Overview

overview

8

Static

static

3

64ed772144...84.exe

windows7-x64

7

64ed772144...84.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/08/2024, 22:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    64ed77214460e66ef6d0191a9cad0799dd1750511a0946fada93b85fb95a6a84.exe

  • Size

    118KB

  • MD5

    2d8d497590e344f40e8b1af9e8544c93

  • SHA1

    7cd9e5f6f1ee61dee27ba523e3bb41d93eed5d15

  • SHA256

    64ed77214460e66ef6d0191a9cad0799dd1750511a0946fada93b85fb95a6a84

  • SHA512

    f181e297b1bc8aa5f10e7cf38b6e5ffb2fd0128d4c2de18e43f267e8638ee925f34204e7683de368120b9111581be933972bec8b6a0c361873c7ad1e102595aa

  • SSDEEP

    3072:WOjWuyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPP/:WIs9OKofHfHTXQLzgvnzHPowYbvrjD/c

Score
8/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 19 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\64ed77214460e66ef6d0191a9cad0799dd1750511a0946fada93b85fb95a6a84.exe
    "C:\Users\Admin\AppData\Local\Temp\64ed77214460e66ef6d0191a9cad0799dd1750511a0946fada93b85fb95a6a84.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:712
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2608
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:4812

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\SysWOW64\ctfmen.exe
          Filesize

          4KB

          MD5

          f0327a9ab07afe2204a362de6e6987ca

          SHA1

          dc2d591fbb8b528c1b1129195b29e7c5ea7f5685

          SHA256

          ba8a7ee128e3a7987e323e473793085bfbc8ae7650079cab583f8044bf2b368d

          SHA512

          b975a7d1dcd091f5625fc9c233b2ab6ff76a7d7262039deca293ab41c1ca1316b005c33613f72b9ec1d520ac317fa1cd6e49e38848f35d0650db24079e0c949f

          Download Submit

        • C:\Windows\SysWOW64\grcopy.dll
          Filesize

          118KB

          MD5

          bb0df3c06a8fad6817a1e85d55996037

          SHA1

          ffc93b81b9d558d180fc8cddc5e11cc6b5a4a537

          SHA256

          b5a41847d9b845d65d13f56c6e279813d6db5707e6f3f58a2bb9c20845cd07cf

          SHA512

          89da81b325fedde3dcfd7d5ee18b462e164d4f1401f2eb7b2f0500d6bcdd7d49c7ab019267f6c5e8d4a231c83d1bd1cbc8df3c81a884de8685e9059a1b4c431a

          Download Submit

        • C:\Windows\SysWOW64\satornas.dll
          Filesize

          183B

          MD5

          4676c9c2cd63588346b580f26744f496

          SHA1

          5a6e761f66c92428e2a6e498deccc9af15a199e2

          SHA256

          afae2061e304a5e1a2938aab0999072a90051f6a05559471cdb4983d0d87022a

          SHA512

          63000c18af785e565cd1016e22fcbcb0988fe62c86c99b78731d314c12fcc7c90954775280e2dba60e172f74e38be0f78d3a1126f3ced55d48cc1be9c6157a2a

          Download Submit

        • C:\Windows\SysWOW64\shervans.dll
          Filesize

          8KB

          MD5

          d6fa26d85bdc56fcfd43514f4577c4f9

          SHA1

          dc41e5c79b8e117dac88dde1313f0773308370f4

          SHA256

          c407e3ed88ef553d3faebfe40a86e5a5890154451d6061cba49d79d96c05560c

          SHA512

          2870be34a8e8ec2e4ffe5b5c153fbed9e3d010c90ed86ff707e51182cf7f5bfcf500eccf6586963f6b30d18eedd19c70f3c9c929388c19f67b8af338fa0cd963

          Download Submit

        • memory/712-24-0x0000000010000000-0x000000001000D000-memory.dmp

          Filesize

          52KB

          Download

        • memory/712-0-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB

          Download

        • memory/712-23-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB

          Download

        • memory/712-13-0x0000000010000000-0x000000001000D000-memory.dmp

          Filesize

          52KB

          Download

        • memory/2608-21-0x0000000000400000-0x0000000000409000-memory.dmp

          Filesize

          36KB

          Download

        • memory/2608-29-0x0000000000400000-0x0000000000409000-memory.dmp

          Filesize

          36KB

          Download

        • memory/4812-30-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB

          Download

        • memory/4812-37-0x0000000010000000-0x000000001000D000-memory.dmp

          Filesize

          52KB

          Download

        • memory/4812-39-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB

          Download

        • memory/4812-40-0x0000000010000000-0x000000001000D000-memory.dmp

          Filesize

          52KB

          Download