0aebe70b51af4c8914fbf3b8c5a03f24a7e6f33eae8134a6da02bb4afb7b0821

General

Target

077b63cd97b092c56918eb05a8230a40.exe
Size

385KB
MD5

077b63cd97b092c56918eb05a8230a40
SHA1

8411de8bba5cd8efed035c40164e35c82d4db2c6
SHA256

0aebe70b51af4c8914fbf3b8c5a03f24a7e6f33eae8134a6da02bb4afb7b0821
SHA512

614bfd559a93fc4f026c8c96d9dcf008f27a2ff48f138d4916b217e5aefaf753efb146381a7f716ac46a341c51308f960c4684f17186956b90a415e6e58b7a2f
SSDEEP

6144:AXJ/1soWib/U3rXJMRuHwhv72ynHFd0dQk2GcI2w+5vOyH9gPelN/04yxCd220B:A5yoWo/U3tMEQhvT30k5vXgeP220B

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2248	077b63cd97b092c56918eb05a8230a40.exe

Executes dropped EXE 1 IoCs

pid	Process
2248	077b63cd97b092c56918eb05a8230a40.exe

Loads dropped DLL 1 IoCs

pid	Process
3024	077b63cd97b092c56918eb05a8230a40.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Modifies system certificate store 2 TTPs 3 IoCs

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	077b63cd97b092c56918eb05a8230a40.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec529030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	077b63cd97b092c56918eb05a8230a40.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	077b63cd97b092c56918eb05a8230a40.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3024	077b63cd97b092c56918eb05a8230a40.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3024	077b63cd97b092c56918eb05a8230a40.exe
2248	077b63cd97b092c56918eb05a8230a40.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2248	3024	077b63cd97b092c56918eb05a8230a40.exe	28
PID 3024 wrote to memory of 2248	3024	077b63cd97b092c56918eb05a8230a40.exe	28
PID 3024 wrote to memory of 2248	3024	077b63cd97b092c56918eb05a8230a40.exe	28
PID 3024 wrote to memory of 2248	3024	077b63cd97b092c56918eb05a8230a40.exe	28

C:\Users\Admin\AppData\Local\Temp\077b63cd97b092c56918eb05a8230a40.exe
"C:\Users\Admin\AppData\Local\Temp\077b63cd97b092c56918eb05a8230a40.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Users\Admin\AppData\Local\Temp\077b63cd97b092c56918eb05a8230a40.exe
  C:\Users\Admin\AppData\Local\Temp\077b63cd97b092c56918eb05a8230a40.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Modifies system certificate store
  - Suspicious use of UnmapMainImage
  PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Cab8B51.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8CBA.tmp

Filesize
64KB

MD5
69b8e2fe3bb7142b759bbc3bd3092cc2

SHA1
c55b032e44415d77a1a2f3f6c6c049b7cc32afd7

SHA256
d31cf766104ab57466eca8c74b0b1dc3f7729270b60df98dde747087ec3e8bb4

SHA512
c3b3ca6861a0e35822f0c5b6085f7fc1444b051548aec4362723d1b7a14b72cd832335ca29eea23ce8f9fb71f4ac76c6bf2b58a220722e7843461bf095970b7b

Download Submit
\Users\Admin\AppData\Local\Temp\077b63cd97b092c56918eb05a8230a40.exe

Filesize
385KB

MD5
b12ba7acead5c5d0963bb5f6be382fe3

SHA1
2215f34125470747b3facd0a1e463cda56e0e7fd

SHA256
6ef96c989ff103f16dcf05c334104241b7b070326876de9ace87d88b78d9c123

SHA512
bb2c9d2df8d3e45c4daf2ddaf35a500dc2f3635049de2490b68bd9cc81c8a42a06ab7fe0e4fe4fcc918da8347143a014e9899233703367ed2cd98f4eec184920

Download Submit
memory/2248-17-0x0000000000190000-0x00000000001F6000-memory.dmp

Filesize
408KB

Download
memory/2248-22-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2248-25-0x0000000001470000-0x00000000014CF000-memory.dmp

Filesize
380KB

Download
memory/2248-76-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2248-82-0x00000000096A0000-0x00000000096DC000-memory.dmp

Filesize
240KB

Download
memory/2248-81-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2248-83-0x00000000096A0000-0x00000000096DC000-memory.dmp

Filesize
240KB

Download
memory/3024-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3024-12-0x0000000001470000-0x00000000014D6000-memory.dmp

Filesize
408KB

Download
memory/3024-14-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3024-2-0x0000000000190000-0x00000000001F6000-memory.dmp

Filesize
408KB

Download
memory/3024-1-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download

Analysis

Sharing