Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/11/2024, 15:07

General

  • Target

    e992b01d3268493cf5aaf1127ef550b1bb52e5437415310e5a36861eae578f89N.exe

  • Size

    119KB

  • MD5

    8a92e8f336098a88dc98a28825528e20

  • SHA1

    509e59d043c4797bd289946be8a0451a06eedb3c

  • SHA256

    e992b01d3268493cf5aaf1127ef550b1bb52e5437415310e5a36861eae578f89

  • SHA512

    de5f629d1b71738e322b18a2353690ed6e02d46626fc121dc86c3e9c61d96f1ba41b2e3829f437932112630a6d8629fbad65073e6474bd668497fe6c060fda52

  • SSDEEP

    3072:LOjWuyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPh:LIs9OKofHfHTXQLzgvnzHPowYbvrjD/E

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 19 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e992b01d3268493cf5aaf1127ef550b1bb52e5437415310e5a36861eae578f89N.exe
    "C:\Users\Admin\AppData\Local\Temp\e992b01d3268493cf5aaf1127ef550b1bb52e5437415310e5a36861eae578f89N.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2012
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4440
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:4396

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\SysWOW64\ctfmen.exe

          Filesize

          4KB

          MD5

          06fd32e1fcaf9844e22106e0af8e3759

          SHA1

          bd075138d84aa06975f2920a41916bc878a1ef8b

          SHA256

          54910e6991aaedad5f2ade287ef71cf65d3ec64e33a7c7d4f8dbde5470aa021b

          SHA512

          19ca97309a7b5c84d5ef9ffa40596a19a48b870536d17b1a12d124258ac6db2e8c0f9472a0a16c4b1e88439f9c2282a77b5f5ea250f14ec8f40c0fee10666e73

        • C:\Windows\SysWOW64\grcopy.dll

          Filesize

          119KB

          MD5

          4af548b1f6aee6927311b320dd910023

          SHA1

          55a8ce89ded1551b565bfb308270ead8ba67b893

          SHA256

          2d2dd1f6f57e165cd17bf31c1d5cd2bf7b4ef06f4f719b909922c92833977619

          SHA512

          102088c67891dfe38c597d1051a1afc55399ee1815d0cc1acb1cfc47a249b98295611bd4485a5859082175784ad4abb622280ee506a7a79f034b76b0ab012ef5

        • C:\Windows\SysWOW64\satornas.dll

          Filesize

          183B

          MD5

          ccf5f62244aee26a2a13e46d2a8834ce

          SHA1

          b687ad94eff8d7ea88c710c06f45d40c8d7e9039

          SHA256

          20f7aaeaab3dc6ef57d01fabaa7e9fcbf1775f50333e379f2fef7fb0d8b2b333

          SHA512

          17ec54cb8475b6d4357b9a996447eb4569d9108178c04cd5fe7ea4cfe0d045aa5f28052d19b56ab736fb984aa52f8d6b82637ded8888a7869d9031d901750244

        • C:\Windows\SysWOW64\shervans.dll

          Filesize

          8KB

          MD5

          7d98b3c88c2bd230d123a8269f92e6d5

          SHA1

          b8bd50c71d88781c8f0b63f69b74062b3d4a5c06

          SHA256

          7921c45166244c492f5589c45aeec98be4e3a45496f7abc133d54f5b6d3ff20b

          SHA512

          dbc7408e7fd21cd5f405803c325f3b2d998988e46d6a63f1e1f08006b9d4a800701542a5f6082a565883e8601f720f594f1f61f63b3a993948c12e12937cdb4d

        • memory/2012-25-0x0000000010000000-0x000000001000D000-memory.dmp

          Filesize

          52KB

        • memory/2012-0-0x0000000000400000-0x0000000000420000-memory.dmp

          Filesize

          128KB

        • memory/2012-24-0x0000000000400000-0x0000000000420000-memory.dmp

          Filesize

          128KB

        • memory/2012-13-0x0000000010000000-0x000000001000D000-memory.dmp

          Filesize

          52KB

        • memory/4396-30-0x0000000000400000-0x0000000000420000-memory.dmp

          Filesize

          128KB

        • memory/4396-37-0x0000000010000000-0x000000001000D000-memory.dmp

          Filesize

          52KB

        • memory/4396-39-0x0000000000400000-0x0000000000420000-memory.dmp

          Filesize

          128KB

        • memory/4396-40-0x0000000010000000-0x000000001000D000-memory.dmp

          Filesize

          52KB

        • memory/4440-21-0x0000000000400000-0x0000000000409000-memory.dmp

          Filesize

          36KB

        • memory/4440-28-0x0000000000400000-0x0000000000409000-memory.dmp

          Filesize

          36KB