Overview

overview

8

Static

static

3

2063e4e0fa...0N.exe

windows7-x64

8

2063e4e0fa...0N.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    14/08/2024, 17:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2063e4e0fa2c58792d4ce3aaf0f4b7c0N.exe

  • Size

    119KB

  • MD5

    2063e4e0fa2c58792d4ce3aaf0f4b7c0

  • SHA1

    98b44163c19c4570a3d87e75f299ee936f9db031

  • SHA256

    a8a5d81762e1952f07776b3e879005a336c39d06ed859e0f12da13c37d38fb74

  • SHA512

    496da185827b61c44e33c6f5a15af820d663bb8f37f9dfe38425481c745624b34971082272aa6b3e953e96a05e0e0f7f5adf8d36ebd347bc94c7e422b9a8d0e2

  • SSDEEP

    3072:3OjWuyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPh:3Is9OKofHfHTXQLzgvnzHPowYbvrjD/E

Score
8/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 19 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2063e4e0fa2c58792d4ce3aaf0f4b7c0N.exe
    "C:\Users\Admin\AppData\Local\Temp\2063e4e0fa2c58792d4ce3aaf0f4b7c0N.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2728
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2692
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:2960

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\ctfmen.exe
    Filesize

    4KB

    MD5

    080fc4ab689cf300c021a10bc0fd0ed6

    SHA1

    dcf228257c423326b81f8f925fad061ecd86fc9f

    SHA256

    9e671dc547f8931eb4813f180a01c6d4838cfc7a43c23ce8210ce459ff0f75e4

    SHA512

    498649fff9adf959416858a5ceb498e67899b933ea3b01f4a2cfc9636039fc8e68e2c7162376c32b7e4f248b90b6230700f91186498a2ced2cf85b6195dd4d74

    Download Submit

  • C:\Windows\SysWOW64\satornas.dll
    Filesize

    183B

    MD5

    47ff8e35624e914bb152cf373a99cd60

    SHA1

    11bd1206197fc1fe6b20fe7884df62903226fa04

    SHA256

    721102b9f80d42a7299fd71a893a56e0e3ada2308caef2a30b14ccdd6445c208

    SHA512

    13bb1bd8fd2e23a8741422d3ee460b2fd19b94e7e524452c4bd4d088920a548fffeb07ef950a396976dac870433e1d6cbc5d32b1f5a888554d0462398862cc42

    Download Submit

  • \Windows\SysWOW64\shervans.dll
    Filesize

    8KB

    MD5

    6f2e0ae8c8995c644cc8349ba0f346b1

    SHA1

    7bb11e68cc2096e1c90b234f003576541d98d482

    SHA256

    9725228dfcc8b9db12b9db9d27cfabd46ceb9b02c3be98004f10af703ff7394b

    SHA512

    2b4f6b7e17ba1971c5febbfc25a48a06a77de308373f6ded1b520c36a771ce786644aeb83fd3e7d9abe9f62d84e4dce522c5ad250bc79ff21b369698fe9b5a71

    Download Submit

  • \Windows\SysWOW64\smnss.exe
    Filesize

    119KB

    MD5

    3906b58b7bed15f63634d4799c27fd28

    SHA1

    08f12ccb47ab1f3146bd57d23a7df01e91648060

    SHA256

    1f57f8b5ac3b4cf41c5a532800571a6663095358a6c375d03a398cee747497a2

    SHA512

    01f029b128599f106e0e1c553150793427dd824823a4523d6300175a80543e370ea7b9646216453c4ea01e367853916bff40003100a10ccaf2e065c1524d2b6f

    Download Submit

  • memory/2692-32-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/2692-27-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/2692-33-0x0000000000320000-0x0000000000340000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2728-25-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2728-26-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2728-0-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2728-16-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2960-35-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2960-42-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2960-45-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

    Download