Overview

overview

8

Static

static

3

d74b7fa156...0N.exe

windows7-x64

8

d74b7fa156...0N.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    29/08/2024, 01:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d74b7fa1562d5dd8eb25e845433c6150N.exe

  • Size

    119KB

  • MD5

    d74b7fa1562d5dd8eb25e845433c6150

  • SHA1

    9def9a31ab29ccd7ad6e89b37bb559bfd4779a49

  • SHA256

    8c5e2733a6003b6d30be8eb733be37a8431a41d8a84cd5c501fabcba2aab712b

  • SHA512

    afba5c649706751370168fb2c121e3b4646e5afa37f7cccd8754da6bfc1ec02cca177e8d53e0f0a57424907051682335ca77d6111a5b9ba79fd5e4126595c68a

  • SSDEEP

    3072:jOjWuyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPh:jIs9OKofHfHTXQLzgvnzHPowYbvrjD/E

Score
8/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 19 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d74b7fa1562d5dd8eb25e845433c6150N.exe
    "C:\Users\Admin\AppData\Local\Temp\d74b7fa1562d5dd8eb25e845433c6150N.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2848
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2868
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:2656

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\satornas.dll
    Filesize

    183B

    MD5

    99a0c659db14e79d4dccd0726dbc3aad

    SHA1

    1cb82217b8667011982323477839cfec833d4241

    SHA256

    4027159647fa6991991051333fe1020496c2a8d0cece9124aeeb4e5c18c67de7

    SHA512

    04bd048371cd0780eb2ea6c8621910191641309ada1db6749442c454ffaf3fc72c709d8f7ddd243c7deea14ca505ce0c2f69438513294c7868359480ed4359d2

    Download Submit

  • \Windows\SysWOW64\ctfmen.exe
    Filesize

    4KB

    MD5

    c1b2542009b9214ddba89de82166906b

    SHA1

    162d123816a3b5e563d3a58405586ba94ec75355

    SHA256

    cfc0a816d79a7fad91fe1fcc19e33c0d56f8547309bbae9a3dcaf1f631fc64d7

    SHA512

    9b5f898e92a2b1cc9c9125742cc771829d3d5e8ae60d67b1aa924af390b8ed676a4842b1b04ba825a31c5959900105726add40c345d58a4ab84e62f2ac1aab60

    Download Submit

  • \Windows\SysWOW64\shervans.dll
    Filesize

    8KB

    MD5

    9dd2d78ec8132957691c9e5a8ff0db3b

    SHA1

    57f8b4cd40c853e97131f670674e6b8a388fe15b

    SHA256

    fdd9ed17d481b12670ce010df1c5003e72f019f7bf9829f463b4267c597328f3

    SHA512

    68035cf819f56e9b432ffc5cf4eb98ff22fc00e20017204ae30dc4067111a568ca0e15c221720f1896081df3c099a04eff1e0626905c29ba6eaaa5f8c5901399

    Download Submit

  • \Windows\SysWOW64\smnss.exe
    Filesize

    119KB

    MD5

    59c46ce9d2540e0c3d645a03e609d8d6

    SHA1

    e9f988a0003bbba279dce1e9f3c391bb379a100e

    SHA256

    6a5bba13d6ed41398c5ead0cc241d45ac7ff0412470f318a2d8cafa967ab3224

    SHA512

    ac54d63c7b7f66e8649b8c5e185a8677082cbd405c767e1a24a4cb7f1f44f967d88a42bca6a575abbd6861c2285cb0dc2578ba90696806641ec4a1646e182caa

    Download Submit

  • memory/2656-35-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2656-41-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2656-43-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2656-44-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2848-27-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2848-26-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2848-18-0x00000000002D0000-0x00000000002D9000-memory.dmp

    Filesize

    36KB

    Download

  • memory/2848-0-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2848-12-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2868-28-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/2868-33-0x00000000002B0000-0x00000000002D0000-memory.dmp

    Filesize

    128KB

    Download