Overview

overview

7

Static

static

3

TDCCsecure...28.exe

windows10-2004-x64

7

TDCCsecure...28.exe

windows11-ltsc_2024-x64

7

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...fo.dll

windows10-2004-x64

3

$PLUGINSDI...fo.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows11-ltsc_2024-x64

3

$TEMP/vc20...86.exe

windows10-2004-x64

4

$TEMP/vc20...86.exe

windows11-ltsc_2024-x64

4

$_10_/certutil.exe

windows10-2004-x64

3

$_10_/certutil.exe

windows11-ltsc_2024-x64

3

$_10_/freebl3.dll

windows10-2004-x64

3

$_10_/freebl3.dll

windows11-ltsc_2024-x64

3

$_10_/libnspr4.dll

windows10-2004-x64

3

$_10_/libnspr4.dll

windows11-ltsc_2024-x64

3

$_10_/libplc4.dll

windows10-2004-x64

3

$_10_/libplc4.dll

windows11-ltsc_2024-x64

3

$_10_/libplds4.dll

windows10-2004-x64

3

$_10_/libplds4.dll

windows11-ltsc_2024-x64

3

$_10_/msvcr100.dll

windows10-2004-x64

3

$_10_/msvcr100.dll

windows11-ltsc_2024-x64

3

$_10_/nss3.dll

windows10-2004-x64

3

$_10_/nss3.dll

windows11-ltsc_2024-x64

3

$_10_/nssckbi.dll

windows10-2004-x64

3

$_10_/nssckbi.dll

windows11-ltsc_2024-x64

3

$_10_/nssdbm3.dll

windows10-2004-x64

3

$_10_/nssdbm3.dll

windows11-ltsc_2024-x64

3

Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/07/2026, 04:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    TDCCsecure.20220428.exe
  • Size 17.6MB
  • Sample260722-eqdpvsad82
  • SHA256 a6325c25bfe6df068eede517e14c284ac1497fa52ac22e172e8ae7f463f31fcd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoverypersistencespywarestealertrojan

Malware Config

Signatures

  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 54 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 1 IoCs
    defense_evasionspywaretrojan
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TDCCsecure.20220428.exe
    "C:\Users\Admin\AppData\Local\Temp\TDCCsecure.20220428.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Modifies trusted root certificate store through registry
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Modifies system certificate store
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3192
    • C:\Users\Admin\AppData\Local\Temp\vc2015_redist.x86.exe
      "C:\Users\Admin\AppData\Local\Temp\vc2015_redist.x86.exe" /q /norestart
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1500
      • C:\Users\Admin\AppData\Local\Temp\vc2015_redist.x86.exe
        "C:\Users\Admin\AppData\Local\Temp\vc2015_redist.x86.exe" /q /norestart -burn.unelevated BurnPipe.{D3B30EB3-573D-4A27-9692-ECEBC0B6743E} {E14DF8F6-720E-42F8-BACE-382CA3FE78FE} 1500
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2176
  • C:\ProgramData\TDCCAtlAgent\TDCCATLAgent45.exe
    "C:\ProgramData\TDCCAtlAgent\TDCCATLAgent45.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4952
    • C:\ProgramData\Mozilla\nss\certutil.exe
      "C:\ProgramData\Mozilla\nss\certutil.exe" -A -n "TWCA_SSLCA" -i "C:\ProgramData\Mozilla\nss\TWCA.crt" -t "CT,c,c" -d "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9xv10wby.Admin"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1032
    • C:\ProgramData\Mozilla\nss\certutil.exe
      "C:\ProgramData\Mozilla\nss\certutil.exe" -A -n "TWCA_SSLCA" -i "C:\ProgramData\Mozilla\nss\TWCA.crt" -t "CT,c,c" -d "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:3936
  • C:\PROGRA~3\TDCCAT~1\TDCCAtlAgent45.exe
    C:\PROGRA~3\TDCCAT~1\TDCCAT~1.EXE
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4216
    • C:\ProgramData\Mozilla\nss\certutil.exe
      "C:\ProgramData\Mozilla\nss\certutil.exe" -A -n "TWCA_SSLCA" -i "C:\ProgramData\Mozilla\nss\TWCA.crt" -t "CT,c,c" -d "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9xv10wby.Admin"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:5980
    • C:\ProgramData\Mozilla\nss\certutil.exe
      "C:\ProgramData\Mozilla\nss\certutil.exe" -A -n "TWCA_SSLCA" -i "C:\ProgramData\Mozilla\nss\TWCA.crt" -t "CT,c,c" -d "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:4792

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        MSVCR100.dll
        • Path C:\ProgramData\Mozilla\nss\MSVCR100.dll
        • Size 755KB
        • SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TWCA.crt
        • Path C:\ProgramData\Mozilla\nss\TWCA.crt
        • Size 1KB
        • SHA256 23a603e1b580ba2641c44b35aa8e88ebbfb2a538e42da5e7ca47634eb902954e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        certutil.exe
        • Path C:\ProgramData\Mozilla\nss\certutil.exe
        • Size 107KB
        • SHA256 b3f3e28a4e9b5f751268170fae99c12bff471fe683178bbe6b0c4f05374b0660
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        freebl3.dll
        • Path C:\ProgramData\Mozilla\nss\freebl3.dll
        • Size 223KB
        • SHA256 7aa61e4265e2180d39ae305c0fdb3626346533db94bec4fb9c192b28037d3d50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libnspr4.dll
        • Path C:\ProgramData\Mozilla\nss\libnspr4.dll
        • Size 201KB
        • SHA256 15a25c02df447ba7892569224d4a7d0b93ac1316be9057f3f2e80ba758eb3b27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libplc4.dll
        • Path C:\ProgramData\Mozilla\nss\libplc4.dll
        • Size 20KB
        • SHA256 f90a58f5055e9f394919b4fdd0c6fcd027f25f13c327265e4a6820d05c595266
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libplds4.dll
        • Path C:\ProgramData\Mozilla\nss\libplds4.dll
        • Size 18KB
        • SHA256 30e857771b02fd241a332ea4d0bff34c423a25e1c3a84af13d687b04e1886d9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nss3.dll
        • Path C:\ProgramData\Mozilla\nss\nss3.dll
        • Size 786KB
        • SHA256 275f078f495152a87d4e255b6fffa8278cb4669a8f1047c84a7767db9d5b50ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nssutil3.dll
        • Path C:\ProgramData\Mozilla\nss\nssutil3.dll
        • Size 97KB
        • SHA256 28da22d47353172e55291a5cb884a6a87c955270abc2d7c8a0f1aa9050ca5957
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        smime3.dll
        • Path C:\ProgramData\Mozilla\nss\smime3.dll
        • Size 101KB
        • SHA256 09765b47b3f1e545d29ca915540db97929ecbdaf66e8194c4af53f9e73941f2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        softokn3.dll
        • Path C:\ProgramData\Mozilla\nss\softokn3.dll
        • Size 174KB
        • SHA256 1941052fbc5cc96779a2af5dfb2fe9eddbad5c10e2be97a7081245a62344adc7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sqlite3.dll
        • Path C:\ProgramData\Mozilla\nss\sqlite3.dll
        • Size 420KB
        • SHA256 9f57dd9fe947856a389a81fe2584c26fb9dd3c4e0a0d91d0d9573e2941a0090b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ICCDFCDLL.dll
        • Path C:\ProgramData\TDCCAtlAgent\ICCDFCDLL.dll
        • Size 42KB
        • SHA256 e1317aa88df542914194d4899fc9d473a6fff90fa8a16029bff9d8647b9a12e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TDCCAtlAgent45.exe
        • Path C:\ProgramData\TDCCAtlAgent\TDCCAtlAgent45.exe
        • Size 2.1MB
        • SHA256 0c19cab68fbe8b10ebac09ffe4f549c794522dc1177a98f77ffa316073f9bedf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TDCCCapiATL.dll
        • Path C:\ProgramData\TDCCAtlAgent\TDCCCapiATL.dll
        • Size 359KB
        • SHA256 7787a284f0ab3b5d8cf28b01031d1c092a5b6c771b4adce4a220943e91afccae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TDCCPkcs11ATL.dll
        • Path C:\ProgramData\TDCCAtlAgent\TDCCPkcs11ATL.dll
        • Size 750KB
        • SHA256 35d2f43b6e4ed8cc2b1399901a85ab74f383c264e36f1d0bb8cba0c7a24063b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TDCCATLAgent45.log.20260722-001
        • Path C:\Users\Admin\ATLAgent\TDCCATLAgent45.log.20260722-001
        • Size 700B
        • SHA256 4fbce1c1a9b80fe9fdda4530465e1330ae67ac480600f4adb43abbabea5167bd
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        etilqs_lDhi1snE55moRpmKhmkq
        • Path C:\Users\Admin\AppData\Local\Temp\etilqs_lDhi1snE55moRpmKhmkq
        • Size 512B
        • SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560
        • MD5 SHA1 SHA512
        Submit Download

        InstallOptions.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsj3F15.tmp\InstallOptions.dll
        • Size 22KB
        • SHA256 096a5eea11e75217c87570930bc0617dffcb93bc99b74c764a88adb2ac0ac1db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StdUtils.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsj3F15.tmp\StdUtils.dll
        • Size 107KB
        • SHA256 8ae2b995ade6b752903adbc798ec4f2414d4ae0db59cf694e91fa74ae3a412ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsj3F15.tmp\System.dll
        • Size 18KB
        • SHA256 e2cf2b8202cb1593f1fd0b848ccb763e836f7f2209cd9b0b0540d630fd11274c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UserInfo.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsj3F15.tmp\UserInfo.dll
        • Size 10KB
        • SHA256 2bf3e02abbf3558a83b3d529c0f97093d317c56254b6711fd5213d0f0cf7a60e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ioSpecial.ini
        • Path C:\Users\Admin\AppData\Local\Temp\nsj3F15.tmp\ioSpecial.ini
        • Size 1KB
        • SHA256 4b31f11944be9e14d8145aa32cc65d1c53409abc58ee2f877f6415ef33db2956
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ioSpecial.ini
        • Path C:\Users\Admin\AppData\Local\Temp\nsj3F15.tmp\ioSpecial.ini
        • Size 1KB
        • SHA256 75ad39c9cae21bf281f19fe3b66fc050f8834c304c41f2584d41bb45f21c9ad6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        vc2015_redist.x86.exe
        • Path C:\Users\Admin\AppData\Local\Temp\vc2015_redist.x86.exe
        • Size 13.1MB
        • SHA256 fdd1e1f0dcae2d0aa0720895eff33b927d13076e64464bb7c7e5843b7667cd14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        logo.png
        • Path C:\Users\Admin\AppData\Local\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba1\logo.png
        • Size 1KB
        • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        wixstdba.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba1\wixstdba.dll
        • Size 118KB
        • SHA256 a9295ad4e909f979e2b6cb2b2495c3d35c8517e689cd64a918c690e17b49078b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cert_override.txt
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9xv10wby.Admin\cert_override.txt
        • Size 970B
        • SHA256 9f9d85fdfc748b600e8ea953466023a93a12ea4b297ae8d3357ebcf67b13eedf
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        cert_override.txt
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\cert_override.txt
        • Size 1KB
        • SHA256 2286415f68cb2ec9fdc6071d33b12b1719aa875d7fb137a54bde57511060894d
        • MD5 SHA1 SHA512 TLSH
        Submit Download