40702b0d2a57d292c5bdfbf1ab1db3da71dacc942dc6838b10458f185800d6e5

Analysis

max time kernel
29s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
18-03-2023 20:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MultiBit/MultiBit.exe
Size

324KB
MD5

0f39821d5744907e68885862080c6234
SHA1

71e263f94a80d6cd1df1349c4a2202ef5f2518c3
SHA256

86f783a90ebc8f381e8c6484d412cce8e587d003856b522b271ca15691e9dd8b
SHA512

38299692594b995607987e1369d7c2c8913e8daec076b3779a61033093290e69fab1fb8cae0a83a80643a825f67b41a81eb17d21736054a656067ae8bcf93cbc
SSDEEP

3072:Ex+JMeg3Z0EeYesNKnXORQtmGWA68rdCbyzziT6hTnNPmxZjmsNKnXOZu:Ov4XORAmGc8rdCbkziksZ4XOZ

Score

8^/10

agilenet

Malware Config

Signatures

Downloads MZ/PE file

Obfuscated with Agile.Net obfuscator 3 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral21/memory/608-55-0x0000000000360000-0x0000000000370000-memory.dmp	agile_net
behavioral21/memory/608-56-0x0000000000380000-0x000000000038E000-memory.dmp	agile_net
behavioral21/memory/608-58-0x00000000055D0000-0x000000000571A000-memory.dmp	agile_net

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

MultiBit.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	MultiBit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	MultiBit.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MultiBit.exe

description pid process

Token: SeDebugPrivilege 608 MultiBit.exe

description	pid	process
Token: SeDebugPrivilege	608	MultiBit.exe

C:\Users\Admin\AppData\Local\Temp\MultiBit\MultiBit.exe
"C:\Users\Admin\AppData\Local\Temp\MultiBit\MultiBit.exe"
1⤵
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:608

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/608-54-0x0000000000DD0000-0x0000000000E26000-memory.dmp

Filesize
344KB

Download
memory/608-55-0x0000000000360000-0x0000000000370000-memory.dmp

Filesize
64KB

Download
memory/608-56-0x0000000000380000-0x000000000038E000-memory.dmp

Filesize
56KB

Download
memory/608-57-0x0000000004DF0000-0x0000000004E30000-memory.dmp

Filesize
256KB

Download
memory/608-58-0x00000000055D0000-0x000000000571A000-memory.dmp

Filesize
1.3MB

Download
memory/608-59-0x0000000005870000-0x0000000005986000-memory.dmp

Filesize
1.1MB

Download
memory/608-60-0x00000000005A0000-0x00000000005D0000-memory.dmp

Filesize
192KB

Download
memory/608-61-0x0000000004DF0000-0x0000000004E30000-memory.dmp

Filesize
256KB

Download
memory/608-62-0x0000000008AF0000-0x0000000008B16000-memory.dmp

Filesize
152KB

Download
memory/608-63-0x0000000004DF0000-0x0000000004E30000-memory.dmp

Filesize
256KB

Download
memory/608-64-0x0000000004DF0000-0x0000000004E30000-memory.dmp

Filesize
256KB

Download
memory/608-65-0x0000000004DF0000-0x0000000004E30000-memory.dmp

Filesize
256KB

Download
memory/608-66-0x0000000004DF0000-0x0000000004E30000-memory.dmp

Filesize
256KB

Download