85e6630cbaf28e3e4832773c62818cd9d9eac7876b01841bda36fed818d9fd56

General

Target

643ed1f839d4e79897ac4294b8bb8e1c.exe
Size

907KB
MD5

643ed1f839d4e79897ac4294b8bb8e1c
SHA1

b2ae1128541e76151ef3fb3f842af4b38b5c8e30
SHA256

85e6630cbaf28e3e4832773c62818cd9d9eac7876b01841bda36fed818d9fd56
SHA512

360d750a6a9a4d5e5a345bc60fc11c29aeb58efd94b37d2e09ad32f01ca0c2c4c8972f7142cb03d85df3d453dc5ac69d7dc3273337ef3c8aae90f051b6a54a96
SSDEEP

24576:t0ekAzhDXwPYfuh6RzDsR/Pp8vS5Ta/ZS1:t0ZAyi99sNPp8vSxgS

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2712	643ed1f839d4e79897ac4294b8bb8e1c.exe

Executes dropped EXE 1 IoCs

pid	Process
2712	643ed1f839d4e79897ac4294b8bb8e1c.exe

Loads dropped DLL 1 IoCs

pid	Process
2364	643ed1f839d4e79897ac4294b8bb8e1c.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Modifies system certificate store 2 TTPs 3 IoCs

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	643ed1f839d4e79897ac4294b8bb8e1c.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	643ed1f839d4e79897ac4294b8bb8e1c.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec529030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	643ed1f839d4e79897ac4294b8bb8e1c.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2364	643ed1f839d4e79897ac4294b8bb8e1c.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2364	643ed1f839d4e79897ac4294b8bb8e1c.exe
2712	643ed1f839d4e79897ac4294b8bb8e1c.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2712	2364	643ed1f839d4e79897ac4294b8bb8e1c.exe	29
PID 2364 wrote to memory of 2712	2364	643ed1f839d4e79897ac4294b8bb8e1c.exe	29
PID 2364 wrote to memory of 2712	2364	643ed1f839d4e79897ac4294b8bb8e1c.exe	29
PID 2364 wrote to memory of 2712	2364	643ed1f839d4e79897ac4294b8bb8e1c.exe	29

C:\Users\Admin\AppData\Local\Temp\643ed1f839d4e79897ac4294b8bb8e1c.exe
"C:\Users\Admin\AppData\Local\Temp\643ed1f839d4e79897ac4294b8bb8e1c.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Users\Admin\AppData\Local\Temp\643ed1f839d4e79897ac4294b8bb8e1c.exe
  C:\Users\Admin\AppData\Local\Temp\643ed1f839d4e79897ac4294b8bb8e1c.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Modifies system certificate store
  - Suspicious use of UnmapMainImage
  PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\643ed1f839d4e79897ac4294b8bb8e1c.exe

Filesize
288KB

MD5
483907ba19e8379d4e0913a37a7ee5a7

SHA1
446b478ca2642f402c5d8abd025bf7633f49b07f

SHA256
2694f1b7892ee2e8e4306c5beec5d5668266618c779f849568893ee0a4cc4bf5

SHA512
1944c696ff3b40c38d27fa9e302d9f33abbbcb5f13a2598e48be5dc22d252157bfee136f9c84c14a0c5c6a47d245d2ff3163687d3ce8bc5a2292d5cec06e62dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab149C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar14AE.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
\Users\Admin\AppData\Local\Temp\643ed1f839d4e79897ac4294b8bb8e1c.exe

Filesize
465KB

MD5
4ad14032319a9b6c3fbd0d677a4801c8

SHA1
cf5c94e08c70d1a98f510aaed14683ba4736664b

SHA256
da69fc6f1e5c243cad0bd0b6ef623cfbc27499bd635378d1388b03da9849590b

SHA512
db31661e6fa080fd53b3d5bac8093d9028878aacdafcfc1c2b04ee0de7b0fb20cc3e8162ad790bc32b49a39e20cdc59f9bb4330ee7132c96d32f9b70baf8095a

Download Submit
memory/2364-13-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/2364-1-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/2364-2-0x0000000000300000-0x00000000003E8000-memory.dmp

Filesize
928KB

Download
memory/2364-0-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/2364-14-0x00000000032D0000-0x00000000033B8000-memory.dmp

Filesize
928KB

Download
memory/2712-23-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2712-16-0x0000000000310000-0x00000000003F8000-memory.dmp

Filesize
928KB

Download
memory/2712-27-0x0000000002FF0000-0x00000000030AB000-memory.dmp

Filesize
748KB

Download
memory/2712-18-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/2712-83-0x0000000008790000-0x0000000008828000-memory.dmp

Filesize
608KB

Download
memory/2712-77-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download

Analysis

Sharing