ac132e2f02f64d2623e776486b6844f93edce4a08dbd0879d8748fd4671e637e

General

Target
support.client.exe
Size 65KB
Sample260423-prxt8sb16q
SHA256 ac132e2f02f64d2623e776486b6844f93edce4a08dbd0879d8748fd4671e637e
MD5 9c04b18e66a2010615e453afce18c9a4
SHA1 ab6150c3dcea529d28ba30665e1d8f36e1403c4d
SHA512 153b0c4aa4d6728227151ab43316b656b726571c3eb6110dec21fbd9ac6f4f0fcbb566e277753320436a9141fc37726efa50a021845d12b03bdf73b905dad88c
SSDEEP 768:Hu91QojVMNCvvzdnBGzJ/YNSNK0cNWIioLsWjcdRPBu7mLIjum9hTQ:Hu9fCN+dnB4cN+asWjcdbrm9hE
TLSH
T1FE634A0376E0C072E8724E3519F485518BBFBD529EB49D6B3798029D4EB26C18E38F67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Manipulates Digital Signatures 1 TTPs 2 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\8EC7BF710E266AEA1B3D58AB0317C6E78EEBE6EB	support.client.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\8EC7BF710E266AEA1B3D58AB0317C6E78EEBE6EB\Blob = 0300000001000000140000008ec7bf710e266aea1b3d58ab0317c6e78eebe6eb2000000001000000430500003082053f30820427a00302010202104272500981010a48eb7637c2d06ae83d300d06092a864886f70d0101050500307b310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d697465643121301f06035504031318434f4d4f444f20436f6465205369676e696e672043412032301e170d3134303330333030303030305a170d3137303330323233353935395a3081ae310b3009060355040613025553310e300c06035504110c053237363039310b300906035504080c024e433110300e06035504070c0752616c656967683124302206035504090c1b343730302053697820466f726b732052642053756974652033323031243022060355040a0c1b456c73696e6f726520546563686e6f6c6f676965732c20496e632e3124302206035504030c1b456c73696e6f726520546563686e6f6c6f676965732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100edcca0c154eba5e1305171d380dd4b311a1924d52b9271e7e85b7d68dee26d1f8fa7e482d366796fef4fc2c44e71cbd14bda730e9c8b9db506f925dc7e79ef2a98c7914233ab7248042482405a222d2ecda634d2395e72df0148f325951d2a652e2c21ab0d02190e1a091ed27553dde9d4b99a19ddef920b94f99886c07dd3f12939e57ac729d759f95e60f6d3620ba6a97394bf18ad716e9208c13cad5ef0869512391606232bd8f744315decf288e468385003669ac0f3b08a2df140d56f3299410d40ee692b79d50b1dba9d6f822e7f46f449aa11b9e67d2d398b1ba322c7f9be1197250a34f360e93bfe4a96160c08dc8a90f613fd66212cccd31042c82f0203010001a382018930820185301f0603551d230418301680141ec5b12c7d87da02687c25bc0c07843fb6cfdef1301d0603551d0e04160414d76850c18d0cd5c52640e5852a3fcab9fa1d130b300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010302302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e6e65742f43505330410603551d1f043a30383036a034a0328630687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e63726c307206082b0601050507010104663064303c06082b060105050730028630687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010505000382010100b0b6422b8d21af2c544ccf470ee5cdfee61b388aa1bf732b9d0762917c102711b2e9092c9584218dacb5fdda50f96a6c2e55ac782b76d767e073240f16d1247d139a3f09b4e629bce5e4bb976468b11d668c0044ac77ccd0431c7717ef000550b6e547fedb0feb185eecf90003acf42b5d7b28f0facb1fa96bc6e6942e9e6a8f40779a112270561b1f96d27fc63143ffa35a94ec0a59e49b536cea15cca662ada1d1981a70a05c82f2ee291c1e46f1d27020ef6aa8a9a390228933cebbac3738f850d58dba9e943d0b96ace14e30dad44b8c09dfd67625e90f9fbcf1f425ddc39821489d8e2a63e8a55de7f9118ecdbb9c892f8f3621a0e55ec60cd1401f7901	support.client.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	support.client.exe

Modifies registry class 21 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "3VZ0LJLP1D89QJJH9Z416JKT"	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "2HG1H6N2OC5LH0YB0PNDMJEE"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\StateStore_RandomString = "ZRCYOV6J0MV8A29O1D0EZO3Q"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Categories	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software	dfsvc.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	dfsvc.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\8EC7BF710E266AEA1B3D58AB0317C6E78EEBE6EB	support.client.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\8EC7BF710E266AEA1B3D58AB0317C6E78EEBE6EB\Blob = 0300000001000000140000008ec7bf710e266aea1b3d58ab0317c6e78eebe6eb2000000001000000430500003082053f30820427a00302010202104272500981010a48eb7637c2d06ae83d300d06092a864886f70d0101050500307b310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d697465643121301f06035504031318434f4d4f444f20436f6465205369676e696e672043412032301e170d3134303330333030303030305a170d3137303330323233353935395a3081ae310b3009060355040613025553310e300c06035504110c053237363039310b300906035504080c024e433110300e06035504070c0752616c656967683124302206035504090c1b343730302053697820466f726b732052642053756974652033323031243022060355040a0c1b456c73696e6f726520546563686e6f6c6f676965732c20496e632e3124302206035504030c1b456c73696e6f726520546563686e6f6c6f676965732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100edcca0c154eba5e1305171d380dd4b311a1924d52b9271e7e85b7d68dee26d1f8fa7e482d366796fef4fc2c44e71cbd14bda730e9c8b9db506f925dc7e79ef2a98c7914233ab7248042482405a222d2ecda634d2395e72df0148f325951d2a652e2c21ab0d02190e1a091ed27553dde9d4b99a19ddef920b94f99886c07dd3f12939e57ac729d759f95e60f6d3620ba6a97394bf18ad716e9208c13cad5ef0869512391606232bd8f744315decf288e468385003669ac0f3b08a2df140d56f3299410d40ee692b79d50b1dba9d6f822e7f46f449aa11b9e67d2d398b1ba322c7f9be1197250a34f360e93bfe4a96160c08dc8a90f613fd66212cccd31042c82f0203010001a382018930820185301f0603551d230418301680141ec5b12c7d87da02687c25bc0c07843fb6cfdef1301d0603551d0e04160414d76850c18d0cd5c52640e5852a3fcab9fa1d130b300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010302302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e6e65742f43505330410603551d1f043a30383036a034a0328630687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e63726c307206082b0601050507010104663064303c06082b060105050730028630687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010505000382010100b0b6422b8d21af2c544ccf470ee5cdfee61b388aa1bf732b9d0762917c102711b2e9092c9584218dacb5fdda50f96a6c2e55ac782b76d767e073240f16d1247d139a3f09b4e629bce5e4bb976468b11d668c0044ac77ccd0431c7717ef000550b6e547fedb0feb185eecf90003acf42b5d7b28f0facb1fa96bc6e6942e9e6a8f40779a112270561b1f96d27fc63143ffa35a94ec0a59e49b536cea15cca662ada1d1981a70a05c82f2ee291c1e46f1d27020ef6aa8a9a390228933cebbac3738f850d58dba9e943d0b96ace14e30dad44b8c09dfd67625e90f9fbcf1f425ddc39821489d8e2a63e8a55de7f9118ecdbb9c892f8f3621a0e55ec60cd1401f7901	support.client.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\8EC7BF710E266AEA1B3D58AB0317C6E78EEBE6EB	support.client.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2352	dfsvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2352	3048	support.client.exe	79

C:\Users\Admin\AppData\Local\Temp\support.client.exe
"C:\Users\Admin\AppData\Local\Temp\support.client.exe"
1⤵
- Manipulates Digital Signatures
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:2352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

2

T1553

Install Root Certificate

1

T1553.004

SIP and Trust Provider Hijacking

1

T1553.003

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2352-0-0x000002160F210000-0x000002160F218000-memory.dmp

Download

memory/2352-1-0x0000021629920000-0x0000021629AA8000-memory.dmp

Download

memory/2352-2-0x00000216298C0000-0x00000216298D0000-memory.dmp

Download

memory/2352-3-0x00000216298C0000-0x00000216298D0000-memory.dmp

Download

memory/2352-4-0x00000216298C0000-0x00000216298D0000-memory.dmp

Download

memory/2352-6-0x000002160F620000-0x000002160F62C000-memory.dmp

Download

memory/2352-8-0x00000216298C0000-0x00000216298D0000-memory.dmp

Download

memory/2352-7-0x0000021629790000-0x000002162983F000-memory.dmp

Download

memory/3048-5-0x0000000002250000-0x0000000002275000-memory.dmp

Download

memory/3048-18-0x0000000002250000-0x0000000002275000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads