Overview

overview

8

Static

static

3

1f1f328608...0N.exe

windows7-x64

8

1f1f328608...0N.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    119s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    05/09/2024, 00:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1f1f328608829869b4bccd21a4c9fca0N.exe

  • Size

    2.3MB

  • MD5

    1f1f328608829869b4bccd21a4c9fca0

  • SHA1

    fe64127f677bcad665ee537b55a37849a7695857

  • SHA256

    3eaf012312e8d219792889fc7a37588152f6414c32458d59aa0282821663e202

  • SHA512

    4e1830338485116ea5db9c9b7032d8cced5a40593c9a91a03bb1f355d80ddea9ae5ad5c8bac188a959a06bcdceb0642711996e7e8befd7ef263933660acdb87c

  • SSDEEP

    49152:Rjvk2d9rJpNJ6jUFdXaDoIHmXMupzh72lxakn2YpHdy4ZBgIoooNe:RrkI9rSjA5aDo73pzF2bz3p9y4HgIoov

Score
8/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 19 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1f1f328608829869b4bccd21a4c9fca0N.exe
    "C:\Users\Admin\AppData\Local\Temp\1f1f328608829869b4bccd21a4c9fca0N.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Drops file in System32 directory
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1568
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2384
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2760

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\satornas.dll
    Filesize

    183B

    MD5

    0b836b92742a8e787a2a94e3bfbea27b

    SHA1

    2e480de1c4b5d9ea25c348add8738fd30dc20f9e

    SHA256

    9f6725ca033caa10384ae332df65cd3c7780e37dcdb5040f1b17f9ab2252221c

    SHA512

    b4dc25516a21ff621a155d741686450f94b0ae04b5eaa81cdcee2e4a17190d786ceecae8cfa68d353666883e210d9def2a84046616467fe7561062e83a2f8d3e

    Download Submit

  • C:\Windows\SysWOW64\smnss.exe
    Filesize

    2.3MB

    MD5

    06a4672c9bb3ca641acbc3eca007f793

    SHA1

    35659d7f69b59530f75350f9aa24856bb4735bee

    SHA256

    046e9d4cbcbb91b9f9ba8ae2748c13c12a702a9ad7ca57cc37b5bedd991abf14

    SHA512

    865fde5076475b0dbc75d8a2e9f465e1ddf730ba81e7ea14bab7f74701f71a335d498963bfb05012cc5d6ec8e7de820b83dfbbd4f9bd9ba2cd2d1c6ed71f58e0

    Download Submit

  • \Windows\SysWOW64\ctfmen.exe
    Filesize

    4KB

    MD5

    b8ecf2d5a4836077ed66598b71d8ff9d

    SHA1

    81253964fddcf4b2ec64f45d36ee7531ce55c35a

    SHA256

    82d75fdf4d4db81dcb48d4ad49ad9c39514f575a99a963521b1c958339bad44c

    SHA512

    146e38b125fbd02fb02d1f714378513fd55c15b64182dec25db591d0a978f665e5b47db9cf4a9f0590096f898fe3a1087464446fc5f98e62f43b674988284a9c

    Download Submit

  • \Windows\SysWOW64\shervans.dll
    Filesize

    8KB

    MD5

    7d3af9133d58217d22f5800fced546ab

    SHA1

    f7625e0955538cdff8cf9d9780277385d9f1509e

    SHA256

    1930821e9d10af9f886373d021bd19de51945c6408ac381e856413eb0b72e358

    SHA512

    8e80ba6df2702356499997c6926518c5d9a09840455dddd6364373f81cbf2382310e215fc32b329a9da840cbd437739c5e5599c88903334744fce032d65d7719

    Download Submit

  • memory/1568-26-0x0000000000250000-0x0000000000259000-memory.dmp

    Filesize

    36KB

    Download

  • memory/1568-20-0x0000000000250000-0x0000000000259000-memory.dmp

    Filesize

    36KB

    Download

  • memory/1568-0-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/1568-30-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/1568-25-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/1568-31-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/1568-29-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

    Filesize

    3.8MB

    Download

  • memory/1568-13-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/1568-1-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

    Filesize

    3.8MB

    Download

  • memory/2384-32-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/2384-38-0x0000000000890000-0x000000000125E000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2760-46-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2760-56-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2760-39-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2760-48-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2760-50-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2760-51-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

    Filesize

    3.8MB

    Download

  • memory/2760-49-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2760-52-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2760-54-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2760-40-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

    Filesize

    3.8MB

    Download

  • memory/2760-58-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2760-60-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2760-62-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2760-64-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2760-66-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2760-68-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2760-70-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download