b28f4495e2cda5a5fef0408701a136d820c7cf2e7a45dd101e70b31458e31530

General

Target

90508db9aa3b3698eb08109217eb43b7.exe
Size

1.0MB
MD5

90508db9aa3b3698eb08109217eb43b7
SHA1

f443522186cad995be2fce64a377bb1e01b49250
SHA256

b28f4495e2cda5a5fef0408701a136d820c7cf2e7a45dd101e70b31458e31530
SHA512

34f683a79d9bcef09a77dd2edf85015b540fd55cb2c709daa7363fa70518f30a6c99d48de7424ef551b8b13ce96dc6a472c319f1eddec2b4acaf2d0d8fb2f4aa

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 676 set thread context of 2120	676	90508db9aa3b3698eb08109217eb43b7.exe	78

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	90508db9aa3b3698eb08109217eb43b7.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	90508db9aa3b3698eb08109217eb43b7.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2120	90508db9aa3b3698eb08109217eb43b7.exe
2120	90508db9aa3b3698eb08109217eb43b7.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 676 wrote to memory of 2120	676	90508db9aa3b3698eb08109217eb43b7.exe	78
PID 676 wrote to memory of 2120	676	90508db9aa3b3698eb08109217eb43b7.exe	78
PID 676 wrote to memory of 2120	676	90508db9aa3b3698eb08109217eb43b7.exe	78
PID 676 wrote to memory of 2120	676	90508db9aa3b3698eb08109217eb43b7.exe	78
PID 676 wrote to memory of 2120	676	90508db9aa3b3698eb08109217eb43b7.exe	78

C:\Users\Admin\AppData\Local\Temp\90508db9aa3b3698eb08109217eb43b7.exe
"C:\Users\Admin\AppData\Local\Temp\90508db9aa3b3698eb08109217eb43b7.exe"
1⤵
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:676
- C:\Users\Admin\AppData\Local\Temp\90508db9aa3b3698eb08109217eb43b7.exe
  "C:\Users\Admin\AppData\Local\Temp\90508db9aa3b3698eb08109217eb43b7.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2120

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/676-2-0x0000000002350000-0x00000000023B5000-memory.dmp

Filesize
404KB

Download
memory/676-4-0x0000000004850000-0x000000000489C000-memory.dmp

Filesize
304KB

Download
memory/2120-6-0x0000000000530000-0x000000000055B000-memory.dmp

Filesize
172KB

Download
memory/2120-8-0x0000000000530000-0x000000000055B000-memory.dmp

Filesize
172KB

Download

Analysis

Sharing