Overview

overview

8

Static

static

3

834fff2f2e...0N.exe

windows7-x64

8

834fff2f2e...0N.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    29-08-2024 13:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    834fff2f2e4449c865c25079ffff2c70N.exe

  • Size

    75KB

  • MD5

    834fff2f2e4449c865c25079ffff2c70

  • SHA1

    37fa4d1c551051183d807ff9d8ddbaff01df0027

  • SHA256

    2e436330a087aa06f8ab22abbde3665432e22518b1f27c20ae120883aa18a987

  • SHA512

    9178c918562b6ee9e45b2a20b5d8a1f6de21e32e94aac53e80f31b3ad898a6d5dca29b213ce0fd04475cd6512f4d24e68ce159bf2248cff71b0df6adf33ee599

  • SSDEEP

    1536:lx1Qja7luy6y0s4sqfkbnAKBOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3J:vOjWuyt0ZsqsXOKofHfHTXQLzgvnzHPh

Score
8/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 19 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\834fff2f2e4449c865c25079ffff2c70N.exe
    "C:\Users\Admin\AppData\Local\Temp\834fff2f2e4449c865c25079ffff2c70N.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2824
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2840
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:2004

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\satornas.dll
    Filesize

    183B

    MD5

    7816069bb1c0297debea51080abb98d7

    SHA1

    3d1583e7903d926d0f546b7e94b025341151a2fc

    SHA256

    5cfd93a55fb0a413782bf8973ad3819a8b10e453768771a4b0d9fcb895d6d6fe

    SHA512

    46948343a2065f7c2b781c85119b3ee8549ec54dd83230cbbb226d64c306ee25d201b1a7a2829d56142634b54d35d657fffa312fb41cfd9e3cdd233cf78a2119

    Download Submit

  • \Windows\SysWOW64\ctfmen.exe
    Filesize

    4KB

    MD5

    3511d25c98d68ccbbd7217a176b89070

    SHA1

    6e92133db86e78bf92c6138416bf68c52876a03c

    SHA256

    0d3d85938fc5b456d7855bece1423750448aac8fafd7b30e0198b15b601b30e2

    SHA512

    3bb98f4621da659bd97ee8735b77d82874641e8d04090fed4ec2e48235869161f03483d02546160d741f07940eec8768d60dfbe1f38efb3df78ad18efda30605

    Download Submit

  • \Windows\SysWOW64\shervans.dll
    Filesize

    8KB

    MD5

    7afee220f89b52f178f01b93ff4432d8

    SHA1

    e3c0c9be408b23f5a3c516d66b4529c53be33d3e

    SHA256

    665c8130dcd19bf7c3eaf50c0706bef8593c37d6de783ce150bb4fbbbf3bfe91

    SHA512

    e477b010b138ac43a1292f4b651251b96cee3b22c7427edf49274af69190829fd82af1b2a89743f982dc781a526ac77ccc435daf43097dce0e11cd5ce4a89a9a

    Download Submit

  • \Windows\SysWOW64\smnss.exe
    Filesize

    75KB

    MD5

    4a522b2ec59fa74dbbdcf51f6bb64408

    SHA1

    1d3ad15fb5dd74b54bbdb142a1b3eaeda094c493

    SHA256

    4023e16b2eadaa0700ea7c2100aa9b041dea32700db48f5b2f383bdf18edbaef

    SHA512

    3cb648684be5628e9ec9521c96f8d2e822a3067c1f936551e2b9bb64b26943c594f60d14c7f946bd8d7ada8ad34153ff956266e50d2aca4e867d8694a8546317

    Download Submit

  • memory/2004-38-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2004-40-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/2004-41-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2004-42-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/2004-44-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/2004-46-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/2824-24-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2824-22-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/2824-11-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2840-26-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/2840-32-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download