Overview

overview

8

Static

static

3

66fc886d57...0N.exe

windows7-x64

7

66fc886d57...0N.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/08/2024, 07:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    66fc886d57d38c41196712a779e90e70N.exe

  • Size

    2.3MB

  • MD5

    66fc886d57d38c41196712a779e90e70

  • SHA1

    b2bbb9e978117a7d714501f8726af134a3fe5859

  • SHA256

    04dc5867bfbd8cb769398ed03ced8fc567db149fb3d24e91a1e14ac57c58802c

  • SHA512

    4f1a5be0f36bf713f98272ecabdfa909ac88cc789ee186c2fa9671d52a9816ed02f5b476f8b2287955477728f186ae7fcb036661c4f94541602495b7c367dd10

  • SSDEEP

    49152:28F4GBYEFMfVrt0HdZyZUKIKp9/bIA3e63wDknToN58zkfwHuVfcu5ZJFKsnfKUn:28F4GBY3dR0HHyZ9p9DIAvADkQ8gfwOj

Score
8/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 19 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\66fc886d57d38c41196712a779e90e70N.exe
    "C:\Users\Admin\AppData\Local\Temp\66fc886d57d38c41196712a779e90e70N.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Drops file in System32 directory
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2580
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4060
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2616

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\ctfmen.exe
    Filesize

    4KB

    MD5

    d4c82c19c708d8f7b39e54185625e182

    SHA1

    47c4bfb332276a45ad9ed790e011b8ba74f34c76

    SHA256

    fc86f3c92f9f2f32b7c1879d7d11e90ce8b837301e8a22a8e2f4966a0320a995

    SHA512

    0d3f872ae7595d0dd213917a09680e374d45e0c926a0eebf6f491983361e71f5e85c1b2754e5a77e9b57527dac3c7a41a8b167cc5b4806d82706bacfa902992b

    Download Submit

  • C:\Windows\SysWOW64\grcopy.dll
    Filesize

    2.3MB

    MD5

    18b6eb06b9382ec28ef7eb08ee912e21

    SHA1

    4414b5bbc3767e2bb4f3958d17d10679e4fb1a39

    SHA256

    c785b7f0a8877985f8d7e8c6171ebb2f3d79ea8d7ae905ef08c19fcdc447bb45

    SHA512

    b90bd96a40ea611efd6325fa1ab06e8e1b7ea73e95d0a6bf144b04f8ee157dc1c0715f05b204357e4f3ec6ef4c455577313693bc5a537cac5410ca516bc4a6e2

    Download Submit

  • C:\Windows\SysWOW64\satornas.dll
    Filesize

    183B

    MD5

    e9c8c61993813e44e7a43292ba26d466

    SHA1

    74c86f52f028f706b165180444d96df19b6534ca

    SHA256

    1b9cb6fbb7e81a486e4db859b7fd78b1bc3b4ca26a57694f3f58ee64a927af33

    SHA512

    9e6c256a6f71559ecc8782e9624a4f7177c6b7f50af1160b3547d9b93921bd64d2652e6b77f75e23f7f79a02c4f91e6413ec0b8389f15019d68ee7b2a7b637ef

    Download Submit

  • C:\Windows\SysWOW64\shervans.dll
    Filesize

    8KB

    MD5

    95aee1fb0769ae86d0aba715d7fb1ac4

    SHA1

    08e3749dcca23d9dcf5db586fc2af60f3d4d4967

    SHA256

    5f0078c093f1e9d5074ba8b759a91975a6943cd424ce0e63ffa6fcb2d1d5cd38

    SHA512

    2df006069b9b931bd944a48a1d30e371a7482d2550f056b5d5c7ea1956c01d90d82526f0b11830cddd44d6fca90100de8c0ac07cb43bc63c13f73e41f653e03a

    Download Submit

  • memory/2580-25-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2580-1-0x000000007FA70000-0x000000007FE41000-memory.dmp

    Filesize

    3.8MB

    Download

  • memory/2580-14-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2580-0-0x0000000000400000-0x0000000000DC2000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2580-31-0x000000007FA70000-0x000000007FE41000-memory.dmp

    Filesize

    3.8MB

    Download

  • memory/2580-30-0x0000000000400000-0x0000000000DC2000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2616-54-0x0000000000400000-0x0000000000DC2000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2616-46-0x0000000000400000-0x0000000000DC2000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2616-34-0x000000007FA70000-0x000000007FE41000-memory.dmp

    Filesize

    3.8MB

    Download

  • memory/2616-40-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2616-33-0x0000000000400000-0x0000000000DC2000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2616-42-0x0000000000400000-0x0000000000DC2000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2616-43-0x000000007FA70000-0x000000007FE41000-memory.dmp

    Filesize

    3.8MB

    Download

  • memory/2616-45-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2616-44-0x0000000000400000-0x0000000000DC2000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2616-64-0x0000000000400000-0x0000000000DC2000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2616-48-0x0000000000400000-0x0000000000DC2000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2616-50-0x0000000000400000-0x0000000000DC2000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2616-52-0x0000000000400000-0x0000000000DC2000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2616-62-0x0000000000400000-0x0000000000DC2000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2616-56-0x0000000000400000-0x0000000000DC2000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2616-58-0x0000000000400000-0x0000000000DC2000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2616-60-0x0000000000400000-0x0000000000DC2000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/4060-22-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/4060-29-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download