2853585aceea5206bc07b2ab320280d85d30405a67cee4ef87b067704c1399e5

General

Target

50c4777836a64941339702dc37a72278.exe
Size

385KB
MD5

50c4777836a64941339702dc37a72278
SHA1

04c2dc98a49b9e3b4c8f5464040d488e169e578d
SHA256

2853585aceea5206bc07b2ab320280d85d30405a67cee4ef87b067704c1399e5
SHA512

09ced7a2f35fda36c6b3f044247ffdda404b1a43219425303176e6a39fe2038818890af148e492aca1a033a6c462729be47774d4022e56152f8740af085c403b
SSDEEP

12288:PSpq4qWd2TKdWFabcX5v/iKSpa6SB7PNOmB:PSQ8qqWFQ25vopzqNOmB

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2800	50c4777836a64941339702dc37a72278.exe

Executes dropped EXE 1 IoCs

pid	Process
2800	50c4777836a64941339702dc37a72278.exe

Loads dropped DLL 1 IoCs

pid	Process
1736	50c4777836a64941339702dc37a72278.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Modifies system certificate store 2 TTPs 3 IoCs

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	50c4777836a64941339702dc37a72278.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	50c4777836a64941339702dc37a72278.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec529030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	50c4777836a64941339702dc37a72278.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1736	50c4777836a64941339702dc37a72278.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1736	50c4777836a64941339702dc37a72278.exe
2800	50c4777836a64941339702dc37a72278.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 2800	1736	50c4777836a64941339702dc37a72278.exe	14
PID 1736 wrote to memory of 2800	1736	50c4777836a64941339702dc37a72278.exe	14
PID 1736 wrote to memory of 2800	1736	50c4777836a64941339702dc37a72278.exe	14
PID 1736 wrote to memory of 2800	1736	50c4777836a64941339702dc37a72278.exe	14

C:\Users\Admin\AppData\Local\Temp\50c4777836a64941339702dc37a72278.exe
C:\Users\Admin\AppData\Local\Temp\50c4777836a64941339702dc37a72278.exe
1⤵
- Deletes itself
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of UnmapMainImage
PID:2800

C:\Users\Admin\AppData\Local\Temp\50c4777836a64941339702dc37a72278.exe
"C:\Users\Admin\AppData\Local\Temp\50c4777836a64941339702dc37a72278.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1736-1-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1736-2-0x0000000000220000-0x0000000000286000-memory.dmp

Filesize
408KB

Download
memory/1736-16-0x0000000000290000-0x00000000002F6000-memory.dmp

Filesize
408KB

Download
memory/1736-13-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1736-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2800-19-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2800-28-0x0000000002CB0000-0x0000000002D0F000-memory.dmp

Filesize
380KB

Download
memory/2800-23-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2800-21-0x0000000000380000-0x00000000003E6000-memory.dmp

Filesize
408KB

Download
memory/2800-77-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2800-83-0x0000000009700000-0x000000000973C000-memory.dmp

Filesize
240KB

Download
memory/2800-82-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing