Overview

overview

8

Static

static

3

4603fa24d1...7N.exe

windows7-x64

7

4603fa24d1...7N.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    118s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-10-2024 03:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4603fa24d1600dcd43072047d9a65a9f474c561fd7bd8c6c8fb316036d320ee7N.exe

  • Size

    119KB

  • MD5

    35f4d2446e08dd79be6a6fe06d65bc80

  • SHA1

    0e695f2714a4d5ee7f75d43c440aa0eb327005a8

  • SHA256

    4603fa24d1600dcd43072047d9a65a9f474c561fd7bd8c6c8fb316036d320ee7

  • SHA512

    9f2a9544fdb5f1d4100126052dd077c80769ca25ce7d971109a64cfe79fe1765417022de722d1c3c10d435420bcb0ab21022c7423d127ada9f6ab769e8e95ad1

  • SSDEEP

    3072:LOjWuyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPh:LIs9OKofHfHTXQLzgvnzHPowYbvrjD/E

Score
8/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 19 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4603fa24d1600dcd43072047d9a65a9f474c561fd7bd8c6c8fb316036d320ee7N.exe
    "C:\Users\Admin\AppData\Local\Temp\4603fa24d1600dcd43072047d9a65a9f474c561fd7bd8c6c8fb316036d320ee7N.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4220
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4688
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:2708

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\ctfmen.exe
    Filesize

    4KB

    MD5

    abec5ab8c931e8a246b4f5e68177e125

    SHA1

    d3ed776e76ce6b5c0ad72cd08b12b70a92f11a4e

    SHA256

    b559076385d869dc59504accc25fc6cfdccd09eb5a15cea6082343ed5c7df473

    SHA512

    817a9351618ff8bc2f45ad83de18ecb365bb881c099a240a500efef3121ec5f2fb9692adb7ae6b9ea135c50ff8edac13f014a2671e360f08beeec9ec365bd72e

    Download Submit

  • C:\Windows\SysWOW64\grcopy.dll
    Filesize

    119KB

    MD5

    edc8611ca2b2d2883e51126974d456ca

    SHA1

    e3251898c5a1d47f88dcb23612703b504976c14d

    SHA256

    7d656be031b1d0c2379b1f0c5782fc180ede3df6bb0be14f55baeda9de3ed30e

    SHA512

    584747bdc8c988eb74571c581f9cfa177af5d81161b045e38f33f561f8406a80d8a35bcfb7f2723a8bcdf38efeaab99fb33ae2e4768d1b6c493122460ae87813

    Download Submit

  • C:\Windows\SysWOW64\satornas.dll
    Filesize

    183B

    MD5

    ad7b78ea68874d577e439c45a8c88b70

    SHA1

    a7a0b343cbf81ccc3c5c300a08c16fefcdb7c40c

    SHA256

    bdf5018f434ff2f680dd621cb5da8e3aab8806793f0e4a06ea1987d4652aed9f

    SHA512

    f03ced72f06efedd04a8f0c51a50c92cd1b8a240fa21eb7c6a40ba1f51ca2c61fd3a383d698633f64fba2701c81243a841dd87640deb75892b13fc2516d19e0a

    Download Submit

  • C:\Windows\SysWOW64\shervans.dll
    Filesize

    8KB

    MD5

    f05ef85f7f12101f89ac46f61ac5dcfc

    SHA1

    ac6126fd2367ff387f9ac45d0262f5ed736ed16c

    SHA256

    e9eb856517f5a1c11501c1c969fe3e984da71dda9446b3128c32639760a805e0

    SHA512

    4d4fe551b2f0490c4f5947548de82c78f6cb1cfcf0308216293aecadf4ae879519d811f3db053e0e5b3d837de1381685cd6ee3bf794f8929a56fa71d0db2449c

    Download Submit

  • memory/2708-29-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2708-40-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2708-39-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2708-37-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/4220-24-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/4220-23-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

    Download

  • memory/4220-0-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

    Download

  • memory/4220-16-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/4688-30-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/4688-21-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download