Overview

overview

8

Static

static

3

217f4de450...1N.exe

windows7-x64

8

217f4de450...1N.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-10-2024 16:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    217f4de450eede01d0c763ba94c6a200948909be645ac26f6a543b54ebb03db1N.exe

  • Size

    352KB

  • MD5

    034abe963151051ab4013eae22d20db0

  • SHA1

    2d4802fa22d04412b2f6db11b2f85aba43cc9430

  • SHA256

    217f4de450eede01d0c763ba94c6a200948909be645ac26f6a543b54ebb03db1

  • SHA512

    803bed9183139092dc69a795e1aa165de7f4838de230ec8a275a41a28187ea62b76bbfe1dce272d968b9d0a079e2e42498f16ae559c1eb596e502fba6c47355a

  • SSDEEP

    6144:cIs9OKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPFsEPAsKCe8i:tKofHfHTXQLzgvnzHPowYbvrjD/L7QPs

Score
8/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 19 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\217f4de450eede01d0c763ba94c6a200948909be645ac26f6a543b54ebb03db1N.exe
    "C:\Users\Admin\AppData\Local\Temp\217f4de450eede01d0c763ba94c6a200948909be645ac26f6a543b54ebb03db1N.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1476
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1400
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:224

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\ctfmen.exe
    Filesize

    4KB

    MD5

    12b07d9a885adce1b15b11e49f19b8e3

    SHA1

    48762be4a1353a58ef878b945d963f8a7965a77a

    SHA256

    a3954701b3dce2468972433d1334a3f79c5687ebba418998b2b21cc72950eff1

    SHA512

    350a85d80fbd3b36f300e9b0925843b38cc75fc1419cdb496b1d95f72a53be9760b96af04c399fdeab3972ebdd0d783e1b2d4004409194b504b56d96accd9250

    Download Submit

  • C:\Windows\SysWOW64\grcopy.dll
    Filesize

    352KB

    MD5

    9a8d19a5c0535ebc7f871839febc33a7

    SHA1

    4e5540ca95d46914af412dbbf2bb31971b6b3cd9

    SHA256

    436319fd57542f5174d116f0f952c7caa5fd4ea368e5462ad35435dea31c486b

    SHA512

    964aa7e00fd28792e95b0eb634d1c44b539935690600b6cc4a3e20af7bdf6cb7c0db465000fa838d91a9ae4d41feacd0989e08e1bb80f492b7528875fdb134b1

    Download Submit

  • C:\Windows\SysWOW64\satornas.dll
    Filesize

    183B

    MD5

    5eb2e7c91a95f9a490e59429ebd26ec2

    SHA1

    77621f4035d365191520a519b733eb7d21012180

    SHA256

    8be78cc0433cd74c27455777f2c2250cc9cd633da9881be6e44bfd3ebbf5bcf7

    SHA512

    c7de6fc3e7beb104d1c5f19a103ce11fb76fb62dcbbc44be6dd896ad39a66ccfb50fa68977bb3f6410e952ebf4f7fcb6c6e4681cf41e2301a81a0f7c3a876540

    Download Submit

  • C:\Windows\SysWOW64\shervans.dll
    Filesize

    8KB

    MD5

    bef5b56c7b89e336055cdbf27938c54a

    SHA1

    c98492ffa740bfebc0ab02acb8e6b9fbd297ddb8

    SHA256

    df149af126924dc7a04ff6dde15559287273e24286d2e34e53ff4bd09fad1abb

    SHA512

    b6fba432d8a08cddc540ede79f0632c3af20a256118bdced0fd9667d836002883dfb91e0b60ab5752e76c077a94d9b46cede0b244d5a7aa8477cb8f400244f68

    Download Submit

  • memory/224-32-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

    Download

  • memory/224-37-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/224-39-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

    Download

  • memory/224-40-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/1400-21-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/1400-28-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/1476-24-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/1476-23-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

    Download

  • memory/1476-0-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

    Download

  • memory/1476-13-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download