Overview

overview

8

Static

static

3

ae6f5bd5f6...b4.exe

windows7-x64

8

ae6f5bd5f6...b4.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    146s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/01/2025, 09:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ae6f5bd5f6e595a57111e6d19a2ab86c6c0c2fa052d19e4d5d8800c19d3833b4.exe

  • Size

    127KB

  • MD5

    42e84c6f2061b4163dc5d65a3bf74eb0

  • SHA1

    73aea92c5e1eb89c5c5b99d67e16e8544ced066c

  • SHA256

    ae6f5bd5f6e595a57111e6d19a2ab86c6c0c2fa052d19e4d5d8800c19d3833b4

  • SHA512

    c6990eae21e8b6271f9d07fe8025848765b39c7951ffa2536387a173fb5a4ed33ee02f67a080a058b6c0b5072d0001908d90e9dbbc2ff410ed391c998f86944d

  • SSDEEP

    3072:oOjWuyt0ZHqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPz:oIH9OKofHfHTXQLzgvnzHPowYbvrjD/e

Score
8/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 19 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ae6f5bd5f6e595a57111e6d19a2ab86c6c0c2fa052d19e4d5d8800c19d3833b4.exe
    "C:\Users\Admin\AppData\Local\Temp\ae6f5bd5f6e595a57111e6d19a2ab86c6c0c2fa052d19e4d5d8800c19d3833b4.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:412
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1900
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:960

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\ctfmen.exe
    Filesize

    4KB

    MD5

    50706a20f3ba5679f039335dc6fd9dd4

    SHA1

    62aa290f23e3eb81a8fd9dcaba81454a27206f10

    SHA256

    f6b5a7a65903dcdfe886be6da0119edd5ac38818aab31381af5985c6ad1d75a6

    SHA512

    4570389c8b300e0b2ad5a303d4459bfaff2e032cb9984daa71be1b85927536c881433091eded4849da82b3b97d5aef3d4e6bdfe0f62ddcc06e0abfdbc2e852f4

    Download Submit

  • C:\Windows\SysWOW64\grcopy.dll
    Filesize

    127KB

    MD5

    c072c9f8f0bd33ed08b92e6462a86dc4

    SHA1

    b6a73feab8501c2c95dd38bb2a9c540a2981a700

    SHA256

    9bfa5548a77c7c58cbace7521a72c0b865f9020c6f502bcde4c776dddf87619a

    SHA512

    8dea36a14b1119ff365f73dd8169a7b40f9538c67ce464210b26d937fc4426680a28ed223f87076b55b4817171923871d21e6af7b4c0718a6d347dbaf1a59952

    Download Submit

  • C:\Windows\SysWOW64\satornas.dll
    Filesize

    183B

    MD5

    ad21d628edaebc89e5c1140356992568

    SHA1

    9ddaa1cc0b369e8b24e5e119e3f2dc559869449b

    SHA256

    e3147d98f2d514112d83f5304d73d8c8196fec1081a0bfa3810797349a4307f4

    SHA512

    bfe19e33412f3ae054bac424c704bcc963013a37790e5e7b8c570740e97bad1b2915a5d57ca952df3211ca7f99e22abaa914660fb165b1d7c89e0d0b65e60ed7

    Download Submit

  • C:\Windows\SysWOW64\shervans.dll
    Filesize

    8KB

    MD5

    74f11cfa7fd57966b90da9013c02babe

    SHA1

    110b876d5dce40d322f5663b52c36b004b13ee58

    SHA256

    f8b180867f79436f3b61aa27f3e8d56ff8fa74f3de5c598125d2b43d115eecf7

    SHA512

    fd5208f25b9ce5d4967d82d4aa3b95dc27b0ec4f15cc2402d9b9611bb81a1d128302c16559ba94d4c44addf5240ed292198b47bf04b5a683e3d0e5f3d6de5e51

    Download Submit

  • memory/412-25-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/412-24-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB

    Download

  • memory/412-0-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB

    Download

  • memory/412-12-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/960-29-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB

    Download

  • memory/960-38-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB

    Download

  • memory/960-39-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/1900-31-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/1900-21-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download