Overview

overview

8

Static

static

3

d9f6584d8d...9f.exe

windows7-x64

8

d9f6584d8d...9f.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21-11-2024 09:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d9f6584d8d40c05a1e0f096dcde448d4cc7d52a9dc3ff61f2a1292f608c5f39f.exe

  • Size

    226KB

  • MD5

    51b302e07414fc728313d5abc02d505e

  • SHA1

    280e787eb0caa0dfc1d6e19702250ffe941cf874

  • SHA256

    d9f6584d8d40c05a1e0f096dcde448d4cc7d52a9dc3ff61f2a1292f608c5f39f

  • SHA512

    2c8930768ba39c45425a7938835f2bf96b9a949cd3d6978aeb4ad610963da15dcaf0e109d24cfe977c1d798b5584e2c8670c2f34b83aed88515856dede54cad6

  • SSDEEP

    6144:BpIs9OKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPFsEPAsKCtS:BQKofHfHTXQLzgvnzHPowYbvrjD/L7QK

Score
8/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 19 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d9f6584d8d40c05a1e0f096dcde448d4cc7d52a9dc3ff61f2a1292f608c5f39f.exe
    "C:\Users\Admin\AppData\Local\Temp\d9f6584d8d40c05a1e0f096dcde448d4cc7d52a9dc3ff61f2a1292f608c5f39f.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2472
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3032
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:2956

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\satornas.dll
    Filesize

    183B

    MD5

    fc7e7ab3792b3607c52c86ac85bf7e55

    SHA1

    d8be0f265e84c6a54e0974746e481371e5f76fa8

    SHA256

    19ebeb477f9e390b4d1a58be1105affb73049f867923972e5a56cece750239c2

    SHA512

    735a61e3ac82fc53c4af2fee5aa7fa52971014dee90938effd9ea4e8d90e517dac6ecd173f9b29e5e6770eccfb2743a28b3470129990bf2efe8dc3cf1676208b

    Download Submit

  • C:\Windows\SysWOW64\smnss.exe
    Filesize

    226KB

    MD5

    6226086d202fb55907d644353fe1a87e

    SHA1

    06c8b792ad456a5a4cfa8629412e97c2a0b340aa

    SHA256

    23541e9f57fb9c1d00a88189c976d14ee02b8e948452dc893796a6ce8ceacf11

    SHA512

    d9e6701cc8e1bfb305ffbac67dee04cfdaf825130e42a3e9dd79120a4d657319f8f50ff01ff144c9da5b9885e6138afe66f324eded41820af03b26053202918c

    Download Submit

  • \Windows\SysWOW64\ctfmen.exe
    Filesize

    4KB

    MD5

    92d5b576468339c5a920a4d5514476e5

    SHA1

    4194eca4817c8b8329ce5efb089913e838cf3333

    SHA256

    0e0d633c6c72cee68795122742ccdb48b77d0ad5c2a4c089d420c1d84ebd4da9

    SHA512

    cea4ef6b91bac188626d3bbc78e93dced85a0b5a4f49812c6fa4ec3f6c143061f9fc0887db1213e8f4e471e3bf4906b7a75a0aa446c15ba674a9c8dfd14e8f97

    Download Submit

  • \Windows\SysWOW64\shervans.dll
    Filesize

    8KB

    MD5

    ecfd3b14a17660e5f459277efb9db290

    SHA1

    a42e625585f129b93fdc7f7b80f7acf8554f84a5

    SHA256

    90b403e3b54faa237bffd8e535a515f8266a25db1f7e38cfc7298725c8c2532d

    SHA512

    dce2e26ba499f9669a8e643202ae0bf7e99cc7016e51bbd23e505523d7f53b516a80f21581d01483360f9bb7c9cfa6e32eccc1f0bfadfd503ea90a1586b4be55

    Download Submit

  • memory/2472-18-0x0000000000340000-0x0000000000349000-memory.dmp

    Filesize

    36KB

    Download

  • memory/2472-26-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

    Download

  • memory/2472-27-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2472-0-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

    Download

  • memory/2472-12-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2956-36-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

    Download

  • memory/2956-42-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2956-43-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

    Download

  • memory/3032-28-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/3032-31-0x0000000000320000-0x0000000000352000-memory.dmp

    Filesize

    200KB

    Download