Overview

overview

8

Static

static

3

2bb5021793...3f.exe

windows7-x64

7

2bb5021793...3f.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/08/2024, 19:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    2bb50217932e3ed442b5841a304ddcf74b632e404d2c9d733fec305db7fc863f.exe

  • Size

    2.3MB

  • MD5

    4ca0ececb54694705492971b03f0cc33

  • SHA1

    e35d9fe4966786d23ec6038510f9766d094e9a73

  • SHA256

    2bb50217932e3ed442b5841a304ddcf74b632e404d2c9d733fec305db7fc863f

  • SHA512

    1da0c41890709524c8e3a6182fa52e17c5ce14fe83cf24cd77b989edc0359dbbd585b49818feaaa5a1891326ca8b04367e3eee37d23435f35f148c2ded67ced7

  • SSDEEP

    49152:7jvk2d9rJpNJ6jUFdXaDoIHmXMupzh72lxakn2YpHdy4ZBgIoooNe:7rkI9rSjA5aDo73pzF2bz3p9y4HgIoov

Score
8/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 19 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2bb50217932e3ed442b5841a304ddcf74b632e404d2c9d733fec305db7fc863f.exe
    "C:\Users\Admin\AppData\Local\Temp\2bb50217932e3ed442b5841a304ddcf74b632e404d2c9d733fec305db7fc863f.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Drops file in System32 directory
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3148
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5092
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2872

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\SysWOW64\ctfmen.exe
          Filesize

          4KB

          MD5

          5502a289390d8545dee9262663070381

          SHA1

          0a1e58a7424a6cedb45880620e05253aa43f5ce7

          SHA256

          548dd844782b282a9875a8336e751be2a468f1edffc3f8191220090c963c9b51

          SHA512

          907673804642edc0f6648d927d655c71e034ad7a6a2b6719483d8e503454716cb8da084a09ae463958c63b3ea7047611ca9090c8adf00683410356c7ee2543fb

          Download Submit

        • C:\Windows\SysWOW64\grcopy.dll
          Filesize

          2.3MB

          MD5

          cecd690614f85a7a936626825a5aa211

          SHA1

          9bca8da4388b8e4e7e869da5826d36b0ca7f97fa

          SHA256

          a9dc0d403bae51385328d0a9e269f6518034be24d3465dfd0efcb66b4b49091a

          SHA512

          6ed49ca77084a9811597d74afa46784ad47c9aec3d332c0a1dd887fb5e37e0c629f7870ddc78be1b52b0ce77304eec581f3522832d7d1056da659db3f2c84870

          Download Submit

        • C:\Windows\SysWOW64\satornas.dll
          Filesize

          183B

          MD5

          cbd99f42d978f0729b59b54683d02af8

          SHA1

          a71ae03f4ae0bd0788359a5a8b5594fc44a8ac43

          SHA256

          46e120e8d43e5bc3b35790afd414c75d177a4714fd773e169693194372130297

          SHA512

          848e52a9492972ef2937bced9d31715a226c78f83afda9ddc70f4e64011ce8aa17e88b48eb1933710175389d34b435b112bb6e7c4b758d4bb29159dbcc91ddd3

          Download Submit

        • C:\Windows\SysWOW64\shervans.dll
          Filesize

          8KB

          MD5

          a20d00ba827f34a06d16d73bc34dc1a6

          SHA1

          a914c822baa79cb27dfc024f91d0b92fa719382d

          SHA256

          c2e858baad416fc405acb4ce3c5f54a479fad2dbf9e8c6dd6fc0b28440dd14cd

          SHA512

          8073043cbdeb346a4c9e4fd20ec632c6bc77a0880da1d3732138e2538d18d50658d20c8edc90cf38cfb2a18c0ee2d77918fdadbad5dee6cc991a83390dd5670e

          Download Submit

        • memory/2872-53-0x0000000000400000-0x0000000000DCE000-memory.dmp

          Filesize

          9.8MB

          Download

        • memory/2872-46-0x000000007FA70000-0x000000007FE41000-memory.dmp

          Filesize

          3.8MB

          Download

        • memory/2872-69-0x0000000000400000-0x0000000000DCE000-memory.dmp

          Filesize

          9.8MB

          Download

        • memory/2872-67-0x0000000000400000-0x0000000000DCE000-memory.dmp

          Filesize

          9.8MB

          Download

        • memory/2872-65-0x0000000000400000-0x0000000000DCE000-memory.dmp

          Filesize

          9.8MB

          Download

        • memory/2872-63-0x0000000000400000-0x0000000000DCE000-memory.dmp

          Filesize

          9.8MB

          Download

        • memory/2872-32-0x0000000000400000-0x0000000000DCE000-memory.dmp

          Filesize

          9.8MB

          Download

        • memory/2872-33-0x000000007FA70000-0x000000007FE41000-memory.dmp

          Filesize

          3.8MB

          Download

        • memory/2872-61-0x0000000000400000-0x0000000000DCE000-memory.dmp

          Filesize

          9.8MB

          Download

        • memory/2872-40-0x0000000010000000-0x000000001000D000-memory.dmp

          Filesize

          52KB

          Download

        • memory/2872-41-0x0000000000400000-0x0000000000DCE000-memory.dmp

          Filesize

          9.8MB

          Download

        • memory/2872-43-0x0000000000400000-0x0000000000DCE000-memory.dmp

          Filesize

          9.8MB

          Download

        • memory/2872-45-0x0000000000400000-0x0000000000DCE000-memory.dmp

          Filesize

          9.8MB

          Download

        • memory/2872-59-0x0000000000400000-0x0000000000DCE000-memory.dmp

          Filesize

          9.8MB

          Download

        • memory/2872-47-0x0000000000400000-0x0000000000DCE000-memory.dmp

          Filesize

          9.8MB

          Download

        • memory/2872-49-0x0000000000400000-0x0000000000DCE000-memory.dmp

          Filesize

          9.8MB

          Download

        • memory/2872-51-0x0000000000400000-0x0000000000DCE000-memory.dmp

          Filesize

          9.8MB

          Download

        • memory/2872-57-0x0000000000400000-0x0000000000DCE000-memory.dmp

          Filesize

          9.8MB

          Download

        • memory/2872-55-0x0000000000400000-0x0000000000DCE000-memory.dmp

          Filesize

          9.8MB

          Download

        • memory/3148-0-0x0000000000400000-0x0000000000DCE000-memory.dmp

          Filesize

          9.8MB

          Download

        • memory/3148-15-0x0000000010000000-0x000000001000D000-memory.dmp

          Filesize

          52KB

          Download

        • memory/3148-1-0x000000007FA70000-0x000000007FE41000-memory.dmp

          Filesize

          3.8MB

          Download

        • memory/3148-30-0x0000000000400000-0x0000000000DCE000-memory.dmp

          Filesize

          9.8MB

          Download

        • memory/3148-31-0x000000007FA70000-0x000000007FE41000-memory.dmp

          Filesize

          3.8MB

          Download

        • memory/3148-29-0x0000000010000000-0x000000001000D000-memory.dmp

          Filesize

          52KB

          Download

        • memory/5092-23-0x0000000000400000-0x0000000000409000-memory.dmp

          Filesize

          36KB

          Download