Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    08/11/2024, 15:07

General

  • Target

    e992b01d3268493cf5aaf1127ef550b1bb52e5437415310e5a36861eae578f89N.exe

  • Size

    119KB

  • MD5

    8a92e8f336098a88dc98a28825528e20

  • SHA1

    509e59d043c4797bd289946be8a0451a06eedb3c

  • SHA256

    e992b01d3268493cf5aaf1127ef550b1bb52e5437415310e5a36861eae578f89

  • SHA512

    de5f629d1b71738e322b18a2353690ed6e02d46626fc121dc86c3e9c61d96f1ba41b2e3829f437932112630a6d8629fbad65073e6474bd668497fe6c060fda52

  • SSDEEP

    3072:LOjWuyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPh:LIs9OKofHfHTXQLzgvnzHPowYbvrjD/E

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 19 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e992b01d3268493cf5aaf1127ef550b1bb52e5437415310e5a36861eae578f89N.exe
    "C:\Users\Admin\AppData\Local\Temp\e992b01d3268493cf5aaf1127ef550b1bb52e5437415310e5a36861eae578f89N.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2144
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1312
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:2184

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\SysWOW64\satornas.dll

          Filesize

          183B

          MD5

          35e697deee1e114ba4b6ae21a38b2e6f

          SHA1

          6b46ebeb564f4e9f70249e3d088e9a2a126a5dbb

          SHA256

          f060ef37c08cdb353c30c553549d26b3092da43560ad8ee528b91e35abd8c443

          SHA512

          8bb7b79644fe0a29377820f6d93219694442970e159a72ccb9368ebc8fc70c4a7aae5cf571acd02178319c7eb9412b0fb9d50ee3654d0f2e9072f5d2a1e5e2c1

        • \Windows\SysWOW64\ctfmen.exe

          Filesize

          4KB

          MD5

          21757df3fba722d67f95c4c6cd8b08f3

          SHA1

          3d1046bfeb340c50f40fde738e160f01f881a019

          SHA256

          071ce1a6a96cc9af3acb789b7a42155b6fe14d3a30498a4f4e09ecdbb3c6f39a

          SHA512

          ea7d3ab95e1aa6b34bff579f660b0aeafdd5137b3315889c2bf2ebd72685bbee3a2f372173ccea268c28571fb71adb1edad3fb385f021660744912f79dfbe043

        • \Windows\SysWOW64\shervans.dll

          Filesize

          8KB

          MD5

          021a53df4eebbbc709b8d4c5042354ae

          SHA1

          35a4f333b43f63abb8fbcd0caafd54aa09e44f72

          SHA256

          8e40288ca688161fd43e615a4776fb22bc961f0d4ba32d751050f2f41eadc8ae

          SHA512

          f7cc51d8b61fec201efc9207189c4d24d622a745ba5a89fad334a98cafcf7560b8dc0fa6008fb03884a069376a068a5616514efea46096db6a8acd7fb7bd0874

        • \Windows\SysWOW64\smnss.exe

          Filesize

          119KB

          MD5

          06f9a60fe792f7f6b1361e3cb84de8a3

          SHA1

          133197ae776f80fb25980ae3881228ea1de16024

          SHA256

          94dae8599b3708c45f4c5be59c5e9e724f880362b4481fbf68a42794203a6898

          SHA512

          69b303724f6432a560f8a33e59b3a24d17ca8e32b32e4490288dccc70a6f101b02aba15418843451996de16c5bc49adb7759bbd444de2c4d193f3e24c85d7fd6

        • memory/1312-36-0x0000000000400000-0x0000000000409000-memory.dmp

          Filesize

          36KB

        • memory/1312-29-0x0000000000400000-0x0000000000409000-memory.dmp

          Filesize

          36KB

        • memory/1312-31-0x0000000000340000-0x0000000000360000-memory.dmp

          Filesize

          128KB

        • memory/2144-27-0x0000000010000000-0x000000001000D000-memory.dmp

          Filesize

          52KB

        • memory/2144-26-0x0000000000400000-0x0000000000420000-memory.dmp

          Filesize

          128KB

        • memory/2144-23-0x0000000000350000-0x0000000000359000-memory.dmp

          Filesize

          36KB

        • memory/2144-24-0x0000000000350000-0x0000000000359000-memory.dmp

          Filesize

          36KB

        • memory/2144-0-0x0000000000400000-0x0000000000420000-memory.dmp

          Filesize

          128KB

        • memory/2144-12-0x0000000010000000-0x000000001000D000-memory.dmp

          Filesize

          52KB

        • memory/2184-37-0x0000000000400000-0x0000000000420000-memory.dmp

          Filesize

          128KB

        • memory/2184-43-0x0000000010000000-0x000000001000D000-memory.dmp

          Filesize

          52KB

        • memory/2184-45-0x0000000000400000-0x0000000000420000-memory.dmp

          Filesize

          128KB

        • memory/2184-46-0x0000000010000000-0x000000001000D000-memory.dmp

          Filesize

          52KB