3780499eb9a9f351a01b9e8eb40e124790741c0c538403755104c494526bb187

General

Target
3780499eb9a9f351a01b9e8eb40e124790741c0c538403755104c494526bb187.exe
Size 601KB
Sample260807-pcvrbsvdqa
SHA256 3780499eb9a9f351a01b9e8eb40e124790741c0c538403755104c494526bb187
MD5 5397197dc8142038b564eaf1de970f03
SHA1 43f2f8bbbf635b2298e4ce7c6f9146f67031a187
SHA512 ed5f44242275520c855bd8d10785e52a847925139757c95646e33888574813e3fa734c19c6c55fe1d83fa16e7c6a006dcbaec04bb3960ae10f7e546c851e8702
SSDEEP 6144:zN7n63HpIOyo2Vy6MMSAoqiFaQNKglICXuWefy0ZDdNsOfivVzJcSX6MkVFOu/ND:zcaI6KYQ4qIDRjVFzL36WppgKkBU
TLSH
T110D45D26A65400FCE1B3D2F99E565802E672784A0334AEDF03D159A31F177E89F7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
2	api.ipify.org

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/memory/932-4-0x00007FF6EC020000-0x00007FF6EC0BD000-memory.dmp	suspicious_telegram_bot

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8555AC452F5A17BC26BF380B7FA9A34660221AB9\Blob = 0300000001000000140000008555ac452f5a17bc26bf380b7fa9a34660221ab902000000010000008c000000000000001c00000018000000000000000000000000000000020000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000520053004100200061006e00640020004100450053002000430072007900700074006f0067007200610070006800690063002000500072006f007600690064006500720000000000000009000000010000000c000000300a06082b060105050703032000000001000000c5010000308201c13082012aa0030201020210135351617709c0a84bf58cadf379dc99300d06092a864886f70d01010b05003016311430120603550403130b626c61636b6e696e6a6173301e170d3236303830373132313133345a170d3239303830373132313133345a3016311430120603550403130b626c61636b6e696e6a617330819f300d06092a864886f70d010101050003818d0030818902818100ebf9255890f843d62bf2a3d54c7ab9abdd4dd306b4ca7d379e2d5d04ac0280a1f431946ab3e58882d5d1fc3754c6c0741fdd9779092c4f97c08b2310a03343b15a04c9c077b1e11c07cf4beabaf9e01875e8b784c33341df96f9128fd8cb1f4ef004fa522b70eb4945bc716f19ff8019519b4248081d10801ae20323e5cc49ad0203010001a310300e300c0603551d130101ff04023000300d06092a864886f70d01010b050003818100004abbd50a82adef8e0e04dee92edabcbcff71c39990a03ea6903f7ab3a53eee06e0534ddf2bc57c3fa4ebf7027256ce67c69cdbd1ce748cefb463c6f196d68e04ada9d5dd5d7ad68e5e3814844446f8e5890582066c260e2d193f81f21822204fe2b632074b37c0bb6f8b9f9894d207e85b28fa219a28cb109007502d4f44ea	3780499eb9a9f351a01b9e8eb40e124790741c0c538403755104c494526bb187.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8555AC452F5A17BC26BF380B7FA9A34660221AB9\Blob = 0f0000000100000020000000b35929ce4c4c76688bbf514bafdc92d094676d96e8957ef463eacbbda10aa4a309000000010000000c000000300a06082b0601050507030302000000010000008c000000000000001c00000018000000000000000000000000000000020000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000520053004100200061006e00640020004100450053002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072000000000000000300000001000000140000008555ac452f5a17bc26bf380b7fa9a34660221ab92000000001000000c5010000308201c13082012aa0030201020210135351617709c0a84bf58cadf379dc99300d06092a864886f70d01010b05003016311430120603550403130b626c61636b6e696e6a6173301e170d3236303830373132313133345a170d3239303830373132313133345a3016311430120603550403130b626c61636b6e696e6a617330819f300d06092a864886f70d010101050003818d0030818902818100ebf9255890f843d62bf2a3d54c7ab9abdd4dd306b4ca7d379e2d5d04ac0280a1f431946ab3e58882d5d1fc3754c6c0741fdd9779092c4f97c08b2310a03343b15a04c9c077b1e11c07cf4beabaf9e01875e8b784c33341df96f9128fd8cb1f4ef004fa522b70eb4945bc716f19ff8019519b4248081d10801ae20323e5cc49ad0203010001a310300e300c0603551d130101ff04023000300d06092a864886f70d01010b050003818100004abbd50a82adef8e0e04dee92edabcbcff71c39990a03ea6903f7ab3a53eee06e0534ddf2bc57c3fa4ebf7027256ce67c69cdbd1ce748cefb463c6f196d68e04ada9d5dd5d7ad68e5e3814844446f8e5890582066c260e2d193f81f21822204fe2b632074b37c0bb6f8b9f9894d207e85b28fa219a28cb109007502d4f44ea	3780499eb9a9f351a01b9e8eb40e124790741c0c538403755104c494526bb187.exe

Modifies system certificate store 2 TTPs 4 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates\8555AC452F5A17BC26BF380B7FA9A34660221AB9\Blob = 0300000001000000140000008555ac452f5a17bc26bf380b7fa9a34660221ab902000000010000008c000000000000001c00000018000000000000000000000000000000020000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000520053004100200061006e00640020004100450053002000430072007900700074006f0067007200610070006800690063002000500072006f007600690064006500720000000000000009000000010000000c000000300a06082b060105050703032000000001000000c5010000308201c13082012aa0030201020210135351617709c0a84bf58cadf379dc99300d06092a864886f70d01010b05003016311430120603550403130b626c61636b6e696e6a6173301e170d3236303830373132313133345a170d3239303830373132313133345a3016311430120603550403130b626c61636b6e696e6a617330819f300d06092a864886f70d010101050003818d0030818902818100ebf9255890f843d62bf2a3d54c7ab9abdd4dd306b4ca7d379e2d5d04ac0280a1f431946ab3e58882d5d1fc3754c6c0741fdd9779092c4f97c08b2310a03343b15a04c9c077b1e11c07cf4beabaf9e01875e8b784c33341df96f9128fd8cb1f4ef004fa522b70eb4945bc716f19ff8019519b4248081d10801ae20323e5cc49ad0203010001a310300e300c0603551d130101ff04023000300d06092a864886f70d01010b050003818100004abbd50a82adef8e0e04dee92edabcbcff71c39990a03ea6903f7ab3a53eee06e0534ddf2bc57c3fa4ebf7027256ce67c69cdbd1ce748cefb463c6f196d68e04ada9d5dd5d7ad68e5e3814844446f8e5890582066c260e2d193f81f21822204fe2b632074b37c0bb6f8b9f9894d207e85b28fa219a28cb109007502d4f44ea	3780499eb9a9f351a01b9e8eb40e124790741c0c538403755104c494526bb187.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates\8555AC452F5A17BC26BF380B7FA9A34660221AB9\Blob = 14000000010000001400000006956276584425678a099a922740acb6a6b38d5b09000000010000000c000000300a06082b0601050507030302000000010000008c000000000000001c00000018000000000000000000000000000000020000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000520053004100200061006e00640020004100450053002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072000000000000000300000001000000140000008555ac452f5a17bc26bf380b7fa9a34660221ab92000000001000000c5010000308201c13082012aa0030201020210135351617709c0a84bf58cadf379dc99300d06092a864886f70d01010b05003016311430120603550403130b626c61636b6e696e6a6173301e170d3236303830373132313133345a170d3239303830373132313133345a3016311430120603550403130b626c61636b6e696e6a617330819f300d06092a864886f70d010101050003818d0030818902818100ebf9255890f843d62bf2a3d54c7ab9abdd4dd306b4ca7d379e2d5d04ac0280a1f431946ab3e58882d5d1fc3754c6c0741fdd9779092c4f97c08b2310a03343b15a04c9c077b1e11c07cf4beabaf9e01875e8b784c33341df96f9128fd8cb1f4ef004fa522b70eb4945bc716f19ff8019519b4248081d10801ae20323e5cc49ad0203010001a310300e300c0603551d130101ff04023000300d06092a864886f70d01010b050003818100004abbd50a82adef8e0e04dee92edabcbcff71c39990a03ea6903f7ab3a53eee06e0534ddf2bc57c3fa4ebf7027256ce67c69cdbd1ce748cefb463c6f196d68e04ada9d5dd5d7ad68e5e3814844446f8e5890582066c260e2d193f81f21822204fe2b632074b37c0bb6f8b9f9894d207e85b28fa219a28cb109007502d4f44ea	3780499eb9a9f351a01b9e8eb40e124790741c0c538403755104c494526bb187.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8555AC452F5A17BC26BF380B7FA9A34660221AB9	3780499eb9a9f351a01b9e8eb40e124790741c0c538403755104c494526bb187.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates\8555AC452F5A17BC26BF380B7FA9A34660221AB9	3780499eb9a9f351a01b9e8eb40e124790741c0c538403755104c494526bb187.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
932	3780499eb9a9f351a01b9e8eb40e124790741c0c538403755104c494526bb187.exe
932	3780499eb9a9f351a01b9e8eb40e124790741c0c538403755104c494526bb187.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
932	3780499eb9a9f351a01b9e8eb40e124790741c0c538403755104c494526bb187.exe

C:\Users\Admin\AppData\Local\Temp\3780499eb9a9f351a01b9e8eb40e124790741c0c538403755104c494526bb187.exe
"C:\Users\Admin\AppData\Local\Temp\3780499eb9a9f351a01b9e8eb40e124790741c0c538403755104c494526bb187.exe"
1⤵
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:932