bf4d67d0babd031ab6f7755549899d83183a1010a96d69ff06f209773db12f53

General

Target

bf4d67d0babd031ab6f7755549899d83183a1010a96d69ff06f209773db12f53.exe
Size

262KB
MD5

c01293919e17abc7ec81a39b5ddc9829
SHA1

0ea90592554baa97aba14a93014faad7e29654bd
SHA256

bf4d67d0babd031ab6f7755549899d83183a1010a96d69ff06f209773db12f53
SHA512

b5891fb18bd3778ec698e6db8ec9e2c63e617385af777fa395ce5ab5ceb8d11fe7f6c42b19671621c7d4c613628be5320d87760bba2cf2fa69db3f9ad8df385d
SSDEEP

6144:ccGpZaraB2WWLsOMibVaPH+1YjZGlmo1oLgNNN/s:cc6ZaWB23sWH+Z6m/gNNN/s

Score

1^/10

Malware Config

Signatures

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	bf4d67d0babd031ab6f7755549899d83183a1010a96d69ff06f209773db12f53.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	bf4d67d0babd031ab6f7755549899d83183a1010a96d69ff06f209773db12f53.exe

C:\Users\Admin\AppData\Local\Temp\bf4d67d0babd031ab6f7755549899d83183a1010a96d69ff06f209773db12f53.exe
"C:\Users\Admin\AppData\Local\Temp\bf4d67d0babd031ab6f7755549899d83183a1010a96d69ff06f209773db12f53.exe"
1⤵
- Modifies system certificate store
PID:1456

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Config.ini

Filesize
37B

MD5
677fa89db72ef186c106944d2abc55d1

SHA1
31b771221a261d6f3f9a2924295548782c5c8152

SHA256
dc662106564e8d4b3b7cdb8aeadec5f98129c2ff09f585dc2e4cb9c71086f151

SHA512
a42d819d1eba187b1d8bafcc00425983de28da1affa45218720fe4db5be5946e5d1cbafe7a5acb4c5da3b7c655b5dd1fbab1a993cd1de0be5267050c298d6c4d

Download Submit
memory/1456-132-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/1456-54-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/1456-55-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/1456-103-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/1456-104-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1456-128-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/1456-129-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/1456-130-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/1456-56-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/1456-131-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/1456-135-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/1456-134-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/1456-133-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/1456-136-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/1456-137-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/1456-138-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/1456-139-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/1456-140-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/1456-141-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/1456-142-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing