3e0565304c1d7e1c8600717fd11c1163b4ab7d301ec049d8d229c087ab5d093f

General

Target

41641f4bb96a9497adf5d09716f77b49.exe
Size

385KB
MD5

41641f4bb96a9497adf5d09716f77b49
SHA1

1e5613d2657991e6821939d68e65bbea16e0dfa5
SHA256

3e0565304c1d7e1c8600717fd11c1163b4ab7d301ec049d8d229c087ab5d093f
SHA512

e9abb8b52f42d3e3d778a5cc45adc205187717051ac8d3a98a499e13a6ddbcff4942eefdb07dd2dbd9b3c5d2980a1f5a9a0c2dad3373a9cf46f5b1aae30cb998
SSDEEP

6144:8M+tr5yvCR+gIyhFsstw1okjvd0Bp/hXuoLuakhN5FdDuDB:wr8vo+gFF+5vd0XVTLuasNpDuDB

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1252	41641f4bb96a9497adf5d09716f77b49.exe

Executes dropped EXE 1 IoCs

pid	Process
1252	41641f4bb96a9497adf5d09716f77b49.exe

Loads dropped DLL 1 IoCs

pid	Process
2500	41641f4bb96a9497adf5d09716f77b49.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Modifies system certificate store 2 TTPs 3 IoCs

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	41641f4bb96a9497adf5d09716f77b49.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	41641f4bb96a9497adf5d09716f77b49.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec529030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	41641f4bb96a9497adf5d09716f77b49.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2500	41641f4bb96a9497adf5d09716f77b49.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2500	41641f4bb96a9497adf5d09716f77b49.exe
1252	41641f4bb96a9497adf5d09716f77b49.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 1252	2500	41641f4bb96a9497adf5d09716f77b49.exe	15
PID 2500 wrote to memory of 1252	2500	41641f4bb96a9497adf5d09716f77b49.exe	15
PID 2500 wrote to memory of 1252	2500	41641f4bb96a9497adf5d09716f77b49.exe	15
PID 2500 wrote to memory of 1252	2500	41641f4bb96a9497adf5d09716f77b49.exe	15

C:\Users\Admin\AppData\Local\Temp\41641f4bb96a9497adf5d09716f77b49.exe
"C:\Users\Admin\AppData\Local\Temp\41641f4bb96a9497adf5d09716f77b49.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Users\Admin\AppData\Local\Temp\41641f4bb96a9497adf5d09716f77b49.exe
  C:\Users\Admin\AppData\Local\Temp\41641f4bb96a9497adf5d09716f77b49.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Modifies system certificate store
  - Suspicious use of UnmapMainImage
  PID:1252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\41641f4bb96a9497adf5d09716f77b49.exe

Filesize
78KB

MD5
8f37d18e358e172c64edf0d42ed17f01

SHA1
ef0d3dcdc48552dd076611ec289cb758f167924b

SHA256
32bf56ebbf944e266701aa1b1503aa7ee8566aa579183aa6d275f70be4076771

SHA512
ddf96fbc8f0be22d0e368ad6a17f7f19e82e8fca2ba7ce0306e8b52b5a6d100e9518ca89a1f05650d14c54e79fea0bf6137838286c1fee1211fef362a600bbe5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1289.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar129C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
\Users\Admin\AppData\Local\Temp\41641f4bb96a9497adf5d09716f77b49.exe

Filesize
9KB

MD5
95487a52a2a564cacac2e344da18afe9

SHA1
c53742dd1c65aa92a9e5cb8a809b3618d8b48153

SHA256
4ccd6988f1e5a8b4042b79114eee6f59f03f6814cecaa2aeac95906d0b08d77e

SHA512
68d3f36548c9555b059b953065e8e2a6a48a3d42d3ac67764e7122b83c5e7926503c0e036070f2fb63f6124c3b0b196709587b23658435cedaecb435d7397358

Download Submit
memory/1252-81-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1252-24-0x0000000002D50000-0x0000000002DAF000-memory.dmp

Filesize
380KB

Download
memory/1252-21-0x0000000000370000-0x00000000003D6000-memory.dmp

Filesize
408KB

Download
memory/1252-22-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1252-82-0x000000000D680000-0x000000000D6BC000-memory.dmp

Filesize
240KB

Download
memory/1252-76-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1252-83-0x000000000D680000-0x000000000D6BC000-memory.dmp

Filesize
240KB

Download
memory/2500-14-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2500-12-0x0000000000200000-0x0000000000266000-memory.dmp

Filesize
408KB

Download
memory/2500-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2500-2-0x0000000000190000-0x00000000001F6000-memory.dmp

Filesize
408KB

Download
memory/2500-1-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download

Analysis

Sharing