Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows11_x64 -
resource
win11 -
submitted
21/08/2021, 07:25
Static task
static1
Behavioral task
behavioral1
Sample
0e4651625abda88df56952b7e97d7fb64a3e1ea97bfe01e931d47381c0952e98.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
0e4651625abda88df56952b7e97d7fb64a3e1ea97bfe01e931d47381c0952e98.exe
Resource
win11
windows11_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
0e4651625abda88df56952b7e97d7fb64a3e1ea97bfe01e931d47381c0952e98.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
0e4651625abda88df56952b7e97d7fb64a3e1ea97bfe01e931d47381c0952e98.exe
-
Size
2.4MB
-
MD5
6d0fd5f76fbe861695b140828aac6443
-
SHA1
71b54d8219ab3a44ac434c41495c8d0db62a7d3f
-
SHA256
0e4651625abda88df56952b7e97d7fb64a3e1ea97bfe01e931d47381c0952e98
-
SHA512
e85fc4cbb64b4abdb1d76322e66ee7a007e8fc13f3dc9bd6d485aa36be345fda2494e44c665768388e3fe5c6aaeafc4d0926a62d69c13a2d06409182711527a6
Score
10/10
Malware Config
Signatures
-
StrongPity
StrongPity is a spyware developed by PROMETHIUM APT group mainly used in government sponsored attacks.
-
StrongPity Spyware 2 IoCs
resource yara_rule behavioral2/files/0x000100000002b21a-150.dat family_strongpity behavioral2/files/0x000100000002b21a-151.dat family_strongpity -
Executes dropped EXE 4 IoCs
pid Process 4516 fnmsetup.exe 4508 nvwmisrv.exe 4984 winmsism.exe 4960 fnmsetup.tmp -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run 0e4651625abda88df56952b7e97d7fb64a3e1ea97bfe01e931d47381c0952e98.exe Set value (str) \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\CUpdateTask = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ndaData\\nvwmisrv.exe" 0e4651625abda88df56952b7e97d7fb64a3e1ea97bfe01e931d47381c0952e98.exe -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople sihclient.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs sihclient.exe Key created \REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache\7\52C64B7E svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates sihclient.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4604 wrote to memory of 4516 4604 0e4651625abda88df56952b7e97d7fb64a3e1ea97bfe01e931d47381c0952e98.exe 80 PID 4604 wrote to memory of 4516 4604 0e4651625abda88df56952b7e97d7fb64a3e1ea97bfe01e931d47381c0952e98.exe 80 PID 4604 wrote to memory of 4516 4604 0e4651625abda88df56952b7e97d7fb64a3e1ea97bfe01e931d47381c0952e98.exe 80 PID 4604 wrote to memory of 4508 4604 0e4651625abda88df56952b7e97d7fb64a3e1ea97bfe01e931d47381c0952e98.exe 81 PID 4604 wrote to memory of 4508 4604 0e4651625abda88df56952b7e97d7fb64a3e1ea97bfe01e931d47381c0952e98.exe 81 PID 4604 wrote to memory of 4508 4604 0e4651625abda88df56952b7e97d7fb64a3e1ea97bfe01e931d47381c0952e98.exe 81 PID 4508 wrote to memory of 4984 4508 nvwmisrv.exe 83 PID 4508 wrote to memory of 4984 4508 nvwmisrv.exe 83 PID 4508 wrote to memory of 4984 4508 nvwmisrv.exe 83 PID 4516 wrote to memory of 4960 4516 fnmsetup.exe 84 PID 4516 wrote to memory of 4960 4516 fnmsetup.exe 84 PID 4516 wrote to memory of 4960 4516 fnmsetup.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e4651625abda88df56952b7e97d7fb64a3e1ea97bfe01e931d47381c0952e98.exe"C:\Users\Admin\AppData\Local\Temp\0e4651625abda88df56952b7e97d7fb64a3e1ea97bfe01e931d47381c0952e98.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\fnmsetup.exe"C:\Users\Admin\AppData\Local\Temp\fnmsetup.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\is-ATGTK.tmp\fnmsetup.tmp"C:\Users\Admin\AppData\Local\Temp\is-ATGTK.tmp\fnmsetup.tmp" /SL5="$70038,1480519,54272,C:\Users\Admin\AppData\Local\Temp\fnmsetup.exe"3⤵
- Executes dropped EXE
PID:4960
-
-
-
C:\Users\Admin\AppData\Local\Temp\ndaData\nvwmisrv.exe"C:\Users\Admin\AppData\Local\Temp\ndaData\nvwmisrv.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\ndaData\winmsism.exe"C:\Users\Admin\AppData\Local\Temp\ndaData\winmsism.exe"3⤵
- Executes dropped EXE
PID:4984
-
-
-
C:\Windows\System32\sihclient.exeC:\Windows\System32\sihclient.exe /cv AQ4ciwWch0+5spMnjZvMow.0.21⤵
- Modifies data under HKEY_USERS
PID:3056
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Modifies data under HKEY_USERS
PID:4588
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:5100