3780499eb9a9f351a01b9e8eb40e124790741c0c538403755104c494526bb187

General

Target
3780499eb9a9f351a01b9e8eb40e124790741c0c538403755104c494526bb187.exe
Size 601KB
Sample260807-pcvrbsvdqa
SHA256 3780499eb9a9f351a01b9e8eb40e124790741c0c538403755104c494526bb187
MD5 5397197dc8142038b564eaf1de970f03
SHA1 43f2f8bbbf635b2298e4ce7c6f9146f67031a187
SHA512 ed5f44242275520c855bd8d10785e52a847925139757c95646e33888574813e3fa734c19c6c55fe1d83fa16e7c6a006dcbaec04bb3960ae10f7e546c851e8702
SSDEEP 6144:zN7n63HpIOyo2Vy6MMSAoqiFaQNKglICXuWefy0ZDdNsOfivVzJcSX6MkVFOu/ND:zcaI6KYQ4qIDRjVFzL36WppgKkBU
TLSH
T110D45D26A65400FCE1B3D2F99E565802E672784A0334AEDF03D159A31F177E89F7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
4	api.ipify.org
6	api.ipify.org

Detect suspicious telegram bot 2 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral1/files/0x00080000000245e7-10.dat	suspicious_telegram_bot
behavioral1/memory/4676-12-0x00007FF7BA9B0000-0x00007FF7BAA4D000-memory.dmp	suspicious_telegram_bot

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\1730DFC9765A17BC98E6EC0B347664B20CB73E11\Blob = 0300000001000000140000001730dfc9765a17bc98e6ec0b347664b20cb73e1102000000010000008c000000000000001c00000018000000000000000000000000000000020000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000520053004100200061006e00640020004100450053002000430072007900700074006f0067007200610070006800690063002000500072006f007600690064006500720000000000000009000000010000000c000000300a06082b060105050703032000000001000000c5010000308201c13082012aa00302010202107d4a5e6ff245059c4cfb37145c582d86300d06092a864886f70d01010b05003016311430120603550403130b626c61636b6e696e6a6173301e170d3236303830373132313133335a170d3239303830373132313133335a3016311430120603550403130b626c61636b6e696e6a617330819f300d06092a864886f70d010101050003818d0030818902818100c7a5aeb6a9be040bf9b8dfec5c82a21a0349e15e4ee4b3fabcebd8121e99189798af83dddd1fb9e358ffc5bdbb44702f476abe40805cd1d729835c8f96100c4bd9aaff543c7aad0b0745d62602524e923447960e0c37a7382d401e80ea8bea7b46aefd88bd3e7d363fc4c6efe90add3570b992bc8ec2435500f69d1838ecc13d0203010001a310300e300c0603551d130101ff04023000300d06092a864886f70d01010b050003818100a30efb67cd4516371ee473d4210980e4b5f533f556048685c5aaacf67ba96c457fb899636dd3f0192e0b908c038b481409b7b46d4120aa8f63f484bcaf1e22eb663b6657ed79fa8d24d054f3afbfc1605841a6acafed6eb8cf9f9a8308ef4b02516602359225b38fcf389057522397bc83f59f37c5250cd0cc211615ea0861cf	3780499eb9a9f351a01b9e8eb40e124790741c0c538403755104c494526bb187.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\1730DFC9765A17BC98E6EC0B347664B20CB73E11\Blob = 0f00000001000000200000000c30686a1ffb94d7c47c730744c66c91cc4f23d30d7484dbad396f4bae968c5809000000010000000c000000300a06082b0601050507030302000000010000008c000000000000001c00000018000000000000000000000000000000020000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000520053004100200061006e00640020004100450053002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072000000000000000300000001000000140000001730dfc9765a17bc98e6ec0b347664b20cb73e112000000001000000c5010000308201c13082012aa00302010202107d4a5e6ff245059c4cfb37145c582d86300d06092a864886f70d01010b05003016311430120603550403130b626c61636b6e696e6a6173301e170d3236303830373132313133335a170d3239303830373132313133335a3016311430120603550403130b626c61636b6e696e6a617330819f300d06092a864886f70d010101050003818d0030818902818100c7a5aeb6a9be040bf9b8dfec5c82a21a0349e15e4ee4b3fabcebd8121e99189798af83dddd1fb9e358ffc5bdbb44702f476abe40805cd1d729835c8f96100c4bd9aaff543c7aad0b0745d62602524e923447960e0c37a7382d401e80ea8bea7b46aefd88bd3e7d363fc4c6efe90add3570b992bc8ec2435500f69d1838ecc13d0203010001a310300e300c0603551d130101ff04023000300d06092a864886f70d01010b050003818100a30efb67cd4516371ee473d4210980e4b5f533f556048685c5aaacf67ba96c457fb899636dd3f0192e0b908c038b481409b7b46d4120aa8f63f484bcaf1e22eb663b6657ed79fa8d24d054f3afbfc1605841a6acafed6eb8cf9f9a8308ef4b02516602359225b38fcf389057522397bc83f59f37c5250cd0cc211615ea0861cf	3780499eb9a9f351a01b9e8eb40e124790741c0c538403755104c494526bb187.exe

Modifies system certificate store 2 TTPs 4 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\1730DFC9765A17BC98E6EC0B347664B20CB73E11	3780499eb9a9f351a01b9e8eb40e124790741c0c538403755104c494526bb187.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates\1730DFC9765A17BC98E6EC0B347664B20CB73E11	3780499eb9a9f351a01b9e8eb40e124790741c0c538403755104c494526bb187.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates\1730DFC9765A17BC98E6EC0B347664B20CB73E11\Blob = 0300000001000000140000001730dfc9765a17bc98e6ec0b347664b20cb73e1102000000010000008c000000000000001c00000018000000000000000000000000000000020000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000520053004100200061006e00640020004100450053002000430072007900700074006f0067007200610070006800690063002000500072006f007600690064006500720000000000000009000000010000000c000000300a06082b060105050703032000000001000000c5010000308201c13082012aa00302010202107d4a5e6ff245059c4cfb37145c582d86300d06092a864886f70d01010b05003016311430120603550403130b626c61636b6e696e6a6173301e170d3236303830373132313133335a170d3239303830373132313133335a3016311430120603550403130b626c61636b6e696e6a617330819f300d06092a864886f70d010101050003818d0030818902818100c7a5aeb6a9be040bf9b8dfec5c82a21a0349e15e4ee4b3fabcebd8121e99189798af83dddd1fb9e358ffc5bdbb44702f476abe40805cd1d729835c8f96100c4bd9aaff543c7aad0b0745d62602524e923447960e0c37a7382d401e80ea8bea7b46aefd88bd3e7d363fc4c6efe90add3570b992bc8ec2435500f69d1838ecc13d0203010001a310300e300c0603551d130101ff04023000300d06092a864886f70d01010b050003818100a30efb67cd4516371ee473d4210980e4b5f533f556048685c5aaacf67ba96c457fb899636dd3f0192e0b908c038b481409b7b46d4120aa8f63f484bcaf1e22eb663b6657ed79fa8d24d054f3afbfc1605841a6acafed6eb8cf9f9a8308ef4b02516602359225b38fcf389057522397bc83f59f37c5250cd0cc211615ea0861cf	3780499eb9a9f351a01b9e8eb40e124790741c0c538403755104c494526bb187.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates\1730DFC9765A17BC98E6EC0B347664B20CB73E11\Blob = 1400000001000000140000009753683456fb44f48c8647197b3290def2b99b1f09000000010000000c000000300a06082b0601050507030302000000010000008c000000000000001c00000018000000000000000000000000000000020000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000520053004100200061006e00640020004100450053002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072000000000000000300000001000000140000001730dfc9765a17bc98e6ec0b347664b20cb73e112000000001000000c5010000308201c13082012aa00302010202107d4a5e6ff245059c4cfb37145c582d86300d06092a864886f70d01010b05003016311430120603550403130b626c61636b6e696e6a6173301e170d3236303830373132313133335a170d3239303830373132313133335a3016311430120603550403130b626c61636b6e696e6a617330819f300d06092a864886f70d010101050003818d0030818902818100c7a5aeb6a9be040bf9b8dfec5c82a21a0349e15e4ee4b3fabcebd8121e99189798af83dddd1fb9e358ffc5bdbb44702f476abe40805cd1d729835c8f96100c4bd9aaff543c7aad0b0745d62602524e923447960e0c37a7382d401e80ea8bea7b46aefd88bd3e7d363fc4c6efe90add3570b992bc8ec2435500f69d1838ecc13d0203010001a310300e300c0603551d130101ff04023000300d06092a864886f70d01010b050003818100a30efb67cd4516371ee473d4210980e4b5f533f556048685c5aaacf67ba96c457fb899636dd3f0192e0b908c038b481409b7b46d4120aa8f63f484bcaf1e22eb663b6657ed79fa8d24d054f3afbfc1605841a6acafed6eb8cf9f9a8308ef4b02516602359225b38fcf389057522397bc83f59f37c5250cd0cc211615ea0861cf	3780499eb9a9f351a01b9e8eb40e124790741c0c538403755104c494526bb187.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4676	3780499eb9a9f351a01b9e8eb40e124790741c0c538403755104c494526bb187.exe
4676	3780499eb9a9f351a01b9e8eb40e124790741c0c538403755104c494526bb187.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4676	3780499eb9a9f351a01b9e8eb40e124790741c0c538403755104c494526bb187.exe

C:\Users\Admin\AppData\Local\Temp\3780499eb9a9f351a01b9e8eb40e124790741c0c538403755104c494526bb187.exe
"C:\Users\Admin\AppData\Local\Temp\3780499eb9a9f351a01b9e8eb40e124790741c0c538403755104c494526bb187.exe"
1⤵
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:4676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

2

T1553

Install Root Certificate

2

T1553.004

Credential Access

Discovery

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3780499eb9a9f351a01b9e8eb40e124790741c0c538403755104c494526bb187.exe

Path C:\Users\Admin\AppData\Local\Temp\3780499eb9a9f351a01b9e8eb40e124790741c0c538403755104c494526bb187.exe
Size 601KB
SHA256 641d8f55db593d6cc588ad6493504f6a981f6aa17adb698fd029aa8ad5d45c4e
MD5 afe3e9f79455a19275b2cc5e75ee0d05
SHA1 231f0aca90da287ba4ca0142cce3b1acaf12ccb7
SHA512 c5f4689fa1dbc21b06153581d5da03ce1c162aa1e676b3461074a09eb4cbdd7172fa1cf3299a46173dc599f83402920a9799120f438c691498582936858d3641
SSDEEP 6144:cN7n63HpIOyo2Vy6MMSAoqiFaQNKglICXuWefy0ZDdNsOfivVzJcSX6MkVFOu/Nk:ccaI6KYQ4qIDRjVFzL36WppgKkBBR
TLSH
T135D45D26A65400FCE1B3D2F99E565802E672784A0334AEDF03D159A31F177E89F7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4676-12-0x00007FF7BA9B0000-0x00007FF7BAA4D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads