b28f4495e2cda5a5fef0408701a136d820c7cf2e7a45dd101e70b31458e31530

General

Target
90508db9aa3b3698eb08109217eb43b7.exe
Size 1.0MB
Sample201210-8s8qaddvyn
SHA256 b28f4495e2cda5a5fef0408701a136d820c7cf2e7a45dd101e70b31458e31530
MD5 90508db9aa3b3698eb08109217eb43b7
SHA1 f443522186cad995be2fce64a377bb1e01b49250
SHA512 34f683a79d9bcef09a77dd2edf85015b540fd55cb2c709daa7363fa70518f30a6c99d48de7424ef551b8b13ce96dc6a472c319f1eddec2b4acaf2d0d8fb2f4aa
MD5 SHA1 SHA512

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 676 set thread context of 2120	676	90508db9aa3b3698eb08109217eb43b7.exe	78

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	90508db9aa3b3698eb08109217eb43b7.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	90508db9aa3b3698eb08109217eb43b7.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2120	90508db9aa3b3698eb08109217eb43b7.exe
2120	90508db9aa3b3698eb08109217eb43b7.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 676 wrote to memory of 2120	676	90508db9aa3b3698eb08109217eb43b7.exe	78
PID 676 wrote to memory of 2120	676	90508db9aa3b3698eb08109217eb43b7.exe	78
PID 676 wrote to memory of 2120	676	90508db9aa3b3698eb08109217eb43b7.exe	78
PID 676 wrote to memory of 2120	676	90508db9aa3b3698eb08109217eb43b7.exe	78
PID 676 wrote to memory of 2120	676	90508db9aa3b3698eb08109217eb43b7.exe	78

C:\Users\Admin\AppData\Local\Temp\90508db9aa3b3698eb08109217eb43b7.exe
"C:\Users\Admin\AppData\Local\Temp\90508db9aa3b3698eb08109217eb43b7.exe"
1⤵
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:676
- C:\Users\Admin\AppData\Local\Temp\90508db9aa3b3698eb08109217eb43b7.exe
  "C:\Users\Admin\AppData\Local\Temp\90508db9aa3b3698eb08109217eb43b7.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2120

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/676-2-0x0000000002350000-0x00000000023B5000-memory.dmp

Download

memory/676-4-0x0000000004850000-0x000000000489C000-memory.dmp

Download

memory/2120-6-0x0000000000530000-0x000000000055B000-memory.dmp

Download

memory/2120-8-0x0000000000530000-0x000000000055B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads