9cd82c8bb30da2bd8dcb3d3a9b0405e0e98024d5ce323ac3c1fcb9ac0cb1cf81

General

Target

3d8cb0e19e4f754ca91117d2f04394fa.exe
Size

52KB
MD5

3d8cb0e19e4f754ca91117d2f04394fa
SHA1

162f1bcfe234c267d01a6a6e83052bdf50f06148
SHA256

9cd82c8bb30da2bd8dcb3d3a9b0405e0e98024d5ce323ac3c1fcb9ac0cb1cf81
SHA512

8170a852509044bb92d7172cc90257af2919dcfabfdb2c7369770de766ac997a9623483512c9da2900cc4e2cea4e6ab6df5272409624f947c4192885312cbe82
SSDEEP

768:J9NHMHPEjfe8l6SdK8fHPfekFKB3qaSxQZthxxdeVCech1+Y:hsHPjD8fHf00aSKtPccX+

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	3d8cb0e19e4f754ca91117d2f04394fa.exe

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000200000001e7f2-4.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5040	certmgr.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1217993601 = "C:\\Windows\\system32\\1217993601\\winlogon.exe"	3d8cb0e19e4f754ca91117d2f04394fa.exe

Modifies WinLogon 2 TTPs 8 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	3d8cb0e19e4f754ca91117d2f04394fa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ abox\DllName = "C:\\Windows\\system32\\1217993601\\GbN.dll"	3d8cb0e19e4f754ca91117d2f04394fa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ abox\Startup = "Lg9Fu"	3d8cb0e19e4f754ca91117d2f04394fa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ abox\Logon = "Lg9Fu"	3d8cb0e19e4f754ca91117d2f04394fa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ abox\Asynchronous = "0"	3d8cb0e19e4f754ca91117d2f04394fa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ abox\Impersonate = "0"	3d8cb0e19e4f754ca91117d2f04394fa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ abox\MaxWait = "258"	3d8cb0e19e4f754ca91117d2f04394fa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ abox	3d8cb0e19e4f754ca91117d2f04394fa.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\1217993601\CA.crt	3d8cb0e19e4f754ca91117d2f04394fa.exe
File created	C:\Windows\SysWOW64\1217993601\certmgr.exe	3d8cb0e19e4f754ca91117d2f04394fa.exe
File created	C:\Windows\SysWOW64\1217993601\GbN.dll	3d8cb0e19e4f754ca91117d2f04394fa.exe
File created	C:\Windows\SysWOW64\1217993601\winlogon.exe	3d8cb0e19e4f754ca91117d2f04394fa.exe
File opened for modification	C:\Windows\SysWOW64\1217993601\winlogon.exe	3d8cb0e19e4f754ca91117d2f04394fa.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\FC1DDBA1A3B19120307637513E4D881BE898480C	certmgr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\FC1DDBA1A3B19120307637513E4D881BE898480C\Blob = 030000000100000014000000fc1ddba1a3b19120307637513e4d881be898480c2000000001000000bc030000308203b830820321a003020102020900bda753ee4a4293c0300d06092a864886f70d010105050030819a310b3009060355040613024252310b30090603550408130244463111300f0603550407130842726173696c6961311c301a060355040a1313436f6d707574696e6720536f667477617265733111300f060355040b1308496e7465726e6574311430120603550403130b436f6d707574696e6753573124302206092a864886f70d010901161561646d696e40636f6d707574696e6773772e6e6574301e170d3038303430343036343130345a170d3131303430343036343130345a30819a310b3009060355040613024252310b30090603550408130244463111300f0603550407130842726173696c6961311c301a060355040a1313436f6d707574696e6720536f667477617265733111300f060355040b1308496e7465726e6574311430120603550403130b436f6d707574696e6753573124302206092a864886f70d010901161561646d696e40636f6d707574696e6773772e6e657430819f300d06092a864886f70d010101050003818d0030818902818100b0a309fa1aba7b268340afb7da2a6b279081581faeefe6e644e0a59b58d5e0af6316b2f5a4013cf9342e578023fa9a60482a3c74f987909b26702e1863383bf727685af59a0cf1420765416bb88b5459156c7e0312e366b2432ec9d52dbcb19f9836cc85d829087375e17bc78ccafbaeeae6511a4bcea9bad6f301cf3594cc630203010001a38201023081ff301d0603551d0e041604148fe8869320b861f8f7a9c768b474d8c24b736ef73081cf0603551d230481c73081c480148fe8869320b861f8f7a9c768b474d8c24b736ef7a181a0a4819d30819a310b3009060355040613024252310b30090603550408130244463111300f0603550407130842726173696c6961311c301a060355040a1313436f6d707574696e6720536f667477617265733111300f060355040b1308496e7465726e6574311430120603550403130b436f6d707574696e6753573124302206092a864886f70d010901161561646d696e40636f6d707574696e6773772e6e6574820900bda753ee4a4293c0300c0603551d13040530030101ff300d06092a864886f70d0101050500038181002d1bd3df21e951932a2b599d11781e1bd29fda4f141461c3a5d07a0122aae4d3f903f9f7658044d2d319117101f9fa487370fb7b7193474f8bab37574bf0bc1fbe45b4914f314c4caa38829d3968725a918158cec9ff187c82a05f4aa2ec09626aad026cff622c576974acb21da1b8bce39fd59d76b30e5e28ce4d6f9a9285a5	certmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2252	3d8cb0e19e4f754ca91117d2f04394fa.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 5040	2252	3d8cb0e19e4f754ca91117d2f04394fa.exe	96
PID 2252 wrote to memory of 5040	2252	3d8cb0e19e4f754ca91117d2f04394fa.exe	96
PID 2252 wrote to memory of 5040	2252	3d8cb0e19e4f754ca91117d2f04394fa.exe	96

C:\Users\Admin\AppData\Local\Temp\3d8cb0e19e4f754ca91117d2f04394fa.exe
"C:\Users\Admin\AppData\Local\Temp\3d8cb0e19e4f754ca91117d2f04394fa.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\SysWOW64\1217993601\certmgr.exe
  C:\Windows\system32\1217993601\certmgr.exe -add -c CA.crt -s -r localMachine root
  2⤵
  - Executes dropped EXE
  - Modifies system certificate store
  PID:5040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

3

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\1217993601\CA.crt

Filesize
1KB

MD5
499a4c5a719a6fb0e0fe92c2bca3b28f

SHA1
5e1475f2adfeaf283788c7dc3f86a2708ab91d36

SHA256
b23ce371bf9c317349febae34bef615cbc552a7d8df4fbfc1d33b30da72a3f0c

SHA512
b47f4d08b6c5536718349fd2b36a1c851e90db7a97fae214220d4bbd4d7db5455f9edafb76b15323b60ca00a508794980df4faa4081b8c16b72ad70c997cd9d3

Download Submit
C:\Windows\SysWOW64\1217993601\certmgr.exe

Filesize
28KB

MD5
aa31551fd28444c2fab106f2ab056503

SHA1
46ecfe8ca5ebd3307eeb2b8c36c5d7de331949e4

SHA256
2bb0443af185c99458e43b4e5f60232238ebea72a74d37c31b82ef10ffbc1dc3

SHA512
c6e31185e4d774e22b61665c5fb71493e97a83dc2a9dd853c86ec9ed132beff3bab7601057d4e3bb1527334c3f0e3910b650f831e3a6ab5489f01cb618aaca3c

Download Submit
memory/2252-0-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2252-5-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2252-15-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/5040-7-0x0000000001000000-0x0000000001015000-memory.dmp

Filesize
84KB

Download
memory/5040-13-0x0000000001000000-0x0000000001015000-memory.dmp

Filesize
84KB

Download
memory/5040-14-0x0000000001000000-0x0000000001015000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads