10663ef8ab454757031f4027efc9375f23f9dbf73488c471a16eaa519effddcd

General

Target

10663ef8ab454757031f4027efc9375f23f9dbf73488c471a16eaa519effddcd.exe
Size

119KB
MD5

9828271777175cea0ef2f6da99e29517
SHA1

4a734bef63f42cbbddbb429bb2f845bf80d3a4a3
SHA256

10663ef8ab454757031f4027efc9375f23f9dbf73488c471a16eaa519effddcd
SHA512

45bb9d2815510636f1a97fb56ef9231d9250edbce50506e472ab19965a72047431c7448f6621823743ef9be5fa32a81fdd2e73962780dfb9c734fecf6a882c05
SSDEEP

3072:0OjWuyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPh:0Is9OKofHfHTXQLzgvnzHPowYbvrjD/E

Score

7^/10

discovery persistence

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000b000000023b7b-10.dat	acprotect

Executes dropped EXE 2 IoCs

pid	Process
2704	ctfmen.exe
1772	smnss.exe

Loads dropped DLL 2 IoCs

pid	Process
4552	10663ef8ab454757031f4027efc9375f23f9dbf73488c471a16eaa519effddcd.exe
1772	smnss.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe"	10663ef8ab454757031f4027efc9375f23f9dbf73488c471a16eaa519effddcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe"	smnss.exe

Maps connected drives based on registry 3 TTPs 6 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	10663ef8ab454757031f4027efc9375f23f9dbf73488c471a16eaa519effddcd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	10663ef8ab454757031f4027efc9375f23f9dbf73488c471a16eaa519effddcd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\1	10663ef8ab454757031f4027efc9375f23f9dbf73488c471a16eaa519effddcd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	smnss.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	smnss.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\1	smnss.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\grcopy.dll	10663ef8ab454757031f4027efc9375f23f9dbf73488c471a16eaa519effddcd.exe
File opened for modification	C:\Windows\SysWOW64\grcopy.dll	10663ef8ab454757031f4027efc9375f23f9dbf73488c471a16eaa519effddcd.exe
File opened for modification	C:\Windows\SysWOW64\shervans.dll	10663ef8ab454757031f4027efc9375f23f9dbf73488c471a16eaa519effddcd.exe
File created	C:\Windows\SysWOW64\smnss.exe	10663ef8ab454757031f4027efc9375f23f9dbf73488c471a16eaa519effddcd.exe
File created	C:\Windows\SysWOW64\satornas.dll	10663ef8ab454757031f4027efc9375f23f9dbf73488c471a16eaa519effddcd.exe
File created	C:\Windows\SysWOW64\zipfi.dll	smnss.exe
File created	C:\Windows\SysWOW64\smnss.exe	smnss.exe
File created	C:\Windows\SysWOW64\ctfmen.exe	10663ef8ab454757031f4027efc9375f23f9dbf73488c471a16eaa519effddcd.exe
File created	C:\Windows\SysWOW64\shervans.dll	10663ef8ab454757031f4027efc9375f23f9dbf73488c471a16eaa519effddcd.exe
File opened for modification	C:\Windows\SysWOW64\satornas.dll	10663ef8ab454757031f4027efc9375f23f9dbf73488c471a16eaa519effddcd.exe
File created	C:\Windows\SysWOW64\zipfiaq.dll	smnss.exe
File opened for modification	C:\Windows\SysWOW64\ctfmen.exe	10663ef8ab454757031f4027efc9375f23f9dbf73488c471a16eaa519effddcd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1488	1772	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10663ef8ab454757031f4027efc9375f23f9dbf73488c471a16eaa519effddcd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smnss.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32	10663ef8ab454757031f4027efc9375f23f9dbf73488c471a16eaa519effddcd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	10663ef8ab454757031f4027efc9375f23f9dbf73488c471a16eaa519effddcd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	10663ef8ab454757031f4027efc9375f23f9dbf73488c471a16eaa519effddcd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}	10663ef8ab454757031f4027efc9375f23f9dbf73488c471a16eaa519effddcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll"	10663ef8ab454757031f4027efc9375f23f9dbf73488c471a16eaa519effddcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll"	smnss.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1772	smnss.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 2704	4552	10663ef8ab454757031f4027efc9375f23f9dbf73488c471a16eaa519effddcd.exe	86
PID 4552 wrote to memory of 2704	4552	10663ef8ab454757031f4027efc9375f23f9dbf73488c471a16eaa519effddcd.exe	86
PID 4552 wrote to memory of 2704	4552	10663ef8ab454757031f4027efc9375f23f9dbf73488c471a16eaa519effddcd.exe	86
PID 2704 wrote to memory of 1772	2704	ctfmen.exe	87
PID 2704 wrote to memory of 1772	2704	ctfmen.exe	87
PID 2704 wrote to memory of 1772	2704	ctfmen.exe	87

C:\Users\Admin\AppData\Local\Temp\10663ef8ab454757031f4027efc9375f23f9dbf73488c471a16eaa519effddcd.exe
"C:\Users\Admin\AppData\Local\Temp\10663ef8ab454757031f4027efc9375f23f9dbf73488c471a16eaa519effddcd.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Windows\SysWOW64\ctfmen.exe
  ctfmen.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Windows\SysWOW64\smnss.exe
    C:\Windows\system32\smnss.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Maps connected drives based on registry
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:1772
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1772 -s 1340
      4⤵
      Program crash
      PID:1488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1772 -ip 1772
1⤵
PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\ctfmen.exe

Filesize
4KB

MD5
88b7ff42027043614bd546d027ce593a

SHA1
48eafc4f228abec5e6b4fdc37eadf599f5b693a2

SHA256
52bb93b10f78cf21b5808ccd3f42f0dbe0258c9e118623b87b14b9da51d021a9

SHA512
c726bf13ebfb14bbf3ebea01ea62fb0c130dcfa8c6cc0ea7ac0b92fd07a513946beb3585be000288f59062d879bdf28f8bfa69b70203a78828ebdd00a34e30da

Download Submit
C:\Windows\SysWOW64\grcopy.dll

Filesize
119KB

MD5
aacc77489c66b3e0f396167d8a4fc31d

SHA1
a713816de135c6a2b243476b7854d3032aa5ed65

SHA256
d4c6cf9a2054141857a2bdb4d8710407860e4b0f0e7b9e90c96aff21fa359415

SHA512
7389298878fec6a758c2b89dcb4a40ca51406deb39aa36ed9d4b804f0bb8aada837d40ad5caddba3ec663df9006c1affd30d37a2820d7f4c486d35a0f6dc2b53

Download Submit
C:\Windows\SysWOW64\satornas.dll

Filesize
183B

MD5
9f1911f5080172ec5f3895f6f438359f

SHA1
8ebb88013b76b76b2aa7e09a788850ee0467f6a8

SHA256
04f835d45eb8f512b663436a01d5cbfc0b3f113b6d9e2c406a9fc68ffc2c26dc

SHA512
11471c87ff7a9cb1969516b066dbb0c42c482ccd0dc51f5a91af0afd00667876329c0969549046d25a8213cf0321998e5d7426cf283713f6802948184bfc4e08

Download Submit
C:\Windows\SysWOW64\shervans.dll

Filesize
8KB

MD5
e0958bf5b957f9c3abb55c0e39452732

SHA1
9af0fc62ed930837ba5b87eacdbc3683011a0528

SHA256
d48412a9ac82fa4b2df3ab6e44dabbca4fde713000450f210d9d53e210a9990f

SHA512
d007b8d6239b36a78a965d33d956f56ff2c2b6ee7fbcdea6e17ee319cceb7ba2c6d530b2ab91b46add973125822475912afc2e7f1cfdff2f17eec6301a32d0d6

Download Submit
memory/1772-31-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1772-40-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1772-39-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/1772-37-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2704-29-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2704-21-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4552-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4552-23-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4552-24-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/4552-13-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads