Overview

overview

8

Static

static

3

d6560615ad...16.exe

windows7-x64

7

d6560615ad...16.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-09-2024 02:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d6560615ad74ebd6570750b1472326e35d3c84192214d40c4f21d31f0c8ed216.exe

  • Size

    118KB

  • MD5

    8a9011b139bb8172d0dca427c3f458c8

  • SHA1

    21c2f318f3f0154a70a6582dfbf023127c70fb91

  • SHA256

    d6560615ad74ebd6570750b1472326e35d3c84192214d40c4f21d31f0c8ed216

  • SHA512

    63ca6b2ec234cb4e1d1f775c338c8843907a8bb9a2986acecc6ed4bc13ed95dd0bba6eaa918a07fe8c873c88a45cf8e10b5ba692e6fba2505da53c32f830ab6f

  • SSDEEP

    3072:1OjWuyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPb:1Is9OKofHfHTXQLzgvnzHPowYbvrjD/m

Score
8/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 19 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d6560615ad74ebd6570750b1472326e35d3c84192214d40c4f21d31f0c8ed216.exe
    "C:\Users\Admin\AppData\Local\Temp\d6560615ad74ebd6570750b1472326e35d3c84192214d40c4f21d31f0c8ed216.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1132
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3372
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:5104

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\ctfmen.exe
    Filesize

    4KB

    MD5

    60e9ade76198e96022a5b7d003edb1b0

    SHA1

    b4479ac7bc91f6bb3403a3cf32d811ad9d8b0699

    SHA256

    2818986f4117b7e07ee3fba5f355bbc30aaa5c7ef482df32a9dc276ed1bfc888

    SHA512

    519294cec6758f645bde3c6f71ae47d60ef9e2df8452e57fd0e5ceeb80648c6d52a00774e8df789cac9c42df4ee3bbc2f934e0110474ef20420c928c1d0c724f

    Download Submit

  • C:\Windows\SysWOW64\grcopy.dll
    Filesize

    118KB

    MD5

    f1f67f9d63537fbf3ffe6ec5ee442001

    SHA1

    dfca25f8f084f1269cdfb33da2405f2dc2fc8337

    SHA256

    aa0c4654d049292235dbcbf109d37bf8aff8a0ce14c16026043455d895111db7

    SHA512

    28d4c5f8abebf8333b82bf19aa6e90d6430032be526aab3a4e02f623ed86c9ecfe36cc6549457bc2ff39c347fa4cd13d119da7aebe97b87052d31936de9073e2

    Download Submit

  • C:\Windows\SysWOW64\satornas.dll
    Filesize

    183B

    MD5

    a161030a683a7712e0f5c4cf32e64ebe

    SHA1

    eb106d4f2ca3fab03794fdbc17f2bd7903a7d979

    SHA256

    2985ff57b264d75ce39ad34d91c8afeec92184c0c531e9d5cd1dba1b54010d66

    SHA512

    e263a55654d5d873c9732829b07afac57fb3cf1bb88d90c42e4a7a015e161d30d54c250cb33c53302dce53900484f0ad3c9fba4588e844603bbbd5330b31ba5c

    Download Submit

  • C:\Windows\SysWOW64\shervans.dll
    Filesize

    8KB

    MD5

    93ce39a36c6a13adbfa0a042f935a049

    SHA1

    314909e7bae92082d2c8fd6eac9d28c9463b053c

    SHA256

    137b5e523a20873207f6fab61755eed64a4bde1cd633d336bf9522d53015287d

    SHA512

    d217fb96221998c2dbc9f220a3aff4fc9e4bc2dd31c398f5890b0f7cb1a4acabde8d2f7af626a56e520d76a2bdbfbeeaf00770298fa79b4fe62225feaebe0459

    Download Submit

  • memory/1132-23-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/1132-24-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/1132-0-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/1132-12-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/3372-21-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/3372-30-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/5104-31-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/5104-38-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/5104-39-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download