Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-11-2024 10:54
General
-
Target
f08c886c349f5f2e5e9f14a1ae59ce832fd0a6b6efaedb9312ad7fc284cbfff6N.exe
-
Size
195KB
-
MD5
8b474754e41c9238bb84dbfc8adae740
-
SHA1
bef5d669376f4ca3c3bb50260050609ae910c135
-
SHA256
f08c886c349f5f2e5e9f14a1ae59ce832fd0a6b6efaedb9312ad7fc284cbfff6
-
SHA512
c6ea5d17895e15e8869c4fc11a45d8c91138dd450f9c53ea9cadab333932c763d2ce4f3bf553c7e3f46ec9d978c712f1dba9bdbd7d6a1037c52104845b39c932
-
SSDEEP
6144:zIs9OKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPFsEPAsKCyOW:WKofHfHTXQLzgvnzHPowYbvrjD/L7QPo
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates connected drives 3 TTPs 19 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Maps connected drives based on registry 3 TTPs 6 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory 64 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 64 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f08c886c349f5f2e5e9f14a1ae59ce832fd0a6b6efaedb9312ad7fc284cbfff6N.exe"C:\Users\Admin\AppData\Local\Temp\f08c886c349f5f2e5e9f14a1ae59ce832fd0a6b6efaedb9312ad7fc284cbfff6N.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ctfmen.exectfmen.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\smnss.exeC:\Windows\system32\smnss.exe3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Maps connected drives based on registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD50544e8f493ae6971db378c80674abeec
SHA1e70c2c53d47bccc856f4d3179ab90b47cd85ce97
SHA2567b45ae0116e6c798a1b76d42cb96dcf83b79f71235132123ef92889a80aed951
SHA5123c54f19c3b17e7779f8a0d4fc38bc1a351a80b5f061649ee417372a4650338cdcae7bf9f187e84b8aca28de6a8bf273637ebd37c8a7d5794bdf66e05f15642d4
-
Filesize
195KB
MD5d5ea04d2bf5bb5cb47e98f521da958d8
SHA181220743a1c0c442c2736dc9a9806bacb9a603d0
SHA256c79808790f5c629d3a7d5630003223703971829860877071389cf7945854510d
SHA512d9fe285de8792a0df54bfb7665f223dd712dc91b0e0d4bb5e5d61e96d651b6962cd216eb3c5c89f5aa53f39eb8b48d7aaec0dde0c28e34fe9f842396706559e3
-
Filesize
183B
MD59ecefb6e9d8c4cf1025926bb82dbbb02
SHA12df159a4667c1bb7ab8dfdcba6fa9483e753744c
SHA25650f4522884f2e2283522318d9d6255a360c9911ac23a72e602b47b7a5f8d4e09
SHA5125a982892a789fafc5d0ccd50e18a9857fc8438e589b43bee3ecf44558fb816356efaf94b66e0c8ec77c859310873f74ab30b66945f93f2eb55f02b5da4c1b1d9
-
Filesize
8KB
MD5fb6567ff8f1bdb1e22e6b89869fc91c8
SHA1e2e43f709a696ca1cab51ad185d63ae827b9831f
SHA25672f6bcf04f6ab3c565a66d0032df1e230665a97ed7c1e3df399074252a46e2c1
SHA512ac968ebbf4a3c822bc8b1d9f2016cc86a06e3aba5ef516327f2d5c56b0db9433d3993c618b1b06bdb7efd377620b1de400e65cb0ecf3272c481064baab6ffde7
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
228KB
-
Filesize
52KB
-
Filesize
228KB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
228KB
-
Filesize
228KB
-
Filesize
52KB