Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    19/01/2025, 11:57

General

  • Target

    c10c2254b611992c169c5ac0d6396ca07249235fd7d0ef2111599d3843ade8c7.exe

  • Size

    75KB

  • MD5

    6ed5cf8d1cd805767d358e6edad16bd1

  • SHA1

    a59441161e0b150e0bc8868780dc7ff5a633205c

  • SHA256

    c10c2254b611992c169c5ac0d6396ca07249235fd7d0ef2111599d3843ade8c7

  • SHA512

    6baf01c79a45e1289008dff1b9fa56ba9813239eae1b9848c32ac36c0148283afe2ce109109debed1aca5f2083b13ff9f928c36fb497df0041baf8751f7ba197

  • SSDEEP

    1536:4x1Qja7luy6y0s4sqfkbnAKBOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3E:wOjWuyt0ZsqsXOKofHfHTXQLzgvnzHPM

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 9 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c10c2254b611992c169c5ac0d6396ca07249235fd7d0ef2111599d3843ade8c7.exe
    "C:\Users\Admin\AppData\Local\Temp\c10c2254b611992c169c5ac0d6396ca07249235fd7d0ef2111599d3843ade8c7.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1420
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2188
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2572
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 828
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:2016

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\SysWOW64\satornas.dll

          Filesize

          183B

          MD5

          15facdf578f7e1a6472cfa6e870dd567

          SHA1

          af6e69c6770b445a3ad857262f5442bad68a4aad

          SHA256

          195825c154d73bb4483156e0d7f0661e139d178e4f5f43a1ea056c935b844b79

          SHA512

          8ddffcc24109f9b1029a5e8437a8947440dd285a3ab9ebc806bf25589dca45ed2fc4934e3bc7752cc6fad8fc5ef193baa55faa38db5a7f6390b2809d6d68bb6b

        • C:\Windows\SysWOW64\smnss.exe

          Filesize

          75KB

          MD5

          5a53a9e24e8bd54b1a503a5acbfd0b79

          SHA1

          58603c394dff147f2d342b5653bee5dd149df8ba

          SHA256

          700a43b37ff7d021dce3d026ad7f7da8b9ce6831a323e42e71d1d0f4c11dc2b7

          SHA512

          0001afc627ee13f024ed82de2e71470bc170cc1e6e62995d4495202eda390feaac7b73bca7f88dd8e8130748831e51e6090229f3bedc323cac844ed0bbbb4a3d

        • \Windows\SysWOW64\ctfmen.exe

          Filesize

          4KB

          MD5

          b6be925977558e26780660fec41a07fe

          SHA1

          5fd6fcff8021821cd94ace581630fec3433c7346

          SHA256

          fe64c2f76501ccb8f125f8e4a084be6d2ff498661a8046e5597733e19bb4b29d

          SHA512

          9d3d900f1ef3c3b8a2ba30c251ce2a901a1526a33b507568fa181c27dfb4a38b4fac87884db368f69a54ad7a9b98d55c91f18a8bd125108ff49aa67de643f0eb

        • \Windows\SysWOW64\shervans.dll

          Filesize

          8KB

          MD5

          5841e566b5ae865f5578b947b0626826

          SHA1

          46c39ad6c1cb2fea531bbadb06d7ee2c77b4e253

          SHA256

          7b08cbfdf9016d86ae943ac575a1d3098d5143c1c181483495eba18cb2e8dc82

          SHA512

          87af8c58b940bce8671cb688f54e8f7bccc42bbb7c49d1b7b4cd9d6577d7de12093e4c1f7c7b5cbaf2e33eace888bfdd6d5e7127fff14ab24437f282cc5317d9

        • memory/1420-11-0x0000000010000000-0x000000001000D000-memory.dmp

          Filesize

          52KB

        • memory/1420-17-0x0000000000340000-0x0000000000349000-memory.dmp

          Filesize

          36KB

        • memory/1420-26-0x0000000010000000-0x000000001000D000-memory.dmp

          Filesize

          52KB

        • memory/1420-24-0x0000000000400000-0x000000000041C000-memory.dmp

          Filesize

          112KB

        • memory/2188-31-0x0000000000400000-0x0000000000409000-memory.dmp

          Filesize

          36KB

        • memory/2572-42-0x0000000000400000-0x000000000041C000-memory.dmp

          Filesize

          112KB

        • memory/2572-44-0x0000000010000000-0x000000001000D000-memory.dmp

          Filesize

          52KB