Overview

overview

8

Static

static

3

32bad6d7af...6N.exe

windows7-x64

8

32bad6d7af...6N.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    03/10/2024, 06:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    32bad6d7afc35e49fdee52aad1d8875c85cadb68ee955b2efd6ab1010b3e6786N.exe

  • Size

    2.3MB

  • MD5

    7443b76914f066a40732d5fc589f6490

  • SHA1

    b01922e06fc3a6f114e1e045260cdb335b6a0744

  • SHA256

    32bad6d7afc35e49fdee52aad1d8875c85cadb68ee955b2efd6ab1010b3e6786

  • SHA512

    208d92eca56f39886ff7b44edb2ede15375816bb4c0af04de57778f2ee3b3ac9ad7f9a22fa5d70e037c86c14f622ed22050396ccca1054f4972237c1ebe646ad

  • SSDEEP

    49152:78F4GBYEFMfVrt0HdZyZUKIKp9/bIA3e63wDknToN58zkfwHuVfcu5ZJFKsnfKUn:78F4GBY3dR0HHyZ9p9DIAvADkQ8gfwOj

Score
8/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 19 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\32bad6d7afc35e49fdee52aad1d8875c85cadb68ee955b2efd6ab1010b3e6786N.exe
    "C:\Users\Admin\AppData\Local\Temp\32bad6d7afc35e49fdee52aad1d8875c85cadb68ee955b2efd6ab1010b3e6786N.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Drops file in System32 directory
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1464
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2812
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2044

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\SysWOW64\satornas.dll
          Filesize

          183B

          MD5

          354dc7f45fbd63dff9851ba01716c443

          SHA1

          c2019097501dfa82df79815f048412f4952ef0e9

          SHA256

          69910cb543e8e9d3e523e31a3dced0bd06e95832f4a5aeec2d5340ffae8c0c78

          SHA512

          67a9bc233ff94f6da562c0474d8c47e68d20d5dc52c2f428a48dc588afa17c6a2db18ea2f3b986c5d55dc63ae2f0a78f7b93fb43d5c097490f089ccbb2dbcfe8

          Download Submit

        • \Windows\SysWOW64\ctfmen.exe
          Filesize

          4KB

          MD5

          1414d8289ea49a738ec7edeeaad55991

          SHA1

          b69569114a3704cd0a3d8b357e0b1a76ad69fc58

          SHA256

          fbe12c80c11b5fa7bdefb8b29388b6fff331296c2cbc69681e353dfd651c9aef

          SHA512

          1fddf9d2486fcc4bac59d493c0ddb581bf8f48d114b9ee79ff9f573bfcf773f4c5bf9f452c8a24f848c951ccefdd335669683a2697b351cf6d640c9d871d2ae0

          Download Submit

        • \Windows\SysWOW64\shervans.dll
          Filesize

          8KB

          MD5

          eae5667f54acd5ee6872d5ddcb8c5859

          SHA1

          18b03e18110931a8df74513690ba8507deb2087f

          SHA256

          825e9296809d14c216f560a3ff97564c7edb1d1fbe0e425c2746582c637c49ce

          SHA512

          f9312608a57fdb2b13b8a401ab2fdfb84b2341c29279d982a350811ee0cfb63c2a1622b05bd5367e96a1f3615f2fe456e1a0fb93f29d6e4505cb30eaafddc319

          Download Submit

        • \Windows\SysWOW64\smnss.exe
          Filesize

          2.3MB

          MD5

          c6ed42a9555fbae5526e123c0eb6aea9

          SHA1

          97e6ae995f38604608ef29acf1fce1825ec4ea74

          SHA256

          f6a2ebbc4650cb21a5c6aeb1b3c2465d2f4618470f546b23c0b1e430cb9fe69c

          SHA512

          5098040e1ada473e02402f487f1bf9163e009171de296b9b524717d245acec33e0f135a06e041d867cd56f09283cf96905b551b9dda0114c0214575429a180f4

          Download Submit

        • memory/1464-36-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

          Filesize

          3.8MB

          Download

        • memory/1464-1-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

          Filesize

          3.8MB

          Download

        • memory/1464-13-0x0000000010000000-0x000000001000D000-memory.dmp

          Filesize

          52KB

          Download

        • memory/1464-20-0x0000000000390000-0x0000000000399000-memory.dmp

          Filesize

          36KB

          Download

        • memory/1464-28-0x0000000010000000-0x000000001000D000-memory.dmp

          Filesize

          52KB

          Download

        • memory/1464-25-0x0000000000400000-0x0000000000DC2000-memory.dmp

          Filesize

          9.8MB

          Download

        • memory/1464-26-0x0000000000390000-0x0000000000399000-memory.dmp

          Filesize

          36KB

          Download

        • memory/1464-0-0x0000000000400000-0x0000000000DC2000-memory.dmp

          Filesize

          9.8MB

          Download

        • memory/2044-43-0x0000000010000000-0x000000001000D000-memory.dmp

          Filesize

          52KB

          Download

        • memory/2044-52-0x0000000000400000-0x0000000000DC2000-memory.dmp

          Filesize

          9.8MB

          Download

        • memory/2044-35-0x0000000000400000-0x0000000000DC2000-memory.dmp

          Filesize

          9.8MB

          Download

        • memory/2044-66-0x0000000000400000-0x0000000000DC2000-memory.dmp

          Filesize

          9.8MB

          Download

        • memory/2044-45-0x0000000000400000-0x0000000000DC2000-memory.dmp

          Filesize

          9.8MB

          Download

        • memory/2044-47-0x0000000010000000-0x000000001000D000-memory.dmp

          Filesize

          52KB

          Download

        • memory/2044-46-0x0000000000400000-0x0000000000DC2000-memory.dmp

          Filesize

          9.8MB

          Download

        • memory/2044-48-0x0000000000400000-0x0000000000DC2000-memory.dmp

          Filesize

          9.8MB

          Download

        • memory/2044-50-0x0000000000400000-0x0000000000DC2000-memory.dmp

          Filesize

          9.8MB

          Download

        • memory/2044-37-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

          Filesize

          3.8MB

          Download

        • memory/2044-54-0x0000000000400000-0x0000000000DC2000-memory.dmp

          Filesize

          9.8MB

          Download

        • memory/2044-56-0x0000000000400000-0x0000000000DC2000-memory.dmp

          Filesize

          9.8MB

          Download

        • memory/2044-58-0x0000000000400000-0x0000000000DC2000-memory.dmp

          Filesize

          9.8MB

          Download

        • memory/2044-60-0x0000000000400000-0x0000000000DC2000-memory.dmp

          Filesize

          9.8MB

          Download

        • memory/2044-62-0x0000000000400000-0x0000000000DC2000-memory.dmp

          Filesize

          9.8MB

          Download

        • memory/2044-64-0x0000000000400000-0x0000000000DC2000-memory.dmp

          Filesize

          9.8MB

          Download

        • memory/2812-29-0x0000000000400000-0x0000000000409000-memory.dmp

          Filesize

          36KB

          Download