Overview

overview

8

Static

static

3

d74b7fa156...0N.exe

windows7-x64

8

d74b7fa156...0N.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    120s
  • max time network
    119s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/08/2024, 01:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d74b7fa1562d5dd8eb25e845433c6150N.exe

  • Size

    119KB

  • MD5

    d74b7fa1562d5dd8eb25e845433c6150

  • SHA1

    9def9a31ab29ccd7ad6e89b37bb559bfd4779a49

  • SHA256

    8c5e2733a6003b6d30be8eb733be37a8431a41d8a84cd5c501fabcba2aab712b

  • SHA512

    afba5c649706751370168fb2c121e3b4646e5afa37f7cccd8754da6bfc1ec02cca177e8d53e0f0a57424907051682335ca77d6111a5b9ba79fd5e4126595c68a

  • SSDEEP

    3072:jOjWuyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPh:jIs9OKofHfHTXQLzgvnzHPowYbvrjD/E

Score
8/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 19 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d74b7fa1562d5dd8eb25e845433c6150N.exe
    "C:\Users\Admin\AppData\Local\Temp\d74b7fa1562d5dd8eb25e845433c6150N.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1852
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1948
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:4440

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\ctfmen.exe
    Filesize

    4KB

    MD5

    e3dad004ab14b02f1938c3729166ab51

    SHA1

    5919c8cf9baa19f4411aa80e2fff8a0cc2471d5f

    SHA256

    ed533d35beb3adf44564ad8be02441774f7ba43f92958dc1e98fe9574f3f5135

    SHA512

    6687e9ee5e4deeb1c53ec9f680a2971be309245d0962118db7bd89f28524adfc4e2a71b82fb878e3b7b41cf29e3b247ab48a14db54974a384f50b2d2b74e2603

    Download Submit

  • C:\Windows\SysWOW64\grcopy.dll
    Filesize

    119KB

    MD5

    50f27a1cb1672ef34dcffb0966a70e56

    SHA1

    cffe893119152f39d5cace1dc92cc927ab8d1a15

    SHA256

    bbaff2f47170d2e90a7e335dd9b0f30f2362220d6aa71b70fa6b9d0285d184f3

    SHA512

    d4a575dfe1a67a9396b6ff9275b4e80f2b88f6aad96fcc4b87aec3a87b0965472c1eb943349d34adda25d6d59b15190d2d9ce739ff486e28bee37593a0f3df9c

    Download Submit

  • C:\Windows\SysWOW64\satornas.dll
    Filesize

    183B

    MD5

    dadb597e97eb1ca76d0ff52e7623c058

    SHA1

    ea43db7180b953df715025cafe438b00346b42eb

    SHA256

    082fdf239204f04d44708710e474db3d2f2200a1244247806f135685c38bd55f

    SHA512

    20a59cb314731dfdbffbc08a663147ee51095914d2735d58f517fca1bcade46c865c9f85a0c06986d41cb39923df55a8d95cadce5533882112c0f178d6bf4fb2

    Download Submit

  • C:\Windows\SysWOW64\shervans.dll
    Filesize

    8KB

    MD5

    b8e2d7a0033178ce17b0eae139d25ed0

    SHA1

    2220d5fdee37242c84823166cfb269510830f5cd

    SHA256

    240009feac1d4dd589fe8fe97120b21329f30cf302733d36d2778a5f9bacc0cf

    SHA512

    8b550e28a5350ccbe2a5dbcaca7b4d5d189d0aaab29a8263a31936f485cb9bb66ff70410c9783fe14f18f19ab3297a6dd628fb18d80cace7ff4ed6372b59d519

    Download Submit

  • memory/1852-24-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/1852-0-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1852-23-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1852-13-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/1948-21-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/1948-30-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/4440-28-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

    Download

  • memory/4440-37-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/4440-39-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

    Download

  • memory/4440-40-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download