2d46ff3cbac2b089b1382dd24565e68bfdac0f627231dab1b6552a1b3c2b4132

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 15:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

RDM_Root_Cert_Update_Windows.exe
Size

3.7MB
MD5

d4b2995d38da119e5b0db2cb90778224
SHA1

2570198aafaf5d6f394ffd6e7e741c2316510ee0
SHA256

05a6215fbf82c755b73dcfa297f229bf5b88c879b4a7a2edf680ebd97a4580ad
SHA512

a611e1fbd0b9997e395f1b829e4b08f833cf5d70e9e846c7eb81d8faeef9fee4af11fc43f4f47776692595ed880eda6b7fd68210cc381984fb70ccf75d680366
SSDEEP

98304:uSiKiNyE3pWHFowVGfO1xW8zjoix6b8/CEqvV0CAe:/KyE5WHFowQsxVwzE/cH

Score

8^/10

spyware stealer

Malware Config

Signatures

Manipulates Digital Signatures 1 TTPs 33 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.2.1.26!6\Name = "SpcMinimalCriteria"	CertMgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.2.1.27!6\Name = "SpcFinancialCriteria"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.1!6\Name = "NetscapeCertType"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.13!6\Name = "NetscapeComment"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.3!6\Name = "NetscapeRevocationURL"	CertMgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.2.1.10!6\Name = "SpcSpAgencyInfo"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.2!6\Name = "NetscapeBaseURL"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.13!6\Name = "NetscapeComment"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.2.1.26!6\Name = "SpcMinimalCriteria"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.1!6\Name = "NetscapeCertType"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.7!6\Name = "NetscapeCertRenewalURL"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.12!6\Name = "NetscapeSSLServerName"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.2.1.27!6\Name = "SpcFinancialCriteria"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.3!6\Name = "NetscapeRevocationURL"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.2!6\Name = "NetscapeBaseURL"	CertMgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.7!6\Name = "NetscapeCertRenewalURL"	CertMgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.8!6\Name = "NetscapeCAPolicyURL"	CertMgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.13!6\Name = "NetscapeComment"	CertMgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.7!6\Name = "NetscapeCertRenewalURL"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.2.1.26!6\Name = "SpcMinimalCriteria"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.1!6\Name = "NetscapeCertType"	CertMgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.2.1.10!6\Name = "SpcSpAgencyInfo"	CertMgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.2.1.27!6\Name = "SpcFinancialCriteria"	CertMgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.4!6\Name = "NetscapeCARevocationURL"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.2.1.10!6\Name = "SpcSpAgencyInfo"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.8!6\Name = "NetscapeCAPolicyURL"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.12!6\Name = "NetscapeSSLServerName"	CertMgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.8!6\Name = "NetscapeCAPolicyURL"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.2!6\Name = "NetscapeBaseURL"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.4!6\Name = "NetscapeCARevocationURL"	CertMgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.3!6\Name = "NetscapeRevocationURL"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.4!6\Name = "NetscapeCARevocationURL"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.12!6\Name = "NetscapeSSLServerName"	certmgr.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Mozilla Firefox\defaults\pref\is-0QVRM.tmp	RDM_ROOTCERTIFICATE.tmp
File created	C:\Program Files\Mozilla Firefox\is-59352.tmp	RDM_ROOTCERTIFICATE.tmp
File created	C:\Program Files\Mozilla Firefox\defaults\pref\is-OI4F2.tmp	RDM_ROOTCERTIFICATE.tmp

Executes dropped EXE 6 IoCs

pid	Process
2156	RDM_Root_Cert_Update_Windows.tmp
1364	RDM_ROOTCERTIFICATE.exe
2036	RDM_ROOTCERTIFICATE.tmp
2852	certmgr.exe
1080	certmgr.exe
2944	CertMgr.exe

Loads dropped DLL 9 IoCs

pid	Process
2536	RDM_Root_Cert_Update_Windows.exe
2156	RDM_Root_Cert_Update_Windows.tmp
1364	RDM_ROOTCERTIFICATE.exe
676	cmd.exe
676	cmd.exe
676	cmd.exe
676	cmd.exe
2036	RDM_ROOTCERTIFICATE.tmp
2036	RDM_ROOTCERTIFICATE.tmp

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CAFAC3A697F2F0A9D66F8F1DC86BEE6AD15E425C	CertMgr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CAFAC3A697F2F0A9D66F8F1DC86BEE6AD15E425C\Blob = 030000000100000014000000cafac3a697f2f0a9d66f8f1dc86bee6ad15e425c20000000010000000704000030820403308202eb02146b150d61cef6aa05636676ae6f6dbc13c1b2bfb2300d06092a864886f70d01010b05003081bc310b30090603550406130243413110300e06035504080c074f6e746172696f3111300f06035504070c0857617465726c6f6f31183016060355040a0c0f52444d20436f72706f726174696f6e3130302e060355040b0c27446576696365202d20666f7220496e7465726e616c20496e7472616e657420757365204f6e6c793118301606035504030c0f52444d2044657669636520526f6f743122302006092a864886f70d0109011613737570706f72744072646d636f72702e636f6d3020170d3231313132363031323631385a180f32303536313131373031323631385a3081bc310b30090603550406130243413110300e06035504080c074f6e746172696f3111300f06035504070c0857617465726c6f6f31183016060355040a0c0f52444d20436f72706f726174696f6e3130302e060355040b0c27446576696365202d20666f7220496e7465726e616c20496e7472616e657420757365204f6e6c793118301606035504030c0f52444d2044657669636520526f6f743122302006092a864886f70d0109011613737570706f72744072646d636f72702e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100e74d4275f5c2761508b58d09039634309fd32bf387e544d589c5a7f8a9f28b419118d0c887937d7437a8e57db56f00021d9b47a56c0c88bd8f707fa1474770d8599feb30d0058286786cbac14ecbd1bed2f136f28af196f8ab3da52e0b450a0a9f363a785f5b2311616da50181babf2895b14089b810e5cc49e8e682693f2a887dfbb3fc8d56fd929d52f406950f3e398fa6ffcd3933cd1e043fe195568cd6319378c210e6136129af1cdc0a4c6bd466349847c7c428cbab68a5ac5f4ccfa0abd6f2f5f46bb51f131b740252335a88031006e576e5f6800fccc507c33757a4bce3f617e1933a94155b331377b8b77ee2b755b2b6bbd46f1ef7fe5b9116590d270203010001300d06092a864886f70d01010b0500038201010019bb46d4291c6eb316551a63cc92f5ae02debe5dc41e75fb03147b1b666460d1477ee31ceddeaae51e9d80e5545aa1049c69a27e34f92937adea54449c7b0218849bf29c39024187ff704e05ebadfa63bcc73c95390a0d0a7f15381676d6137015b3d8e607a2c8f1db9ded96d5c88f462e7399e535600f660450ab6f260539deb6f5149826c493aa4670f75e67ce7102b7447ec0b82f912c5e8b12b5d8529d387e0caa8329442b78eb5f8b069a1f27d6c72ae9f08e98306e6e8b24b039d3f6ed14938d065973a5e118d795958622ea3573b820694a78a3902cd81f08566a5182ecfac05141223160a5cad78dc40e41c762f723403873b2f6179f5f72521bf1e6	CertMgr.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2156	RDM_Root_Cert_Update_Windows.tmp
2156	RDM_Root_Cert_Update_Windows.tmp

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
2156	RDM_Root_Cert_Update_Windows.tmp
2156	RDM_Root_Cert_Update_Windows.tmp
2156	RDM_Root_Cert_Update_Windows.tmp
2156	RDM_Root_Cert_Update_Windows.tmp
2156	RDM_Root_Cert_Update_Windows.tmp
2156	RDM_Root_Cert_Update_Windows.tmp
2156	RDM_Root_Cert_Update_Windows.tmp
2156	RDM_Root_Cert_Update_Windows.tmp
2156	RDM_Root_Cert_Update_Windows.tmp
2156	RDM_Root_Cert_Update_Windows.tmp
2156	RDM_Root_Cert_Update_Windows.tmp
2156	RDM_Root_Cert_Update_Windows.tmp
2156	RDM_Root_Cert_Update_Windows.tmp
2156	RDM_Root_Cert_Update_Windows.tmp
2156	RDM_Root_Cert_Update_Windows.tmp
2156	RDM_Root_Cert_Update_Windows.tmp
2156	RDM_Root_Cert_Update_Windows.tmp
2156	RDM_Root_Cert_Update_Windows.tmp
2156	RDM_Root_Cert_Update_Windows.tmp
2156	RDM_Root_Cert_Update_Windows.tmp
2156	RDM_Root_Cert_Update_Windows.tmp
2156	RDM_Root_Cert_Update_Windows.tmp
2156	RDM_Root_Cert_Update_Windows.tmp
2156	RDM_Root_Cert_Update_Windows.tmp
2156	RDM_Root_Cert_Update_Windows.tmp
2156	RDM_Root_Cert_Update_Windows.tmp
2156	RDM_Root_Cert_Update_Windows.tmp
2036	RDM_ROOTCERTIFICATE.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2156	2536	RDM_Root_Cert_Update_Windows.exe	31
PID 2536 wrote to memory of 2156	2536	RDM_Root_Cert_Update_Windows.exe	31
PID 2536 wrote to memory of 2156	2536	RDM_Root_Cert_Update_Windows.exe	31
PID 2536 wrote to memory of 2156	2536	RDM_Root_Cert_Update_Windows.exe	31
PID 2536 wrote to memory of 2156	2536	RDM_Root_Cert_Update_Windows.exe	31
PID 2536 wrote to memory of 2156	2536	RDM_Root_Cert_Update_Windows.exe	31
PID 2536 wrote to memory of 2156	2536	RDM_Root_Cert_Update_Windows.exe	31
PID 2156 wrote to memory of 1364	2156	RDM_Root_Cert_Update_Windows.tmp	32
PID 2156 wrote to memory of 1364	2156	RDM_Root_Cert_Update_Windows.tmp	32
PID 2156 wrote to memory of 1364	2156	RDM_Root_Cert_Update_Windows.tmp	32
PID 2156 wrote to memory of 1364	2156	RDM_Root_Cert_Update_Windows.tmp	32
PID 2156 wrote to memory of 1364	2156	RDM_Root_Cert_Update_Windows.tmp	32
PID 2156 wrote to memory of 1364	2156	RDM_Root_Cert_Update_Windows.tmp	32
PID 2156 wrote to memory of 1364	2156	RDM_Root_Cert_Update_Windows.tmp	32
PID 1364 wrote to memory of 2036	1364	RDM_ROOTCERTIFICATE.exe	33
PID 1364 wrote to memory of 2036	1364	RDM_ROOTCERTIFICATE.exe	33
PID 1364 wrote to memory of 2036	1364	RDM_ROOTCERTIFICATE.exe	33
PID 1364 wrote to memory of 2036	1364	RDM_ROOTCERTIFICATE.exe	33
PID 1364 wrote to memory of 2036	1364	RDM_ROOTCERTIFICATE.exe	33
PID 1364 wrote to memory of 2036	1364	RDM_ROOTCERTIFICATE.exe	33
PID 1364 wrote to memory of 2036	1364	RDM_ROOTCERTIFICATE.exe	33
PID 2036 wrote to memory of 676	2036	RDM_ROOTCERTIFICATE.tmp	34
PID 2036 wrote to memory of 676	2036	RDM_ROOTCERTIFICATE.tmp	34
PID 2036 wrote to memory of 676	2036	RDM_ROOTCERTIFICATE.tmp	34
PID 2036 wrote to memory of 676	2036	RDM_ROOTCERTIFICATE.tmp	34
PID 676 wrote to memory of 1292	676	cmd.exe	36
PID 676 wrote to memory of 1292	676	cmd.exe	36
PID 676 wrote to memory of 1292	676	cmd.exe	36
PID 676 wrote to memory of 1292	676	cmd.exe	36
PID 676 wrote to memory of 2852	676	cmd.exe	37
PID 676 wrote to memory of 2852	676	cmd.exe	37
PID 676 wrote to memory of 2852	676	cmd.exe	37
PID 676 wrote to memory of 2852	676	cmd.exe	37
PID 676 wrote to memory of 1080	676	cmd.exe	38
PID 676 wrote to memory of 1080	676	cmd.exe	38
PID 676 wrote to memory of 1080	676	cmd.exe	38
PID 676 wrote to memory of 1080	676	cmd.exe	38
PID 2036 wrote to memory of 2944	2036	RDM_ROOTCERTIFICATE.tmp	39
PID 2036 wrote to memory of 2944	2036	RDM_ROOTCERTIFICATE.tmp	39
PID 2036 wrote to memory of 2944	2036	RDM_ROOTCERTIFICATE.tmp	39
PID 2036 wrote to memory of 2944	2036	RDM_ROOTCERTIFICATE.tmp	39
PID 2036 wrote to memory of 3064	2036	RDM_ROOTCERTIFICATE.tmp	41
PID 2036 wrote to memory of 3064	2036	RDM_ROOTCERTIFICATE.tmp	41
PID 2036 wrote to memory of 3064	2036	RDM_ROOTCERTIFICATE.tmp	41
PID 2036 wrote to memory of 3064	2036	RDM_ROOTCERTIFICATE.tmp	41
PID 3064 wrote to memory of 2964	3064	cmd.exe	43
PID 3064 wrote to memory of 2964	3064	cmd.exe	43
PID 3064 wrote to memory of 2964	3064	cmd.exe	43
PID 3064 wrote to memory of 2964	3064	cmd.exe	43
PID 3064 wrote to memory of 2848	3064	cmd.exe	44
PID 3064 wrote to memory of 2848	3064	cmd.exe	44
PID 3064 wrote to memory of 2848	3064	cmd.exe	44
PID 3064 wrote to memory of 2848	3064	cmd.exe	44
PID 2036 wrote to memory of 2448	2036	RDM_ROOTCERTIFICATE.tmp	45
PID 2036 wrote to memory of 2448	2036	RDM_ROOTCERTIFICATE.tmp	45
PID 2036 wrote to memory of 2448	2036	RDM_ROOTCERTIFICATE.tmp	45
PID 2036 wrote to memory of 2448	2036	RDM_ROOTCERTIFICATE.tmp	45
PID 2156 wrote to memory of 1092	2156	RDM_Root_Cert_Update_Windows.tmp	47
PID 2156 wrote to memory of 1092	2156	RDM_Root_Cert_Update_Windows.tmp	47
PID 2156 wrote to memory of 1092	2156	RDM_Root_Cert_Update_Windows.tmp	47
PID 2156 wrote to memory of 1092	2156	RDM_Root_Cert_Update_Windows.tmp	47
PID 1092 wrote to memory of 1588	1092	net.exe	49
PID 1092 wrote to memory of 1588	1092	net.exe	49
PID 1092 wrote to memory of 1588	1092	net.exe	49

C:\Users\Admin\AppData\Local\Temp\RDM_Root_Cert_Update_Windows.exe
"C:\Users\Admin\AppData\Local\Temp\RDM_Root_Cert_Update_Windows.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Users\Admin\AppData\Local\Temp\is-0QP9J.tmp\RDM_Root_Cert_Update_Windows.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-0QP9J.tmp\RDM_Root_Cert_Update_Windows.tmp" /SL5="$4010C,2990719,887296,C:\Users\Admin\AppData\Local\Temp\RDM_Root_Cert_Update_Windows.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2156
- - C:\Users\Admin\AppData\Local\Temp\is-CCVB3.tmp\RDM_ROOTCERTIFICATE.exe
    "C:\Users\Admin\AppData\Local\Temp\is-CCVB3.tmp\RDM_ROOTCERTIFICATE.exe" /VERYSILENT
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1364
  - - C:\Users\Admin\AppData\Local\Temp\is-14SL4.tmp\RDM_ROOTCERTIFICATE.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-14SL4.tmp\RDM_ROOTCERTIFICATE.tmp" /SL5="$501DC,1902883,887296,C:\Users\Admin\AppData\Local\Temp\is-CCVB3.tmp\RDM_ROOTCERTIFICATE.exe" /VERYSILENT
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2036
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-U5SI7.tmp/RdmCert/certremoval.bat""
        5⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:676
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo 1 "
        6⤵
        
        PID:1292
      - C:\Users\Admin\AppData\Local\Temp\is-U5SI7.tmp\RdmCert\certmgr.exe
        
        CertMgr.exe -del -c -n "RDM Device Root" -s -r localMachine Root
        6⤵
        Manipulates Digital Signatures
        Executes dropped EXE
        
        PID:2852
      - C:\Users\Admin\AppData\Local\Temp\is-U5SI7.tmp\RdmCert\certmgr.exe
        
        CertMgr.exe -del -c -n "RDM Device Root" -s -r localMachine Root
        6⤵
        Manipulates Digital Signatures
        Executes dropped EXE
        
        PID:1080
    - - C:\Users\Admin\AppData\Local\Temp\is-U5SI7.tmp\RdmCert\CertMgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-U5SI7.tmp/RdmCert/CertMgr.exe" -add -c RDM_RootCA.pem -s -r localmachine Root
        5⤵
        Manipulates Digital Signatures
        Executes dropped EXE
        Modifies system certificate store
        
        PID:2944
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-U5SI7.tmp/RdmCert/AddCert.bat" "C:\Users\Admin\AppData\Local\Temp\is-U5SI7.tmp\RdmCert\RDM_RootCA.pem""
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3064
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c dir /B "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\*.default*"
        6⤵
        
        PID:2964
      - C:\Windows\SysWOW64\certutil.exe
        
        certutil.exe -A -n "RDM_Device" -t "TCu,TCu,TCu" -d "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\." -i "C:\Users\Admin\AppData\Local\Temp\is-U5SI7.tmp\RdmCert\RDM_RootCA.pem"
        6⤵
        
        PID:2848
    - - C:\Windows\SysWOW64\certutil.exe
        
        "C:\Windows\system32/certutil.exe" –f –p rdm736 –importpfx "C:\Users\Admin\AppData\Local\Temp\is-U5SI7.tmp\RdmCert\rdm.pfx"
        5⤵
        
        PID:2448
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\system32\net.exe" stop "RDMAppweb"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1092
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "RDMAppweb"
      4⤵
      PID:1588
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\system32\net.exe" stop "Embedthis Rdmappweb"
    3⤵
    PID:1556
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Embedthis Rdmappweb"
      4⤵
      PID:1340
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\system32\net.exe" start "RDMAppweb"
    3⤵
    PID:2976
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start "RDMAppweb"
      4⤵
      PID:1560
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\system32\net.exe" start "Embedthis Rdmappweb"
    3⤵
    PID:572
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start "Embedthis Rdmappweb"
      4⤵
      PID:2496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Mozilla Firefox\defaults\pref\firefox-windows-truststore.js

Filesize
103B

MD5
9556062a739f56d168c1581a11192a17

SHA1
81ee37e3990a004b9f50cbe99d512a5a5247aa90

SHA256
d151a50870503a2d394e3ffd65e2c0daed043ae1e54c974e80af811c7a60c78e

SHA512
57ab815c4f4f4f7c96d05a714f6cfebd3df47ec5c5e8363e07c3180e05bbecb03a472690ede29bb8690b2e2c0570b5512338b13710e031de8622d68667031d92

Download Submit
C:\Program Files\Mozilla Firefox\defaults\pref\local-settings.js

Filesize
90B

MD5
30573acfc9586271a3f800a10c284479

SHA1
9cc1a1329258379698a04c33dc5d62e9ce8e06fd

SHA256
30b9cf8f9760bcd38617a3878d43fc19e981c6dd13d6400c2a19d2ecab746cb5

SHA512
4a6df4e50d8c04ad9e65a9d183d4c8b723fcb50e1e786018010a33cee2b4f73296045864fffb526d887579bec8ec5c4ca5353127fb07e632b18c5b4684719015

Download Submit
C:\Program Files\Mozilla Firefox\umbrella.cfg

Filesize
56B

MD5
e40a3d559e4b85251943e071cd036d90

SHA1
10fc58df075108c912589f7954244a807776a0fb

SHA256
e179ca82c741d7d4842e42bc339c0e2c9befa1a5effe33d69d6821b3121fecca

SHA512
07cc337d7eb364fc78b0b36acbe9f89b85d932b3d616b8edfb5f12214ecd17853ecac4725cae929cce8a803d868fc3f5a5ad4d394554bb4783b0ccafea981959

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-U5SI7.tmp\RdmCert\AddCert.bat

Filesize
236B

MD5
0a7f6c64eef31ddb78a7ea184a1e526c

SHA1
222bb7f9444ae8124eae1f243dcea4436a32d3ad

SHA256
fdcdd7e21e9ccedacb8bfc166fd945f2cb08979682bd15e70a88bbaac48714ea

SHA512
a9c38de565354eaf5adbb714a409056daf73e7b2f1ccfe4d26d91c687351ce29a8dea34da73fc829f0852a5a5e0839a7e4d4aa68802607aa55974f538a5ea5e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-U5SI7.tmp\RdmCert\RDM_RootCA.pem

Filesize
1KB

MD5
5236fc957397fb2700dc025c29543cb5

SHA1
18b222ed28c757645d6986e92e2317839a7a6c6d

SHA256
60db73e7d89e86f33e26e735cd9d37bfc6a097790200e9a32a4afe7b80cf3f4a

SHA512
f3a6da5ba7130984edcaf323a42bf3d5b99a6bfed01f4893f215918210f4573b287e2e3f26fa384d013bc2ee7c993592541b99614a0f733dc3fcef3d1f5c10e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-U5SI7.tmp\RdmCert\certmgr.exe

Filesize
58KB

MD5
5d077a0cdd077c014eedb768feb249ba

SHA1
ea2c62d69a1f6b9d643fe16319ec7632c9533b3f

SHA256
8a830c48c4d78159dd80f4dad81c0bebbf9314710026b1a2ef0ffdddcb24b83d

SHA512
71bf48dcb6916a810f63710968894b431357aa694aa169067f567cc82b8e4ee732f581afb85b256e5c5a9d15a8b7b5746fa6a8b4127b273feb5b0e03e91b607a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-U5SI7.tmp\RdmCert\certremoval.bat

Filesize
143B

MD5
e8c0e44371c4edcc8908173bb91ca75c

SHA1
5479f75580e366cbb2bb03b15c1518cebdfc5cb0

SHA256
30aa7a6e165232dca4b1b3adf8c74bea54a29686f8802c6de92075ef53b5c1aa

SHA512
3ad2442ea854b2c7b1620a6e679ed36110a0f30023cf12552de28c70e3e883f859c114d5a14cec4280564ad280204fa549f7f5680cefafff8a2857e16ac36b7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-U5SI7.tmp\RdmCert\rdm.pfx

Filesize
2KB

MD5
cb24f524ab36239cda47ebeb8cbd6edb

SHA1
4cdc6226288f2d5868c48457f124569ecb91608f

SHA256
7ee7f861af655e38b08fc3112e0b19c518673251478b2dd44c2580659fe402f0

SHA512
c1ba2485c5900bbe5b0a7aeea8856ee77de8d1544f2f71effca80f3e8dd49b01c309ad3163740263f027ab66ecbdb679b8609ac601d33f98670e406c4c6604b0

Download Submit
\Users\Admin\AppData\Local\Temp\is-0QP9J.tmp\RDM_Root_Cert_Update_Windows.tmp

Filesize
3.1MB

MD5
a5388235bbd3513d95a2a5c172a55680

SHA1
e9beb5ae74748344085efc937d8b5acfcf194e7b

SHA256
109dfa3633727aee046973a9d59dfd493c4f4edfa50bcbcc37999c4bf020550f

SHA512
68e6111ffeb231668914c66d2a09bc21f5fc616767284af699919ae98b09082c0f89d567cf6cb33b087c5f0c59b4ce813836cd12eec62e54aa10a584ec4fd970

Download Submit
\Users\Admin\AppData\Local\Temp\is-14SL4.tmp\RDM_ROOTCERTIFICATE.tmp

Filesize
3.1MB

MD5
05cb53c8116fa798ab00b737f7b94015

SHA1
bc5f54566ca4a156030372cefead56540fb3d9ff

SHA256
41355b9de8550c19de59ba6555bac91bcca1529f0eabff8c239a7b151f4012eb

SHA512
66e96aca190fd2069c6e24b37ede8f38d1b0e3d11696e93ad09e0ebdf3e8809d49d0c9b0e5c68f479e88f6440302e07a1d5327be489d1095dad0746657acdeae

Download Submit
\Users\Admin\AppData\Local\Temp\is-CCVB3.tmp\RDM_ROOTCERTIFICATE.exe

Filesize
2.6MB

MD5
5daec5d62a1b06418e5eae25b7857748

SHA1
8a56f34f6a62b6ee1489ab2dfff643bc5dc22276

SHA256
9f395107a54b5393d98b7aa5d4a039d32be780e691cacf75ef7d4ce58d074d83

SHA512
10b3af9c90b875294ef606eb471e1e30a7a8db56fab2874f6ef32d33d088c97e4802a4980b196aa419bd0dddc568f13c5453e822a190e5165c96c4e7e2cf0cb1

Download Submit
memory/1364-136-0x0000000000400000-0x00000000004E6000-memory.dmp

Filesize
920KB

Download
memory/1364-34-0x0000000000400000-0x00000000004E6000-memory.dmp

Filesize
920KB

Download
memory/2036-134-0x0000000000400000-0x0000000000720000-memory.dmp

Filesize
3.1MB

Download
memory/2156-11-0x0000000000400000-0x0000000000720000-memory.dmp

Filesize
3.1MB

Download
memory/2156-9-0x0000000000400000-0x0000000000720000-memory.dmp

Filesize
3.1MB

Download
memory/2156-138-0x0000000000400000-0x0000000000720000-memory.dmp

Filesize
3.1MB

Download
memory/2536-0-0x0000000000400000-0x00000000004E6000-memory.dmp

Filesize
920KB

Download
memory/2536-10-0x0000000000400000-0x00000000004E6000-memory.dmp

Filesize
920KB

Download
memory/2536-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/2536-140-0x0000000000400000-0x00000000004E6000-memory.dmp

Filesize
920KB

Download