89fe3488138656f7ae310d00b5e311d51b6ab51de14f15f7f06038928513e6a8

General

Target
89fe3488138656f7ae310d00b5e311d51b6ab51de14f15f7f06038928513e6a8.exe
Size 1.7MB
Sample260803-bdmkfsvhmf
SHA256 89fe3488138656f7ae310d00b5e311d51b6ab51de14f15f7f06038928513e6a8
MD5 ec7eb8b015f761e4b84467d5758fac04
SHA1 21568e160655809bdfb09d621c6d58bcd7006811
SHA512 0dbc660bc83c2461e6f10fff6369e96f73998c624cfc28942a37261dbcc82209cecbfdb58a7425c06e64da79dfa047d3bf6fc50402e9de0454372d1ca502da5f
SSDEEP 24576:Nf/CBAE+Fuf4owQ1HYBSiPZTPEGUOk5naB4H2+jTcMaZe3vPr8l:NnE1PfHYBDXXiq4H2ATzaZe/z8l
TLSH
T19F856D137661C021D4E40172935FBB2B50B86F706BE298CBB7C47A5959F09C29E3DF2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Mozilla Firefox\raonk_ca.cfg	89fe3488138656f7ae310d00b5e311d51b6ab51de14f15f7f06038928513e6a8.exe
File created	C:\Program Files\Mozilla Firefox\defaults\pref\raonk_ca.js	89fe3488138656f7ae310d00b5e311d51b6ab51de14f15f7f06038928513e6a8.exe

Modifies trusted root certificate store through registry 1 TTPs 1 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\ECEE052F995765664EE76FBF29EE491E36E8B156\Blob = 030000000100000014000000ecee052f995765664ee76fbf29ee491e36e8b15620000000010000002b040000308204273082030fa00302010202090086595cb263071ee4300d06092a864886f70d01010b05003069310b3009060355040613024b5231153013060355040a0c0c52414f4e57495a20496e632e312a3028060355040b0c21526573656172636820616e6420446576656c6f706d656e74204469766973696f6e3117301506035504030c0e52414f4e204b20524f4f54204341301e170d3138303931393032303135335a170d3338313233313032303135335a3069310b3009060355040613024b5231153013060355040a0c0c52414f4e57495a20496e632e312a3028060355040b0c21526573656172636820616e6420446576656c6f706d656e74204469766973696f6e3117301506035504030c0e52414f4e204b20524f4f5420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da1980ede10b7c474fff329932502eb379a738edd971b1be914eede0c58c21d9db1186999e4dc09e0e5d73c733d0d8fb86779e74590f19657fd66a274a478754c24274f951c783125b96c1819538984ec3b2d71c079d0a066a20d46f7fc6cf0ecd754aee997805b9cb605cb9bc820bbcecf5b278e869945ab341cdfb03acff785c877f4c0e3a549345ac0c351ca5d2fdda00c9fd2e524fdd28b75a6105de25bc240beebb2e46447a72331954b9ae4cf7c9c62bf9e08bff310ae51b2575dd2056ae28ec78500eb7fcb897b278c08c74320330365ab685c3afe90fcd2074273cc6054af9f24f017c9cd6aaa2cd3ccad5bd9bb464ec038057af63dfc3305b66e2170203010001a381d13081ce300f0603551d130101ff040530030101ff301d0603551d0e041604146aa702326dc0bb9b82195d3214e1c9d8f25b886a30819b0603551d2304819330819080146aa702326dc0bb9b82195d3214e1c9d8f25b886aa16da46b3069310b3009060355040613024b5231153013060355040a0c0c52414f4e57495a20496e632e312a3028060355040b0c21526573656172636820616e6420446576656c6f706d656e74204469766973696f6e3117301506035504030c0e52414f4e204b20524f4f5420434182090086595cb263071ee4300d06092a864886f70d01010b05000382010100aaae0c28946e6e3611ca5fbd1ffd1759182a0052a70830adf69e313d175f4a53991dc4fd41637788c7d88a6bd4131ed25167670f77c69bbc9d5254c1f44bdad7b3a6c9a892905e04e739b39eeb49cfcd0f939f7dc0aec5c0de32be2be2c0b094637b42fc8acf47a1901fbf05d7fc03840c0cf3c83beb3e3dfc0d4c09732ddbaa75655dd0201be1aaa60099d88985fce85a7fd7985dcf101c072db00081b217d13e22acaa342b4acee965f3caad03326d15bbe9f08310ff9c942e55e16d931c330aca95f70170a431207ff12d22985ad6e385b62eb32a61bd07e11707ad137d0982cbc36eb868ba7e4668e386ca60de2fb08471e53fa6c591ac6d716eb6c08f8e	89fe3488138656f7ae310d00b5e311d51b6ab51de14f15f7f06038928513e6a8.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	89fe3488138656f7ae310d00b5e311d51b6ab51de14f15f7f06038928513e6a8.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\ECEE052F995765664EE76FBF29EE491E36E8B156	89fe3488138656f7ae310d00b5e311d51b6ab51de14f15f7f06038928513e6a8.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5488	89fe3488138656f7ae310d00b5e311d51b6ab51de14f15f7f06038928513e6a8.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
5488	89fe3488138656f7ae310d00b5e311d51b6ab51de14f15f7f06038928513e6a8.exe
5488	89fe3488138656f7ae310d00b5e311d51b6ab51de14f15f7f06038928513e6a8.exe
5488	89fe3488138656f7ae310d00b5e311d51b6ab51de14f15f7f06038928513e6a8.exe
5488	89fe3488138656f7ae310d00b5e311d51b6ab51de14f15f7f06038928513e6a8.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
5488	89fe3488138656f7ae310d00b5e311d51b6ab51de14f15f7f06038928513e6a8.exe
5488	89fe3488138656f7ae310d00b5e311d51b6ab51de14f15f7f06038928513e6a8.exe
5488	89fe3488138656f7ae310d00b5e311d51b6ab51de14f15f7f06038928513e6a8.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5488	89fe3488138656f7ae310d00b5e311d51b6ab51de14f15f7f06038928513e6a8.exe

C:\Users\Admin\AppData\Local\Temp\89fe3488138656f7ae310d00b5e311d51b6ab51de14f15f7f06038928513e6a8.exe
"C:\Users\Admin\AppData\Local\Temp\89fe3488138656f7ae310d00b5e311d51b6ab51de14f15f7f06038928513e6a8.exe"
1⤵
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

2

T1553

Install Root Certificate

2

T1553.004

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Tmp3BF6.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp3BF6.tmp
Size 1KB
SHA256 f0743fbbabbbfbbc8272d699178e8e20f9557ab6ee1b2285c86cd83ec0073a03
MD5 8109f560b1d42ea3226f29060c60a7ca
SHA1 f6611aa3f2064acada9d6e62c9d71471fc35a8c5
SHA512 525be1263cc719fb90f281dea1dc7fc2da07e603f057bbf70942c3e0394091e211a95a6b5673117760db95e342fd1121e689c977c50f7a567179a7d783ebb0fa
TLSH
T17B31E7109FAC19151812E27ACBB2830D5C23A2AC6685796F012E3DCD9CCDA2346FA89C
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads