Overview

overview

8

Static

static

3

4b162d69d1...0N.exe

windows7-x64

8

4b162d69d1...0N.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-08-2024 00:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4b162d69d170bfb0015c1ff5785b3f10N.exe

  • Size

    2.3MB

  • MD5

    4b162d69d170bfb0015c1ff5785b3f10

  • SHA1

    86c0c347123e854b895c8d87faf6e94c256c6262

  • SHA256

    2ec5fb9a640626c0f8dc5f20c8e6923e3fa971ae1af79cb8344ad55e8664da64

  • SHA512

    abe7e4152d42ac6ded6b226df702138e111e73d45ea2f7b309c643df05bd24cd54e19bb7edc4de579c5a0ede3a41e1c629013c7623ef1a99de46e67867f901e2

  • SSDEEP

    49152:ujvk2d9rJpNJ6jUFdXaDoIHmXMupzh72lxakn2YpHdy4ZBgIoooNe:urkI9rSjA5aDo73pzF2bz3p9y4HgIoov

Score
8/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 19 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4b162d69d170bfb0015c1ff5785b3f10N.exe
    "C:\Users\Admin\AppData\Local\Temp\4b162d69d170bfb0015c1ff5785b3f10N.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Drops file in System32 directory
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2680
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2408
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:1552

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\ctfmen.exe
    Filesize

    4KB

    MD5

    0c99fdd923cca7759b98221ee8895a68

    SHA1

    036941147f89d1033ee1bc5a02b87ad424f50d3e

    SHA256

    cc5c0d5b38c7272d72adfd86bdd3d136358d8a86bbf8d2b067d27b88e5b5c631

    SHA512

    5f88f82ed86da97f70bcc5909d97e8ebc30c655661811a7ded1dc6a3607b75d8bcfbe9df01ab7d6913f2e00353033644e4d31afa2f74f7aa5167a5d54f09526d

    Download Submit

  • C:\Windows\SysWOW64\grcopy.dll
    Filesize

    2.3MB

    MD5

    6695b2a2c7fb8fec45e71bc25ec54aa6

    SHA1

    1e3e37a2e735e828ea61783d210cfcb58aca592e

    SHA256

    10abf5b686a6fc1e87fab43e4b41889cfd5e508b7ec2de24077484a1dfc595c2

    SHA512

    c7271d18a802777955419d34ad2d59f325683b1cef508956db3ea003e2a4da6a0679826a03548e71875ad35a0529ebf5541124c52f61464a8b68b8768faa5cbd

    Download Submit

  • C:\Windows\SysWOW64\satornas.dll
    Filesize

    183B

    MD5

    af3d0f9e951a47ae06d9774bd3c660f8

    SHA1

    d11a6f46c83b2660bc1eba31f39fb58b3b9fcd24

    SHA256

    9a07b47766b66ed6483feef04d99750dab14ddb8ab90501c578b7c4ed50a1acf

    SHA512

    0e68afed1200a27a448e618cd10a4d330d9548d72277f0ec87dc44e5ebd91c09998359d1d9cd0bd26d272f06c7f4eea6dc217625771329bfd23a05823097b1fd

    Download Submit

  • C:\Windows\SysWOW64\shervans.dll
    Filesize

    8KB

    MD5

    a5fbf43814af19bf651e216463054c14

    SHA1

    e90c8d665ac0a418814825a2dc0bcf387b53a0e6

    SHA256

    4283d08fd53b7b0fde45967f50edf3aa4f8981bdf21370e733545f06697618a5

    SHA512

    afd4002082162d5091d4a45c3964bc390a1b0c369b86df0e8128a41cb43a9b96fdbc8c70803fe097a23269fd61f585d6baa15c9966e25f5dd301033034e08e62

    Download Submit

  • memory/1552-48-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/1552-43-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/1552-62-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/1552-60-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/1552-58-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/1552-56-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/1552-32-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/1552-33-0x000000007FA70000-0x000000007FE41000-memory.dmp

    Filesize

    3.8MB

    Download

  • memory/1552-54-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/1552-40-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/1552-41-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/1552-52-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/1552-45-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/1552-46-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/1552-50-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2408-23-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/2680-0-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2680-19-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2680-1-0x000000007FA70000-0x000000007FE41000-memory.dmp

    Filesize

    3.8MB

    Download

  • memory/2680-25-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2680-28-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2680-29-0x000000007FA70000-0x000000007FE41000-memory.dmp

    Filesize

    3.8MB

    Download