Overview

overview

8

Static

static

3

c599e2b50d...e2.exe

windows7-x64

8

c599e2b50d...e2.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    146s
  • max time network
    117s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    07/08/2024, 02:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c599e2b50df2ec204ca0ee1d5586ed5d0acf85c3e0bcbcade89b74b1ff7fdfe2.exe

  • Size

    75KB

  • MD5

    d45b15ca1abe56158120e0fcff16e68c

  • SHA1

    e4fcd22a3632669b7f0b8ac44c6d27aa1a551bca

  • SHA256

    c599e2b50df2ec204ca0ee1d5586ed5d0acf85c3e0bcbcade89b74b1ff7fdfe2

  • SHA512

    ab877a50323f9756278f43547dc7447a8f1a63369fb3eeb3f64fedf15815526d9f74cdb5162f40875b1860fc60855c99a47dc95a80ae0b5f2afca4119df80a12

  • SSDEEP

    1536:hx1Qja7luy6y0s4sqfkbnAKBOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3s:bOjWuyt0ZsqsXOKofHfHTXQLzgvnzHPE

Score
8/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 19 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c599e2b50df2ec204ca0ee1d5586ed5d0acf85c3e0bcbcade89b74b1ff7fdfe2.exe
    "C:\Users\Admin\AppData\Local\Temp\c599e2b50df2ec204ca0ee1d5586ed5d0acf85c3e0bcbcade89b74b1ff7fdfe2.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2556
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2972
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:2768

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\ctfmen.exe
    Filesize

    4KB

    MD5

    4ed9d5728eaebec5f0e43746e792b969

    SHA1

    ad925e6d386490e4a0159c0df2b5455df7bb828c

    SHA256

    8548d9a6edd4c8853d8ccd418ce430899a6e49bc77347ebe740d9f13df589536

    SHA512

    1eff94d870f8ba4f09ab207170e2947c3c1382e4cb4fc6cb7c09aefbfefaa7c795c2a3245baa0312fd2c6927bf9f7d819d50a11e1ac577cac907b602dec97f59

    Download Submit

  • C:\Windows\SysWOW64\satornas.dll
    Filesize

    183B

    MD5

    5588ccf6033336f7e57ecae62d5e7aef

    SHA1

    9eb575b9c7e8b74c9f20d94cf5c84cfd90c798e0

    SHA256

    1d777d53a9a87b0423f068cbd378354c936a88e40e84ead7f39c42b29fd958bf

    SHA512

    bdaeb664dce3007fd1b3778ab785b74d2539fd2cbb5f2607e4ccfec50e232d191af52f02da3c2b02f7a30c8de78d0d01e48ac7b44fb7f56afadf0f3be5286d63

    Download Submit

  • \Windows\SysWOW64\shervans.dll
    Filesize

    8KB

    MD5

    dfd5b389f25a355f95b031a53054e5d6

    SHA1

    c5b6df4189d4a35b6066b39c8b1eb8b2f9b1d5cd

    SHA256

    b4131bb0e6be01cf3ca5050e1f6b467092291e9187bbbec28c8b074802807def

    SHA512

    69c09c4cc30d162e71693fc289f36ee815a5c51af623e2094df53ba0194ab109e96753da19b3b951a95324acd1dcc7bddc6ae45f9358b2244a1e4babe8ed3800

    Download Submit

  • \Windows\SysWOW64\smnss.exe
    Filesize

    75KB

    MD5

    9281aa8735bbfc79c1ce034ced5a0613

    SHA1

    e60ab5fe579219e59eb76803555e84f9571e4872

    SHA256

    b357579fc43d6a09476a6e0977bdd7e6c4f723c43d8e2611ad05cbb3474fddee

    SHA512

    bd2486db668ba55b71f9dccc10befa541f3cda50828c10b27b045b6bddea03f1088273f214cd3dd8814d725d6bb1fd906505b535651de3a297f35eb88e9ab5bb

    Download Submit

  • memory/2556-25-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2556-22-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/2556-15-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2768-39-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2768-40-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/2768-44-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/2768-46-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/2972-26-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/2972-32-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download