Overview

overview

8

Static

static

3

6d886eadbf...9N.exe

windows7-x64

8

6d886eadbf...9N.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    120s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    30/09/2024, 22:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6d886eadbff80170a8974d6f6d4eefb3d7ce1f06b672af2224f933fbe1bddbd9N.exe

  • Size

    2.3MB

  • MD5

    825daf731bf5e5c1e833a1f9e2b92a10

  • SHA1

    921a66e85e76318473d14cac8e3e338b1aa16655

  • SHA256

    6d886eadbff80170a8974d6f6d4eefb3d7ce1f06b672af2224f933fbe1bddbd9

  • SHA512

    20fc3bdc78d74f8a7c91bc361862deb7ce0d3df42c752c1c7a289bbe9b37ab9711851394b6796501c5f68909c743767f720108e250a704d5613ffd7b7520a1f2

  • SSDEEP

    49152:Kjvk2d9rJpNJ6jUFdXaDoIHmXMupzh72lxakn2YpHdy4ZBgIoooNe:KrkI9rSjA5aDo73pzF2bz3p9y4HgIoov

Score
8/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 19 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6d886eadbff80170a8974d6f6d4eefb3d7ce1f06b672af2224f933fbe1bddbd9N.exe
    "C:\Users\Admin\AppData\Local\Temp\6d886eadbff80170a8974d6f6d4eefb3d7ce1f06b672af2224f933fbe1bddbd9N.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Drops file in System32 directory
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2536
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2084
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2456

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\satornas.dll
    Filesize

    183B

    MD5

    369673631df2255fc6e1d3af090b77b8

    SHA1

    86f1fdc63f7af845781518679b2b55744e1168f1

    SHA256

    94e586e05dd5e375e54b5f5fe09327a311f6cd321fd1aaad6d10db14d5d5bbc8

    SHA512

    6211b75e2647305f8f3260cd57b895cb1dad1e1fc7d3236d21f1ae6bdc5342d94f3d418794ae5ec2d75ca3229cc38eda2f8bfae20f10cd9a04e8d80ddeacbdbd

    Download Submit

  • \Windows\SysWOW64\ctfmen.exe
    Filesize

    4KB

    MD5

    79ab14783f9582d3e5e2ec1e7a194c27

    SHA1

    079ee7c48a3823bd59a3758e4702dee9ed69b8e3

    SHA256

    975d3a3444d87f06311e598f9273de6ce305fcc70162714f826673b0a3712e42

    SHA512

    71e817aaa023f62564be793da08258c019d2168ced0f4b04d933122bf4376ed8feb72aff6140936f72581dd7bd80c5606077cdf48dcfb86e8b62780678210628

    Download Submit

  • \Windows\SysWOW64\shervans.dll
    Filesize

    8KB

    MD5

    464ce23067dc3de9bd19a7cb1c29da70

    SHA1

    fb69d823dddb6566049672074feddf0298bfde05

    SHA256

    7fa1bec9d45b07bdfaa1c3aca00c330acaca41b4304a4271f78d13352bb1520d

    SHA512

    339a75bb677bcd71541807120be340c584ea63184bb2d3450bc87089c28e69dbbebe5cce2b8c14653a4a3db0cb3261b4478365ceb13a51ecab86371afc7bf040

    Download Submit

  • \Windows\SysWOW64\smnss.exe
    Filesize

    2.3MB

    MD5

    90f35d9a2a5fab4fdaea9d1d56bb380f

    SHA1

    d87f432d5be203bf367dfcede6c31995170b9311

    SHA256

    98283c36f0887fffbefaa85934add28e458dc61e2fa5b1a40524197f68169e65

    SHA512

    e27fc0e4b962ba750632aee0232542798daa8b341a11c9f4a2d71c95cc5e2271516982bbec11dbfcf8835ba6ab179b5554545762e54ba5c267e6dddbd3f59382

    Download Submit

  • memory/2084-28-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/2456-57-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2456-46-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2456-67-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2456-65-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2456-35-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2456-63-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2456-48-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

    Filesize

    3.8MB

    Download

  • memory/2456-37-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

    Filesize

    3.8MB

    Download

  • memory/2456-43-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2456-61-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2456-59-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2456-55-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2456-53-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2456-47-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2456-49-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2456-51-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2456-45-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2536-36-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

    Filesize

    3.8MB

    Download

  • memory/2536-20-0x0000000000170000-0x0000000000179000-memory.dmp

    Filesize

    36KB

    Download

  • memory/2536-27-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2536-1-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

    Filesize

    3.8MB

    Download

  • memory/2536-33-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2536-13-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2536-0-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download