da045fcbd63520920626c45655b87da65e0e6cdc26f7bc20dfbfb6f667be9dbf

General

Target
hosts.bin.exe
Size 1.3MB
Sample201008-3236rtlty2
SHA256 da045fcbd63520920626c45655b87da65e0e6cdc26f7bc20dfbfb6f667be9dbf
MD5 24ffe0dcd9078d0e8ad4f35cad159f91
SHA1 71accca50bfd123e27d2eeea150191b91e6ff96b
SHA512 dd59745782616f0f28942b80087bdc8031dbef00d1f2a04a6c48e41199229262f8e46fe9723ce3940421514afc942c224380bdb8cec3f0a0d068492b853235b1
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1292	cmd.exe

Loads dropped DLL 8 IoCs

pid	Process
764	hosts.bin.exe
764	hosts.bin.exe
764	hosts.bin.exe
764	hosts.bin.exe
764	hosts.bin.exe
764	hosts.bin.exe
764	hosts.bin.exe
764	hosts.bin.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

JavaScript code in executable 1 IoCs

resource	yara_rule
behavioral1/files/0x00030000000131d4-6.dat	js

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1164 set thread context of 764	1164	hosts.bin.exe	25

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
820	timeout.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	hosts.bin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	hosts.bin.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1164	hosts.bin.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1164	hosts.bin.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 764	1164	hosts.bin.exe	25
PID 1164 wrote to memory of 764	1164	hosts.bin.exe	25
PID 1164 wrote to memory of 764	1164	hosts.bin.exe	25
PID 1164 wrote to memory of 764	1164	hosts.bin.exe	25
PID 764 wrote to memory of 1292	764	hosts.bin.exe	31
PID 764 wrote to memory of 1292	764	hosts.bin.exe	31
PID 764 wrote to memory of 1292	764	hosts.bin.exe	31
PID 764 wrote to memory of 1292	764	hosts.bin.exe	31
PID 1292 wrote to memory of 820	1292	cmd.exe	33
PID 1292 wrote to memory of 820	1292	cmd.exe	33
PID 1292 wrote to memory of 820	1292	cmd.exe	33
PID 1292 wrote to memory of 820	1292	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\hosts.bin.exe
"C:\Users\Admin\AppData\Local\Temp\hosts.bin.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Users\Admin\AppData\Local\Temp\hosts.bin.exe
  "C:\Users\Admin\AppData\Local\Temp\hosts.bin.exe"
  2⤵
  - Loads dropped DLL
  - Modifies system certificate store
  - Suspicious use of WriteProcessMemory
  PID:764
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\hosts.bin.exe"
    3⤵
    - Deletes itself
    - Suspicious use of WriteProcessMemory
    PID:1292
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /T 10 /NOBREAK
      4⤵
      Delays execution with timeout.exe
      PID:820