Overview

overview

8

Static

static

3

f9bbb5706c...8a.exe

windows7-x64

8

f9bbb5706c...8a.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    12/09/2024, 03:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f9bbb5706c25b8df7f82a58d9fefb3a1d30c82cba5431b47d00286cd5bf35e8a.exe

  • Size

    119KB

  • MD5

    c6958e0ebef24e368cf7df5dfaf65f0d

  • SHA1

    27815b29a74bc5d12567b03fce1381bb2f104419

  • SHA256

    f9bbb5706c25b8df7f82a58d9fefb3a1d30c82cba5431b47d00286cd5bf35e8a

  • SHA512

    f1ba823286f8e0a6bf32f4d278692a6a14bc111e1608b12dfeeeca2d422ffb1fc6b41d5e645dd9e565a9bd78c213a46870c2e5778121216ef0b9ccac966d5381

  • SSDEEP

    3072:UOjWuyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPh:UIs9OKofHfHTXQLzgvnzHPowYbvrjD/E

Score
8/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 19 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f9bbb5706c25b8df7f82a58d9fefb3a1d30c82cba5431b47d00286cd5bf35e8a.exe
    "C:\Users\Admin\AppData\Local\Temp\f9bbb5706c25b8df7f82a58d9fefb3a1d30c82cba5431b47d00286cd5bf35e8a.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2300
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2692
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:1012

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\satornas.dll
    Filesize

    183B

    MD5

    ebcef4990f2c7b5259ba2599e4c09e70

    SHA1

    03c8c86bb733ee2b121de5fd0a46ac65be9bd88d

    SHA256

    f4f3c35f51def5df43c4757eb489593e3c2f66e3f1124bd14bb3b2580849f48b

    SHA512

    fbd022ca616218d7ebfd6d454535b39c5d62a8b3d13270aec973fd3f737b1b11791a6ba2f198bba92909e9bba687b80d6749c4b4cad92532a28b4bc78cbf2ece

    Download Submit

  • C:\Windows\SysWOW64\smnss.exe
    Filesize

    119KB

    MD5

    a64308837791badfb271be7be77afaae

    SHA1

    d2fc83cdb4fc123f60eb4051b4d8504664ec098a

    SHA256

    aa46ef86b6e9942c26d565b07e80ef05a3001c0ff8ce1526119e0cb88ab49a2b

    SHA512

    ce6deec0130385832a986ce16c5c8e506ec153ab5bd6953207de46f0205116a67ead1db112b2ff92b6401a5900d6e357112e21a1fc3340b9231a6a9f1722acf1

    Download Submit

  • \Windows\SysWOW64\ctfmen.exe
    Filesize

    4KB

    MD5

    1573bc3e7ff375962d95429dd1f4fbb8

    SHA1

    1960a84a682d872db1ea2e5f4359624e1306dbfa

    SHA256

    9345e3315ae73ed672ad704101041801136495fa312020c7c0923cc718828e95

    SHA512

    b2ecfbade168cd199aa1184520ff3bee6755ea007add3e686186c5d9a416542fe6a9f076e078988cc95881a29a719d28e30d51fcbe45865b7431e52ad43e9998

    Download Submit

  • \Windows\SysWOW64\shervans.dll
    Filesize

    8KB

    MD5

    6c23678ef17a4c03ac4bd295af92570f

    SHA1

    991c4d19b1ec08d2611752929facd43bcb7484e5

    SHA256

    2dbba88336df065e9a9f7cf89a253c3d17085545e8ce5e614f0de10c0feac05f

    SHA512

    3807707816dc06fb37942462a936d556f5bc4064d778e980543cdb0719fd49bfda6d04909d7aa98913eae2b9f1e2f3d5ddc8169e892e3121788903a5610de055

    Download Submit

  • memory/1012-46-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/1012-45-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1012-36-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1012-42-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2300-18-0x00000000003C0000-0x00000000003C9000-memory.dmp

    Filesize

    36KB

    Download

  • memory/2300-27-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2300-26-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2300-0-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2300-12-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2692-28-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/2692-33-0x00000000002B0000-0x00000000002D0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2692-34-0x00000000002B0000-0x00000000002D0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2692-44-0x00000000002B0000-0x00000000002D0000-memory.dmp

    Filesize

    128KB

    Download