83dc1316a2a9f515187cd82024fd616d85f4fd9b8880a2a0b2480216a97bab24

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/05/2026, 09:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
83dc1316a2a9f515187cd82024fd616d85f4fd9b8880a2a0b2480216a97bab24.exe
Size 1.2MB
Sample260519-lrbefshx91
SHA256 83dc1316a2a9f515187cd82024fd616d85f4fd9b8880a2a0b2480216a97bab24
MD5 4ec99b4bcf6e8475d157dacb3f213503
SHA1 a4ffe5659d4f43b20ccf6392f2a0f9b3df418e7a
SHA512 a31e42f5cca2fbda38275cb48baa6ef9abc1e3569dced08ca6c9641261a0094c954537b80d0b1b7e6448f1a82cafdd695507e5c4ececfcfcb021b0837fbfe496
SSDEEP 12288:d+H1DSds3T9fZBIYRNY3EfxnXxModXRSiXhkypdQwcmeyIvw9E8:ySds3T9xiodXROypdQwc1I9E
TLSH
T1CC55A54BE7B611D1F4BAC139A562322AFC7234A58738D7D792859A0E5B30FE4AD3D700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

defense_evasion spyware trojan

Malware Config

Signatures

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	83dc1316a2a9f515187cd82024fd616d85f4fd9b8880a2a0b2480216a97bab24.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 5c000000010000000400000080010000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	83dc1316a2a9f515187cd82024fd616d85f4fd9b8880a2a0b2480216a97bab24.exe

C:\Users\Admin\AppData\Local\Temp\83dc1316a2a9f515187cd82024fd616d85f4fd9b8880a2a0b2480216a97bab24.exe
"C:\Users\Admin\AppData\Local\Temp\83dc1316a2a9f515187cd82024fd616d85f4fd9b8880a2a0b2480216a97bab24.exe"
1⤵
- Modifies system certificate store
PID:1556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1556-0-0x00007FF7C7E00000-0x00007FF7C7FB8000-memory.dmp

Download

memory/1556-1-0x00007FF7C7E00000-0x00007FF7C7FB8000-memory.dmp

Download

memory/1556-16-0x00007FF7C7E00000-0x00007FF7C7FB8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads