697e5f445b5ca6aa8fee03b7f1e2666767b154fcadf78e3f7ede24340dcc7513

Analysis

user interaction
yes
max time kernel
149s
max time network
96s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/06/2026, 17:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
adamxpatcherset/adamxpatcher.exe
Size 1.2MB
Sample260629-v7m8macv9p
SHA256 697e5f445b5ca6aa8fee03b7f1e2666767b154fcadf78e3f7ede24340dcc7513
MD5 f1733eccb410c965cc40ba363b763325
SHA1 c36764b17f7f90adc97d2ed06b4d0469a2c04949
SHA512 e9c3d8f5c7522db1851d3c9cfddac7d67c39a769795b7740c2ff9a5e3efdef6d9b074e0f0546a1a3aa3e8c9e53a94ce81c7d00dd880392ae6d326415dc29238d
SSDEEP 12288:oQkVyHWbdPPKMHBek10vAmVyIk2JHi6d1JHi6d:b20k1MVy1ISI
TLSH
T104455B15F59884D5C09BC4B68A72C85AE6727F984B3C8AE337F5BF6E1E325D06239D00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion spyware trojan

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	adamxpatcher.exe

Modifies trusted root certificate store through registry 1 TTPs 1 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BF38C7A50870C66E26E86E9DA3994465189B9370\Blob = 030000000100000014000000bf38c7a50870c66e26e86e9da3994465189b937020000000010000002c0300003082032830820210a003020102021100b85dd926a31e8bb3c4ff89af092f0614300d06092a864886f70d01010b0500303d310b300906035504061302555331163014060355040a0c0d4164616d7850726f78792043413116301406035504030c0d4164616d7850726f7879204341301e170d3236303632393137333832325a170d3336303632363137333832325a303d310b300906035504061302555331163014060355040a0c0d4164616d7850726f78792043413116301406035504030c0d4164616d7850726f787920434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ca547816a1a77af1fbe6ad374276fc20e44402540b13362e76fb1d0de0a2f0aab5eaeb14ccef35428030228ba7a09b8e07088f2beb4c03adaf5cc56f3f114ba44921600820d7f32cc6605e472a9b86385b518f69bcc199d3cb4f9392f26260afe42cbf22332592884c90910a5acb5f83423d659b3dd75836f476c278f91888c2c6dd1bcac7a929abcedbe90e0270257099bdf8a83c29822815045142a2aedb4231a3209a0c739f3b604bce70ee0002584e935c59e973acc9491164ea7d4dc155c4f1b6f6fb13d78a4418ec42362912be09d6e82a5a85cd9f7f35e5bab4e50736b5c25646bdae32e7f6c248c3398b9eca5c9f090b95a9a3b464c333bbe21066ed0203010001a3233021300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186300d06092a864886f70d01010b05000382010100c732504c55242f5d24e13b613af13008276acdbf31193e9077213ad4f0f0e51e9f5a42a3899c2ec41b60a5029f4d8e81f5d2775ff777c05ab280562be210e1359886d59b704bde99ea0a597abb1b35db0fe417f4d0f7e74c3244b5b99d0f4e27464743ed425e859fcb7c4ade3cbefc2fafcab5a5bccef9df6e1d8bbd9fcf143c2bffc1cb5f1dcd69b63ac918e9298535ec463495a99e5b4a236201e4e0f161fbf193b2e66847bb45c00ef44b35a3eb9bdfbd56dbc51e8bbb96019983d6ddc2e61e2730763424c86450bff3fdf8235eff3fad21743ce87064d70887399d8ca1cc38851c2cb838c0475f311f6113dbc1bf5800465985866b011fd9f951f59d9705	adamxpatcher.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BF38C7A50870C66E26E86E9DA3994465189B9370	adamxpatcher.exe

C:\Users\Admin\AppData\Local\Temp\adamxpatcherset\adamxpatcher.exe
"C:\Users\Admin\AppData\Local\Temp\adamxpatcherset\adamxpatcher.exe"
1⤵
- Drops file in Drivers directory
- Modifies trusted root certificate store through registry
- Modifies system certificate store
PID:560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads