Overview

overview

7

Static

static

3

TDCCsecure...28.exe

windows10-2004-x64

7

TDCCsecure...28.exe

windows11-ltsc_2024-x64

7

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...fo.dll

windows10-2004-x64

3

$PLUGINSDI...fo.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows11-ltsc_2024-x64

3

$TEMP/vc20...86.exe

windows10-2004-x64

4

$TEMP/vc20...86.exe

windows11-ltsc_2024-x64

4

$_10_/certutil.exe

windows10-2004-x64

3

$_10_/certutil.exe

windows11-ltsc_2024-x64

3

$_10_/freebl3.dll

windows10-2004-x64

3

$_10_/freebl3.dll

windows11-ltsc_2024-x64

3

$_10_/libnspr4.dll

windows10-2004-x64

3

$_10_/libnspr4.dll

windows11-ltsc_2024-x64

3

$_10_/libplc4.dll

windows10-2004-x64

3

$_10_/libplc4.dll

windows11-ltsc_2024-x64

3

$_10_/libplds4.dll

windows10-2004-x64

3

$_10_/libplds4.dll

windows11-ltsc_2024-x64

3

$_10_/msvcr100.dll

windows10-2004-x64

3

$_10_/msvcr100.dll

windows11-ltsc_2024-x64

3

$_10_/nss3.dll

windows10-2004-x64

3

$_10_/nss3.dll

windows11-ltsc_2024-x64

3

$_10_/nssckbi.dll

windows10-2004-x64

3

$_10_/nssckbi.dll

windows11-ltsc_2024-x64

3

$_10_/nssdbm3.dll

windows10-2004-x64

3

$_10_/nssdbm3.dll

windows11-ltsc_2024-x64

3

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    22/07/2026, 04:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    TDCCsecure.20220428.exe
  • Size 17.6MB
  • Sample260722-eqdpvsad82
  • SHA256 a6325c25bfe6df068eede517e14c284ac1497fa52ac22e172e8ae7f463f31fcd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoverypersistencespywarestealertrojan

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 37 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 1 IoCs
    defense_evasionspywaretrojan
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TDCCsecure.20220428.exe
    "C:\Users\Admin\AppData\Local\Temp\TDCCsecure.20220428.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Modifies trusted root certificate store through registry
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Modifies system certificate store
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4704
    • C:\Users\Admin\AppData\Local\Temp\vc2015_redist.x86.exe
      "C:\Users\Admin\AppData\Local\Temp\vc2015_redist.x86.exe" /q /norestart
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4284
      • C:\Users\Admin\AppData\Local\Temp\vc2015_redist.x86.exe
        "C:\Users\Admin\AppData\Local\Temp\vc2015_redist.x86.exe" /q /norestart -burn.unelevated BurnPipe.{4167D825-2D65-40AC-8996-5E90EFB2A8D8} {71533365-61DF-4F10-B499-DCCE22687346} 4284
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4540
  • C:\ProgramData\TDCCAtlAgent\TDCCATLAgent45.exe
    "C:\ProgramData\TDCCAtlAgent\TDCCATLAgent45.exe"
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:944
    • C:\ProgramData\Mozilla\nss\certutil.exe
      "C:\ProgramData\Mozilla\nss\certutil.exe" -A -n "TWCA_SSLCA" -i "C:\ProgramData\Mozilla\nss\TWCA.crt" -t "CT,c,c" -d "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fbrj04v0.Admin"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1288
    • C:\ProgramData\Mozilla\nss\certutil.exe
      "C:\ProgramData\Mozilla\nss\certutil.exe" -A -n "TWCA_SSLCA" -i "C:\ProgramData\Mozilla\nss\TWCA.crt" -t "CT,c,c" -d "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2500

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        TWCA.crt
        • Path C:\ProgramData\Mozilla\nss\TWCA.crt
        • Size 1KB
        • SHA256 23a603e1b580ba2641c44b35aa8e88ebbfb2a538e42da5e7ca47634eb902954e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        certutil.exe
        • Path C:\ProgramData\Mozilla\nss\certutil.exe
        • Size 107KB
        • SHA256 b3f3e28a4e9b5f751268170fae99c12bff471fe683178bbe6b0c4f05374b0660
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        freebl3.dll
        • Path C:\ProgramData\Mozilla\nss\freebl3.dll
        • Size 223KB
        • SHA256 7aa61e4265e2180d39ae305c0fdb3626346533db94bec4fb9c192b28037d3d50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libnspr4.dll
        • Path C:\ProgramData\Mozilla\nss\libnspr4.dll
        • Size 201KB
        • SHA256 15a25c02df447ba7892569224d4a7d0b93ac1316be9057f3f2e80ba758eb3b27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libplc4.dll
        • Path C:\ProgramData\Mozilla\nss\libplc4.dll
        • Size 20KB
        • SHA256 f90a58f5055e9f394919b4fdd0c6fcd027f25f13c327265e4a6820d05c595266
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libplds4.dll
        • Path C:\ProgramData\Mozilla\nss\libplds4.dll
        • Size 18KB
        • SHA256 30e857771b02fd241a332ea4d0bff34c423a25e1c3a84af13d687b04e1886d9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcr100.dll
        • Path C:\ProgramData\Mozilla\nss\msvcr100.dll
        • Size 755KB
        • SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nss3.dll
        • Path C:\ProgramData\Mozilla\nss\nss3.dll
        • Size 786KB
        • SHA256 275f078f495152a87d4e255b6fffa8278cb4669a8f1047c84a7767db9d5b50ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nssutil3.dll
        • Path C:\ProgramData\Mozilla\nss\nssutil3.dll
        • Size 97KB
        • SHA256 28da22d47353172e55291a5cb884a6a87c955270abc2d7c8a0f1aa9050ca5957
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        smime3.dll
        • Path C:\ProgramData\Mozilla\nss\smime3.dll
        • Size 101KB
        • SHA256 09765b47b3f1e545d29ca915540db97929ecbdaf66e8194c4af53f9e73941f2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        softokn3.dll
        • Path C:\ProgramData\Mozilla\nss\softokn3.dll
        • Size 174KB
        • SHA256 1941052fbc5cc96779a2af5dfb2fe9eddbad5c10e2be97a7081245a62344adc7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sqlite3.dll
        • Path C:\ProgramData\Mozilla\nss\sqlite3.dll
        • Size 420KB
        • SHA256 9f57dd9fe947856a389a81fe2584c26fb9dd3c4e0a0d91d0d9573e2941a0090b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ICCDFCDLL.dll
        • Path C:\ProgramData\TDCCAtlAgent\ICCDFCDLL.dll
        • Size 42KB
        • SHA256 e1317aa88df542914194d4899fc9d473a6fff90fa8a16029bff9d8647b9a12e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TDCCAtlAgent45.exe
        • Path C:\ProgramData\TDCCAtlAgent\TDCCAtlAgent45.exe
        • Size 2.1MB
        • SHA256 0c19cab68fbe8b10ebac09ffe4f549c794522dc1177a98f77ffa316073f9bedf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TDCCCapiATL.dll
        • Path C:\ProgramData\TDCCAtlAgent\TDCCCapiATL.dll
        • Size 359KB
        • SHA256 7787a284f0ab3b5d8cf28b01031d1c092a5b6c771b4adce4a220943e91afccae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TDCCPkcs11ATL.dll
        • Path C:\ProgramData\TDCCAtlAgent\TDCCPkcs11ATL.dll
        • Size 750KB
        • SHA256 35d2f43b6e4ed8cc2b1399901a85ab74f383c264e36f1d0bb8cba0c7a24063b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InstallOptions.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nswD592.tmp\InstallOptions.dll
        • Size 22KB
        • SHA256 096a5eea11e75217c87570930bc0617dffcb93bc99b74c764a88adb2ac0ac1db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StdUtils.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nswD592.tmp\StdUtils.dll
        • Size 107KB
        • SHA256 8ae2b995ade6b752903adbc798ec4f2414d4ae0db59cf694e91fa74ae3a412ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nswD592.tmp\System.dll
        • Size 18KB
        • SHA256 e2cf2b8202cb1593f1fd0b848ccb763e836f7f2209cd9b0b0540d630fd11274c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UserInfo.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nswD592.tmp\UserInfo.dll
        • Size 10KB
        • SHA256 2bf3e02abbf3558a83b3d529c0f97093d317c56254b6711fd5213d0f0cf7a60e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ioSpecial.ini
        • Path C:\Users\Admin\AppData\Local\Temp\nswD592.tmp\ioSpecial.ini
        • Size 1KB
        • SHA256 8ddbdeb769207cf3ecdc7c6c419ae7a9c559685d68419b1ae291fd1254193ae7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        vc2015_redist.x86.exe
        • Path C:\Users\Admin\AppData\Local\Temp\vc2015_redist.x86.exe
        • Size 13.1MB
        • SHA256 fdd1e1f0dcae2d0aa0720895eff33b927d13076e64464bb7c7e5843b7667cd14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        logo.png
        • Path C:\Users\Admin\AppData\Local\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba1\logo.png
        • Size 1KB
        • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        wixstdba.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba1\wixstdba.dll
        • Size 118KB
        • SHA256 a9295ad4e909f979e2b6cb2b2495c3d35c8517e689cd64a918c690e17b49078b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download