Overview

overview

8

Static

static

3

160d2b1d2c...a9.exe

windows7-x64

7

160d2b1d2c...a9.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/09/2024, 18:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    160d2b1d2ce33182cb13191cca0b98d71c403681047eb318a8e0c36483ee95a9.exe

  • Size

    173KB

  • MD5

    5fd816d9d884fea888390ff0c85ff029

  • SHA1

    c6fb6c36691c7e79543707d1c16731677f11ecdd

  • SHA256

    160d2b1d2ce33182cb13191cca0b98d71c403681047eb318a8e0c36483ee95a9

  • SHA512

    d3c2d2a6686e8b215152b2307315790b1b29a7f89ebac20210f6981f3c34681a62c579b443f2cf457985ed01f045f0ba35e711baa92f2abc0405b05f3f2073b6

  • SSDEEP

    3072:YOjWuyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPq:YIs9OKofHfHTXQLzgvnzHPowYbvrjD/5

Score
8/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 19 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\160d2b1d2ce33182cb13191cca0b98d71c403681047eb318a8e0c36483ee95a9.exe
    "C:\Users\Admin\AppData\Local\Temp\160d2b1d2ce33182cb13191cca0b98d71c403681047eb318a8e0c36483ee95a9.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3604
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3540
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:3232

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\SysWOW64\ctfmen.exe
          Filesize

          4KB

          MD5

          6fd374e2b8e307e7bb569c39d3ef4651

          SHA1

          ca5fe8310cac6dd5ea641a4a296b806cf44c2add

          SHA256

          0d4c7f6a2f2b08025dc538844c1acabceb82c09ed5723e29ede19c2aa89563d6

          SHA512

          efde43a92a7f4b4430fcb273157a203daf901a5030f7040c8c8b56734072060c91a569d7ad2cb4aa069cad9ef89a45e277d2bfcad6c68afccb484775a3208ba3

          Download Submit

        • C:\Windows\SysWOW64\grcopy.dll
          Filesize

          173KB

          MD5

          2374dfebc6450ec849ed538a6cbb071c

          SHA1

          112f837489b0c52559add6aa2420d9eafd99bdc9

          SHA256

          f29e197ca6568e6206188341bab01c3a8cb79e180b5fdae8f65356622ce87118

          SHA512

          0f73e6f99dc5bcb5e63294ffa7115499786f6b875103993aa66cfeb97fba92b90215973268f281945d9442c9ae38ae63ed88898d769481c6ae5f1e06c1246ef2

          Download Submit

        • C:\Windows\SysWOW64\satornas.dll
          Filesize

          183B

          MD5

          1575f0bd6b9f26d487402f07e0d3f778

          SHA1

          9358a452b57ca6178d9ebc91607885b99718cceb

          SHA256

          746998976b3aeacd8adeffa976aee66225f705cdc69502b0922d7ce561c5ca26

          SHA512

          95866f9d721bc842fdd65efc6d086d4bd67fc6c9a1fca4fed9e44e32b402cf4b8990b4ece0dd9c3b7330a434e83821d445ad5e60d9023c267d440a6f7d97a778

          Download Submit

        • C:\Windows\SysWOW64\shervans.dll
          Filesize

          8KB

          MD5

          a99688527a173e62ae380722b45f2f06

          SHA1

          2c00f0b1e1cdcbd38142c4d9ded1e9f701406aac

          SHA256

          9463c7bc4c8b2ef6033efdbebae8ed6fde95f1e0a684e34dcbe29172e31cc1a4

          SHA512

          7db8e73bde024d6e0e8226cfe38ef9c564dc7e76f683a6a09a116f5daa2ca629877bf27d1e6ff71b00e00a7b9faac30cfa2306b0848ba8b5a8138bbb22418ba6

          Download Submit

        • memory/3232-30-0x0000000000400000-0x0000000000432000-memory.dmp

          Filesize

          200KB

          Download

        • memory/3232-40-0x0000000010000000-0x000000001000D000-memory.dmp

          Filesize

          52KB

          Download

        • memory/3232-39-0x0000000000400000-0x0000000000432000-memory.dmp

          Filesize

          200KB

          Download

        • memory/3232-37-0x0000000010000000-0x000000001000D000-memory.dmp

          Filesize

          52KB

          Download

        • memory/3540-29-0x0000000000400000-0x0000000000409000-memory.dmp

          Filesize

          36KB

          Download

        • memory/3540-25-0x0000000000400000-0x0000000000409000-memory.dmp

          Filesize

          36KB

          Download

        • memory/3604-0-0x0000000000400000-0x0000000000432000-memory.dmp

          Filesize

          200KB

          Download

        • memory/3604-23-0x0000000000400000-0x0000000000432000-memory.dmp

          Filesize

          200KB

          Download

        • memory/3604-24-0x0000000010000000-0x000000001000D000-memory.dmp

          Filesize

          52KB

          Download

        • memory/3604-13-0x0000000010000000-0x000000001000D000-memory.dmp

          Filesize

          52KB

          Download