Overview

overview

8

Static

static

3

51e02c5dc2...0N.exe

windows7-x64

7

51e02c5dc2...0N.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/09/2024, 22:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    51e02c5dc29a230ffafda7f6505db390N.exe

  • Size

    119KB

  • MD5

    51e02c5dc29a230ffafda7f6505db390

  • SHA1

    e28fa26444cd2f3b73fce14052b5687d838c812e

  • SHA256

    9a6e97029c1431b455739dc43fd6bc82d6a3309dee9b8f06c1ed2fa7b2b022fc

  • SHA512

    95d1e67fa78fcd9994cd6b1dd6c54d17f7fd03ae4ad23dfadd8f425713e18b4a7b0803ecca69daacf29b821488cf18372174f88e8b646a45ede6107db5628e13

  • SSDEEP

    3072:KOjWuyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPh:KIs9OKofHfHTXQLzgvnzHPowYbvrjD/E

Score
8/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 19 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\51e02c5dc29a230ffafda7f6505db390N.exe
    "C:\Users\Admin\AppData\Local\Temp\51e02c5dc29a230ffafda7f6505db390N.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2444
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4060
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:1764

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\SysWOW64\ctfmen.exe
          Filesize

          4KB

          MD5

          5c5486ff64f6c21641b7be1267318d91

          SHA1

          18ca11da46d1dd517e84d518efc483914853b9b4

          SHA256

          7261eadc81564a0d28fb24a5893e4455eb4357e3408e3de6b91fbb3d9dfb104a

          SHA512

          ae13afa4271bb1a12367264e5aa70eb8a3b5311ff700826bb2ad3724ae894b9e8fe287f8e49df4c721aedb9ae077354d2fd0ec6dc19e281055217e4fa9cdbb65

          Download Submit

        • C:\Windows\SysWOW64\grcopy.dll
          Filesize

          119KB

          MD5

          4710b273b87e449c91761d2f8f3acd2c

          SHA1

          ef1b0f4e6ac9cc69e184c294f434b1ce0caf27cb

          SHA256

          fb4bc88b06bcd77fffee06ddbe3dd2d8afffaba330d986abe5724b2b8d9553d9

          SHA512

          f4c4f42fdaeb5495b7c2292fa54d8dad823f1d647dc07d2b9dfddd2438addefc12f2bf34b3dac7457fdc41e67cd0c1d6209f4e77bb848d58e9e8168b04006436

          Download Submit

        • C:\Windows\SysWOW64\satornas.dll
          Filesize

          183B

          MD5

          2ad3fdc58283a12e31cd3fd1a47412c9

          SHA1

          cc46059809309309f20952eb5346cd570e98a84c

          SHA256

          15dace0f619d518ed31c78aa687f5ebb029cb2848df49afb86e19e4e50eaa066

          SHA512

          19b1d935565d922416db92385110754406a34cbc5edee0ea84fa206e2828c3d058ad91de49f86af09dc159402a1f444a8e19e5b03ab9c7d4be2e75fdc82ffc12

          Download Submit

        • C:\Windows\SysWOW64\shervans.dll
          Filesize

          8KB

          MD5

          c01f72497c0ad3fb7e73c07ad589a210

          SHA1

          60743899cb52e8ce4ea0a6802f0b7a0c7165c165

          SHA256

          1f8a158da4f339a980051cd9aea07ee9aa9cecd9d96a3593008ce5062a404498

          SHA512

          4e79081ee53a4bf76ce504f1cbe4df55f8653e0e241526fb811519a9a899f85eeaa8bfc9db9bbedcc15614cf18b2e41fc37778d6b1dc1e6cf8e431b502ec38b9

          Download Submit

        • memory/1764-30-0x0000000000400000-0x0000000000420000-memory.dmp

          Filesize

          128KB

          Download

        • memory/1764-38-0x0000000000400000-0x0000000000420000-memory.dmp

          Filesize

          128KB

          Download

        • memory/1764-39-0x0000000010000000-0x000000001000D000-memory.dmp

          Filesize

          52KB

          Download

        • memory/2444-24-0x0000000010000000-0x000000001000D000-memory.dmp

          Filesize

          52KB

          Download

        • memory/2444-23-0x0000000000400000-0x0000000000420000-memory.dmp

          Filesize

          128KB

          Download

        • memory/2444-0-0x0000000000400000-0x0000000000420000-memory.dmp

          Filesize

          128KB

          Download

        • memory/2444-12-0x0000000010000000-0x000000001000D000-memory.dmp

          Filesize

          52KB

          Download

        • memory/4060-22-0x0000000000400000-0x0000000000409000-memory.dmp

          Filesize

          36KB

          Download

        • memory/4060-28-0x0000000000400000-0x0000000000409000-memory.dmp

          Filesize

          36KB

          Download