Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-11-2024 09:21
General
-
Target
d9f6584d8d40c05a1e0f096dcde448d4cc7d52a9dc3ff61f2a1292f608c5f39f.exe
-
Size
226KB
-
MD5
51b302e07414fc728313d5abc02d505e
-
SHA1
280e787eb0caa0dfc1d6e19702250ffe941cf874
-
SHA256
d9f6584d8d40c05a1e0f096dcde448d4cc7d52a9dc3ff61f2a1292f608c5f39f
-
SHA512
2c8930768ba39c45425a7938835f2bf96b9a949cd3d6978aeb4ad610963da15dcaf0e109d24cfe977c1d798b5584e2c8670c2f34b83aed88515856dede54cad6
-
SSDEEP
6144:BpIs9OKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPFsEPAsKCtS:BQKofHfHTXQLzgvnzHPowYbvrjD/L7QK
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates connected drives 3 TTPs 19 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Maps connected drives based on registry 3 TTPs 6 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory 64 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 64 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d9f6584d8d40c05a1e0f096dcde448d4cc7d52a9dc3ff61f2a1292f608c5f39f.exe"C:\Users\Admin\AppData\Local\Temp\d9f6584d8d40c05a1e0f096dcde448d4cc7d52a9dc3ff61f2a1292f608c5f39f.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ctfmen.exectfmen.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\smnss.exeC:\Windows\system32\smnss.exe3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Maps connected drives based on registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5ca339faa985e1ffe076a716aa441313b
SHA15139925bb814fed5dadc98157266dbb4ff1b589d
SHA25623aac08ac5934ed2cb3785adb3b07f25a1b29d7a04c5db5355541aab85d6f74e
SHA512c1a791696da283f8d655d5061cf3d17334ad745b9e8a4b5f8c77a80c74cbeaf34a7d2cf99cbcb9c0c86db29ba2d394d2ecde004cd3f7608151153e6c4ea39b2e
-
Filesize
226KB
MD57d98b0e28a4f3eeae750f05776215d37
SHA13a54b5f85335b4e1d4fc385a3418026c8eabfb00
SHA25652552c4bd0e7b78c7f9e57b2b505b2f3e36dbe7c081faa3e6ec1dc5fda998aff
SHA512c8618b9369e4721c8f703924710da9cc41d1dbe775544c8cf4ab5122d2a958688fea7de7de0e61a4e01e0dcdd220c4e8a835118564a6ada7201a089ab66b93fa
-
Filesize
183B
MD5417326175f03466fa6ddf40dbc92d9aa
SHA16cdc861076b72a5c3c67256f296feb1ea0f0b8a1
SHA256212d7e3b34515066fb5a34eef9be24a4d9746980b2183dc989f557fa1044b219
SHA512b63c88075fdfc4e2cee85d55f53c081579005ed842814d828b4cc2d759ba5601ae1dab94c297a98117b93df9380f01a83a20221aa634d0e456b2029ef4522da2
-
Filesize
8KB
MD5e6d21ab7af4ed6a9f1c8eeea9f788bed
SHA1c28cd0aaed07f1527aa67dbe0eb12665ce793c5a
SHA256e7d7bb28fd154420538956d9ed3049d4017da423821a03ce8302fd4ccdf1b431
SHA5126be21c234976999e17b37d15a254db0b86eb8326e4556b6b4ff25bd316c58113caa4692c03a83d3ddbd52a48b131dfdfa1ee7bb5732d7797d8d0cf3ef4274940
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
200KB
-
Filesize
52KB
-
Filesize
200KB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
200KB
-
Filesize
200KB
-
Filesize
52KB