Overview

overview

8

Static

static

3

7fd456d631...0N.exe

windows7-x64

8

7fd456d631...0N.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    120s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    26-07-2024 05:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7fd456d63113f3fafcbebd1913cb6090N.exe

  • Size

    352KB

  • MD5

    7fd456d63113f3fafcbebd1913cb6090

  • SHA1

    8689742a19b2addd248b47c814f9f3ba0c49f7de

  • SHA256

    5fe56b3beff59973589d95112f0f8d41554489f70273628687494493a44a1a79

  • SHA512

    50eaba4ff1c10e547c6de8da415215f2f954854fb088589b350f02c4b537152eaceca56674f544fa6cd0a02757771100ef382375d97eef8d86931f61300035bb

  • SSDEEP

    6144:gIs9OKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPFsEPAsKCe8i:5KofHfHTXQLzgvnzHPowYbvrjD/L7QPs

Score
8/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 19 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7fd456d63113f3fafcbebd1913cb6090N.exe
    "C:\Users\Admin\AppData\Local\Temp\7fd456d63113f3fafcbebd1913cb6090N.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2080
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2768
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:2936

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\satornas.dll
    Filesize

    183B

    MD5

    04fefa52f1a1f00243cac7b4ad4178db

    SHA1

    cb67bf9d21090fe4e3b689887927f4245f102fa2

    SHA256

    40fd2bd58b1ae8e3702717d8c4fb362238a52343658fdfd1b68548ffd87ebe96

    SHA512

    5c4a90ef890bce38a82bc59eed2560c6946cef4d3998bb4502cd8dee9083d58f6e40aa10c7d0f4b7a70da6d330f4e19d77a8d91606c1f01d6723789236d1ac80

    Download Submit

  • \Windows\SysWOW64\ctfmen.exe
    Filesize

    4KB

    MD5

    8e2e6439d506d44f12a2b5c3a733d601

    SHA1

    c4f9c1c126ed29c1dd7b8aeb93e91fd2a98a2efa

    SHA256

    d2a22a1f731211564121c328c4cb270ea9ac7182c212b98e01a5436dd89ad8ce

    SHA512

    a8b9a9a9261cb8c279b6e09f8c4211637fe92b73ac2c88e5313fa6bf0aa3f01f1352d31f25160223c97d3d0ffa3536fbc46fdf5ba2866f15cb47fdc469127522

    Download Submit

  • \Windows\SysWOW64\shervans.dll
    Filesize

    8KB

    MD5

    fb0980738dd19fa0571efcae1cc158b8

    SHA1

    016f5fb7e03bf75f08d741c913ff45386b728474

    SHA256

    22f5d2d4c6f1be08701c8786c091ce2111c975f08da3384d77bd51d81aefb921

    SHA512

    032604a8e330351b66f5690a19b9c53b95186d3a83cb57919d1ed157f8f6438469a26b1485dc9f79f9185f0c4f11f72f3d229213c45d5177dd03043dccfbaefe

    Download Submit

  • \Windows\SysWOW64\smnss.exe
    Filesize

    352KB

    MD5

    8d49ce83022fa5536d680adce0ac85f4

    SHA1

    ea7112108ce0d68255ad07554a0d1d9869077eb2

    SHA256

    3e4922e0c95601dd3fcc0b627f43a7b45fa9939b49c6850a630886c88c5dfdc7

    SHA512

    9a918b9f486039733a12580142a66ae60cd247daba6f46e455f83b565b80c0444241c7fe391ae117d2ee0d56a6c091d023e36a93b625a0b9dc4ba0c5e69e98de

    Download Submit

  • memory/2080-18-0x00000000002D0000-0x00000000002D9000-memory.dmp

    Filesize

    36KB

    Download

  • memory/2080-27-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2080-26-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

    Download

  • memory/2080-0-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

    Download

  • memory/2080-14-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2768-30-0x00000000005C0000-0x0000000000620000-memory.dmp

    Filesize

    384KB

    Download

  • memory/2768-33-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/2768-45-0x00000000005C0000-0x0000000000620000-memory.dmp

    Filesize

    384KB

    Download

  • memory/2936-35-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

    Download

  • memory/2936-41-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2936-43-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2936-46-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

    Download