Overview

overview

8

Static

static

3

2f2382f436...0N.exe

windows7-x64

7

2f2382f436...0N.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240730-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/08/2024, 01:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2f2382f436bbc6f2efeb5de2ebdb79d0N.exe

  • Size

    118KB

  • MD5

    2f2382f436bbc6f2efeb5de2ebdb79d0

  • SHA1

    e9ac81a43658d7b550d389c4d7fa9cbda28b0899

  • SHA256

    baeee7e3c2d0cb8a7af5d5a946c60294bc4b99a880fd9e89710e7628cb773d2d

  • SHA512

    05f4cc536b633196903286fc290f3240f70f1fcd0ab26cd1f66ce840a2f0bc24275668a489d4a2beeaf552f22de1c9d428f0c32eca92d43779ba6aba6888e652

  • SSDEEP

    3072:COjWuyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPb:CIs9OKofHfHTXQLzgvnzHPowYbvrjD/m

Score
8/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 19 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2f2382f436bbc6f2efeb5de2ebdb79d0N.exe
    "C:\Users\Admin\AppData\Local\Temp\2f2382f436bbc6f2efeb5de2ebdb79d0N.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4236
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5100
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:2128

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\ctfmen.exe
    Filesize

    4KB

    MD5

    1000db831f8967a83384e3ec64b0065d

    SHA1

    e94b34ef08b98fdfca3515ab6bc02bd0948af967

    SHA256

    a1fe2067a32c1300434f6301218ec3b6565aebd5483e511d7d750c9d4d1648c9

    SHA512

    61224638a5932b65f2853c53d44a85eccccb0fec6ae62bfd7d1c9656200de21b8a81d9238ca4aaad9d5cdad112214e3516759ef1368b9918c90a4635c3ef59d8

    Download Submit

  • C:\Windows\SysWOW64\grcopy.dll
    Filesize

    118KB

    MD5

    f71c67068706fb5472eec1e14aba8d1d

    SHA1

    65f61df8f18013816b0f789e1c2105a8eb2abadc

    SHA256

    67aec6b267c4a935819fe949c94fae7489e5383bf878b82bd9b2427c764c818b

    SHA512

    0be9cd171b0be61e0db4e42ccba55529006970461b020481754862df54889ac8ea0c91e5dfbd3cd998783d77c7ceec88df79d40ab7a986092cd5cec74ae4d296

    Download Submit

  • C:\Windows\SysWOW64\satornas.dll
    Filesize

    183B

    MD5

    27edd28bb807ae4b9c4cf45ff9a8fc70

    SHA1

    bd2aafe031e5c40a47072f249ec0a7c29849c820

    SHA256

    aeb6e1b0d14e137f4f4a6036cd6cb0f49bacb0dbcac527a34a5113c0f27f10cf

    SHA512

    f044af48ae7e528c47d179f1686dae37e3300c022dfa9e2585d747b5a0fe6a12bd9c8aff5f35b4dbf295469c7267c4054fe17c51c10fae35a989eb29aacff202

    Download Submit

  • C:\Windows\SysWOW64\shervans.dll
    Filesize

    8KB

    MD5

    337bbd019d3ae9d576d1ade8c8229300

    SHA1

    4031e6fa5f997d8b4aecba02fe6552000a53e8c9

    SHA256

    37b4215de72037ff095fc5d6f810c065312b4b16124d8fc70def097b667474d1

    SHA512

    dd1f44d800c8424f657990ebb880271e941c63494dece77f2fe04244164e81dc38db2fe89866f355598e0f46ac59300c6dec692734cf3e19f1ffae22c8771337

    Download Submit

  • memory/2128-29-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/2128-37-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2128-40-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/4236-0-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/4236-18-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/4236-23-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/4236-22-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/5100-30-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download