bb4a53733f0033eb457acf98da3adcaed09328dbd37dd8991d788ae67187b33d

General

Target

OneLaunch - PDF_6qhow.exe
Size

2.9MB
MD5

cdd6433b49575a3a11018af8a079b695
SHA1

b7c82e18b683939dff6891a9e3afe3f97275ed31
SHA256

bb4a53733f0033eb457acf98da3adcaed09328dbd37dd8991d788ae67187b33d
SHA512

e9ec2ffdee94d0b66a7ccd0e01a187bdcc3fbd56d84835b4fb555797008e5891580da7ea1cbee1be38a6625850e23b433105cf6cc5b88d90b98a506a0da41a96
SSDEEP

49152:hqe3f6RzyPE5oZPCpecWcNwDCEjqVX5rIJwI2J5PiH7nBGtY:4SiRzcSeCec/NwWEjgJLTiH7BUY

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

OneLaunch - PDF_6qhow.tmp

pid process

2376 OneLaunch - PDF_6qhow.tmp
Loads dropped DLL 2 IoCs

Processes:

OneLaunch - PDF_6qhow.exeOneLaunch - PDF_6qhow.tmp

pid process

2188 OneLaunch - PDF_6qhow.exe
2376 OneLaunch - PDF_6qhow.tmp

pid	process
2376	OneLaunch - PDF_6qhow.tmp

pid	process
2188	OneLaunch - PDF_6qhow.exe
2376	OneLaunch - PDF_6qhow.tmp

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

OneLaunch - PDF_6qhow.tmp

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e40f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47419000000010000001000000068cb42b035ea773e52ef50ecf50ec52920000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	OneLaunch - PDF_6qhow.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	OneLaunch - PDF_6qhow.tmp

Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 5 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

description	flow	ioc
HTTP User-Agent header	5	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

OneLaunch - PDF_6qhow.exe

description	pid	process	target process
PID 2188 wrote to memory of 2376	2188	OneLaunch - PDF_6qhow.exe	OneLaunch - PDF_6qhow.tmp
PID 2188 wrote to memory of 2376	2188	OneLaunch - PDF_6qhow.exe	OneLaunch - PDF_6qhow.tmp
PID 2188 wrote to memory of 2376	2188	OneLaunch - PDF_6qhow.exe	OneLaunch - PDF_6qhow.tmp
PID 2188 wrote to memory of 2376	2188	OneLaunch - PDF_6qhow.exe	OneLaunch - PDF_6qhow.tmp
PID 2188 wrote to memory of 2376	2188	OneLaunch - PDF_6qhow.exe	OneLaunch - PDF_6qhow.tmp
PID 2188 wrote to memory of 2376	2188	OneLaunch - PDF_6qhow.exe	OneLaunch - PDF_6qhow.tmp
PID 2188 wrote to memory of 2376	2188	OneLaunch - PDF_6qhow.exe	OneLaunch - PDF_6qhow.tmp

C:\Users\Admin\AppData\Local\Temp\OneLaunch - PDF_6qhow.exe
"C:\Users\Admin\AppData\Local\Temp\OneLaunch - PDF_6qhow.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2188

C:\Users\Admin\AppData\Local\Temp\is-C24PH.tmp\OneLaunch - PDF_6qhow.tmp
"C:\Users\Admin\AppData\Local\Temp\is-C24PH.tmp\OneLaunch - PDF_6qhow.tmp" /SL5="$90126,2173635,893952,C:\Users\Admin\AppData\Local\Temp\OneLaunch - PDF_6qhow.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
PID:2376

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-C24PH.tmp\OneLaunch - PDF_6qhow.tmp

Filesize
3.0MB

MD5
9b5632f007c8167a3b00da0650890656

SHA1
fa58306fc2dc2a6be63501625e96570979560582

SHA256
4f97a90004773cb627a9cbb39cff5c2c43262d04b7f9f88572b81ad041ed48a4

SHA512
0ec72d4dd1d188bf7a717d1fb8fd087c16cd0c93fc2d78bc16bce625dc615710f2c6074b54d8f1f0f0b4b9a1042c3ab47482ed16a5c4bd038f62bfe5a2c6fa21

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UM0QT.tmp\Win32Library.dll

Filesize
45KB

MD5
4f424691cf849999b6ac476ca09afdee

SHA1
98e2827aea19ccfc3980c5329f53e408f30acf8f

SHA256
ca6793c4f4b12fac9506f441b8d6641a3e465dda0a1a14d49acdaa56a0389b07

SHA512
2aec1c49b608a47b3804345094a108db3ce0e0ef7127eb70fa2e07a4c500fa697b33fcee4d7e6ebf3d8cc04dae13f7f07439d4dc1dcd6239baddef5d818edfff

Download Submit
\Users\Admin\AppData\Local\Temp\is-C24PH.tmp\OneLaunch - PDF_6qhow.tmp

Filesize
3.0MB

MD5
9b5632f007c8167a3b00da0650890656

SHA1
fa58306fc2dc2a6be63501625e96570979560582

SHA256
4f97a90004773cb627a9cbb39cff5c2c43262d04b7f9f88572b81ad041ed48a4

SHA512
0ec72d4dd1d188bf7a717d1fb8fd087c16cd0c93fc2d78bc16bce625dc615710f2c6074b54d8f1f0f0b4b9a1042c3ab47482ed16a5c4bd038f62bfe5a2c6fa21

Download Submit
\Users\Admin\AppData\Local\Temp\is-UM0QT.tmp\Win32Library.dll

Filesize
45KB

MD5
4f424691cf849999b6ac476ca09afdee

SHA1
98e2827aea19ccfc3980c5329f53e408f30acf8f

SHA256
ca6793c4f4b12fac9506f441b8d6641a3e465dda0a1a14d49acdaa56a0389b07

SHA512
2aec1c49b608a47b3804345094a108db3ce0e0ef7127eb70fa2e07a4c500fa697b33fcee4d7e6ebf3d8cc04dae13f7f07439d4dc1dcd6239baddef5d818edfff

Download Submit
memory/2188-54-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/2188-77-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/2376-69-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2376-75-0x0000000000400000-0x000000000070A000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing