c897c6077d4a6dece0df7d91eaf9bc6be011c92b5261012ca0fa896600caaa30

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 03:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dd6f11369c7851bd5f3553e8d9516214.exe
Size

214KB
MD5

dd6f11369c7851bd5f3553e8d9516214
SHA1

b2d9f99e12ac6d0e1adb70f883a220ae6e28752c
SHA256

c897c6077d4a6dece0df7d91eaf9bc6be011c92b5261012ca0fa896600caaa30
SHA512

5b0cce7f1ec91d4365e443c53e7ea173b3c1a22850734de68efb9692a484967fe5ce5cb38d15df90eef8ea3119f53ae8b536fed5e32df57fb2caa0ac73004973
SSDEEP

3072:ZhpAyazIlyazTIFTZIPrsrVbmTk31LI2cu8vKLiGaiWdPHabe571Y:hZMazU8DsrVbmTC1Ltc1OiGa7dY1

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

fak9RC7WXL614mZ.exeCTS.exe

pid process

2784 fak9RC7WXL614mZ.exe
2340 CTS.exe
Loads dropped DLL 1 IoCs

Processes:

dd6f11369c7851bd5f3553e8d9516214.exe

pid process

1900 dd6f11369c7851bd5f3553e8d9516214.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2784	fak9RC7WXL614mZ.exe
2340	CTS.exe

pid	process
1900	dd6f11369c7851bd5f3553e8d9516214.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

dd6f11369c7851bd5f3553e8d9516214.exeCTS.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	dd6f11369c7851bd5f3553e8d9516214.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe

Drops file in Windows directory 2 IoCs

Processes:

dd6f11369c7851bd5f3553e8d9516214.exeCTS.exe

description ioc process

File created C:\Windows\CTS.exe dd6f11369c7851bd5f3553e8d9516214.exe
File created C:\Windows\CTS.exe CTS.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

dd6f11369c7851bd5f3553e8d9516214.exeCTS.exe

description pid process

Token: SeDebugPrivilege 1900 dd6f11369c7851bd5f3553e8d9516214.exe
Token: SeDebugPrivilege 2340 CTS.exe

description	ioc	process
File created	C:\Windows\CTS.exe	dd6f11369c7851bd5f3553e8d9516214.exe
File created	C:\Windows\CTS.exe	CTS.exe

description	pid	process
Token: SeDebugPrivilege	1900	dd6f11369c7851bd5f3553e8d9516214.exe
Token: SeDebugPrivilege	2340	CTS.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

dd6f11369c7851bd5f3553e8d9516214.exe

description	pid	process	target process
PID 1900 wrote to memory of 2784	1900	dd6f11369c7851bd5f3553e8d9516214.exe	fak9RC7WXL614mZ.exe
PID 1900 wrote to memory of 2784	1900	dd6f11369c7851bd5f3553e8d9516214.exe	fak9RC7WXL614mZ.exe
PID 1900 wrote to memory of 2784	1900	dd6f11369c7851bd5f3553e8d9516214.exe	fak9RC7WXL614mZ.exe
PID 1900 wrote to memory of 2784	1900	dd6f11369c7851bd5f3553e8d9516214.exe	fak9RC7WXL614mZ.exe
PID 1900 wrote to memory of 2340	1900	dd6f11369c7851bd5f3553e8d9516214.exe	CTS.exe
PID 1900 wrote to memory of 2340	1900	dd6f11369c7851bd5f3553e8d9516214.exe	CTS.exe
PID 1900 wrote to memory of 2340	1900	dd6f11369c7851bd5f3553e8d9516214.exe	CTS.exe
PID 1900 wrote to memory of 2340	1900	dd6f11369c7851bd5f3553e8d9516214.exe	CTS.exe

C:\Users\Admin\AppData\Local\Temp\dd6f11369c7851bd5f3553e8d9516214.exe
"C:\Users\Admin\AppData\Local\Temp\dd6f11369c7851bd5f3553e8d9516214.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1900

C:\Users\Admin\AppData\Local\Temp\fak9RC7WXL614mZ.exe
C:\Users\Admin\AppData\Local\Temp\fak9RC7WXL614mZ.exe
2⤵
- Executes dropped EXE
PID:2784

C:\Windows\CTS.exe
"C:\Windows\CTS.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2340

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\fak9RC7WXL614mZ.exe
Filesize
143KB

MD5
38f108cddb6619fba80f8382d5227ece

SHA1
12fd277bf756f22cfae3043900e4aff8b9f05ed9

SHA256
8296fe257b8c34398e3f291764454ec3cd9cbe06d60989b632ef4ba6c73ae5dc

SHA512
3db732c23f10122c78cffc6b6a5b11836ade1a23f5c6f9a192f2be2fa99c5bd7afb7a9e29c5d518a888cdd2091f9ac41b244214be226152830e96f5ec2cca424

Download Submit
C:\Windows\CTS.exe
Filesize
71KB

MD5
66df4ffab62e674af2e75b163563fc0b

SHA1
dec8a197312e41eeb3cfef01cb2a443f0205cd6e

SHA256
075a6eecd8da1795532318f9cf880efe42461f9464d63f74deb271d33110f163

SHA512
1588dd78e6e8972013c40cdb6acfb84c8df7b081197233ce621904b645356c805d0424bb93dd46c55834dc47d9ff39ee1323cf8e670841b3fff24ab98ba87f25

Download Submit
memory/2784-12-0x000007FEF6133000-0x000007FEF6134000-memory.dmp

Filesize
4KB

Download
memory/2784-14-0x0000000000280000-0x00000000002A8000-memory.dmp

Filesize
160KB

Download
memory/2784-16-0x000007FEF6130000-0x000007FEF6B1C000-memory.dmp

Filesize
9.9MB

Download