Overview

overview

8

Static

static

3

fb7fe9d685...dN.exe

windows7-x64

8

fb7fe9d685...dN.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    119s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    17/10/2024, 14:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    fb7fe9d6859e3d06c6fa943ff9b04ace779fef6e68c99657c73b020f9e2b838dN.exe

  • Size

    119KB

  • MD5

    07a198eb8fcb4912c5cc5f2aaf460a90

  • SHA1

    74b69e161d21fe8b5963d77a8d6880fb9caccea3

  • SHA256

    fb7fe9d6859e3d06c6fa943ff9b04ace779fef6e68c99657c73b020f9e2b838d

  • SHA512

    eb4de697483bae275c3ee48dd04623774d6fa745101b31df65791f695ffc9fe8a7f8b58e90694661a4556bf13ab715b506db03bed1a58a2e8f39b6439826711b

  • SSDEEP

    3072:IOjWuyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPh:IIs9OKofHfHTXQLzgvnzHPowYbvrjD/E

Score
8/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 19 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fb7fe9d6859e3d06c6fa943ff9b04ace779fef6e68c99657c73b020f9e2b838dN.exe
    "C:\Users\Admin\AppData\Local\Temp\fb7fe9d6859e3d06c6fa943ff9b04ace779fef6e68c99657c73b020f9e2b838dN.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3052
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2800
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:2096

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\SysWOW64\satornas.dll
          Filesize

          183B

          MD5

          9d4ac93266d24538e48a809e6c029737

          SHA1

          3fdf69f180e5c9cd671b28fa7853b0f4c1fb65a2

          SHA256

          887d90ab99d7ddce622874bddfd6477bb238bdf487f346574c36c2432b951714

          SHA512

          e932836b4d373dd43d7a5b590e6e6462ac68e5f3caba4d5aefef7a62bc2b36e9bd9b9b2c1586c20e1df6aead7a191174d18c8d0fa675799aacf5fb51f11185dc

          Download Submit

        • \Windows\SysWOW64\ctfmen.exe
          Filesize

          4KB

          MD5

          da64d94c1533ac508d6e3752a402c645

          SHA1

          c3555360fff4d8e028681c4a4aed039dbf544fa9

          SHA256

          217274cb2146c892c041db09835e62d8ab97e23bc0bc8f70d930fe57c114f100

          SHA512

          b6c0e6961a9ec38670b36633e2baef08fd2b65222c20d6a22d470e9f337963f8c342ed435af9a68ad7032ca33488239b0a8b74be8a71b78b6d4cd4129dbdd36d

          Download Submit

        • \Windows\SysWOW64\shervans.dll
          Filesize

          8KB

          MD5

          72d22e762dcdfc29eef9ec72faaa0685

          SHA1

          13c45333a416f90ac02f699ae349396e2fdab95a

          SHA256

          3822d77c8f9d15a09bd318601d93d7b11d464fe2d88e86438658bd7400bfb55b

          SHA512

          28036e316f086974a14ec3224b8cf6ca9ff1ab5b7e0e90cdcbec2aad7f8face12ce13ef300d0432208e65cd10e7a07f5712b0c8eff9e22cba88979877b4ef564

          Download Submit

        • \Windows\SysWOW64\smnss.exe
          Filesize

          119KB

          MD5

          d77ca1199f9962c8d232dd9dbc4cb0ac

          SHA1

          c57b7988a6d2ef1d062ace026f36a58f67395b81

          SHA256

          a3c49886c4f85090f6c126a00233794bb399211832fe86d0fca8699bb85e0cbc

          SHA512

          9902709cba9ab195e9891b8dd65412693f808ef49cc254f2deea58d1756db60f7fead3c353bbd2cba0f64807fa2ba144e215633fd08ffbed7a431f8f100064db

          Download Submit

        • memory/2096-34-0x0000000000400000-0x0000000000420000-memory.dmp

          Filesize

          128KB

          Download

        • memory/2096-40-0x0000000010000000-0x000000001000D000-memory.dmp

          Filesize

          52KB

          Download

        • memory/2096-43-0x0000000000400000-0x0000000000420000-memory.dmp

          Filesize

          128KB

          Download

        • memory/2096-44-0x0000000010000000-0x000000001000D000-memory.dmp

          Filesize

          52KB

          Download

        • memory/2800-32-0x0000000000400000-0x0000000000409000-memory.dmp

          Filesize

          36KB

          Download

        • memory/2800-42-0x0000000000400000-0x0000000000409000-memory.dmp

          Filesize

          36KB

          Download

        • memory/3052-18-0x0000000000350000-0x0000000000359000-memory.dmp

          Filesize

          36KB

          Download

        • memory/3052-26-0x0000000000400000-0x0000000000420000-memory.dmp

          Filesize

          128KB

          Download

        • memory/3052-0-0x0000000000400000-0x0000000000420000-memory.dmp

          Filesize

          128KB

          Download

        • memory/3052-27-0x0000000010000000-0x000000001000D000-memory.dmp

          Filesize

          52KB

          Download

        • memory/3052-12-0x0000000010000000-0x000000001000D000-memory.dmp

          Filesize

          52KB

          Download