15a2debbfae31b70d4a4ec64f70244af4e7cfe9862cb56fe24b0d2727124f115

General

Target
15a2debbfae31b70d4a4ec64f70244af4e7cfe9862cb56fe24b0d2727124f115.exe
Size 889KB
Sample260808-wgcvmsbk7x
SHA256 15a2debbfae31b70d4a4ec64f70244af4e7cfe9862cb56fe24b0d2727124f115
MD5 d63cbfa812c334eba620890ac6e1fb8b
SHA1 f5687e49326a975645a12c1825834f2ae1261a43
SHA512 2795271d58e0348fa5ae426190afc46fc21b6816bc32e8ac37ba1ae454857167ea85a3003639d57a6a214c9323676db35df822b7ea24506f6da46d56b85ffcbc
SSDEEP 12288:KZYQW3y9+1tAVT6UrqeYsjrPZQuZUzhjmjuEhcQCiVPx+/pM:v6atA9brqeYsZQhzhjmjuEhcQCiVQpM
TLSH
T1EA158D1AFBA504B9E577C178C9A34902E7727C490760EBDF13904AA61F37BD09A3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	15a2debbfae31b70d4a4ec64f70244af4e7cfe9862cb56fe24b0d2727124f115.exe

Loads dropped DLL 2 IoCs

pid	Process
3436	15a2debbfae31b70d4a4ec64f70244af4e7cfe9862cb56fe24b0d2727124f115.exe
3436	15a2debbfae31b70d4a4ec64f70244af4e7cfe9862cb56fe24b0d2727124f115.exe

Modifies trusted root certificate store through registry 1 TTPs 1 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\C3EEF63CB8D8654B361A32748380426DB41BB382\Blob = 030000000100000014000000c3eef63cb8d8654b361a32748380426db41bb38220000000010000000e0300003082030a308201f2a0030201020214254c063151f7aa9e109479d7d95eb6821b63e191300d06092a864886f70d01010b0500301d311b301906035504030c1242524d4f44535f4c41425f544553545f4341301e170d3236303632383031323534315a170d3336303632363031323534315a301d311b301906035504030c1242524d4f44535f4c41425f544553545f434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c31ddab001d5931c30d8499de7abd7f8e0a83d6d52a70b7d8a42c6f522ad82d00619cd7a79a052c758c94754cf1858d4af7f6e26f7d05a98c8f5a702a4b34fe690e2c0db68028e8c9d14ee52104caecceb430b56c9496f7019fcef062964785682a12ba3ed5a2a2eb5654a533822c1aa21dc297f9dbbc15ad414bbbfd053bb13053d74cbe09ed8bb1f1baac9ea0abd2d72853fa34eaaf33ffb43933f561a592f1c69969b3806ddd1b06c4abb3747420ec9d6c1bc40088d1df0e65d85880c001dabceed604db7e6c97a3966bbaf64c55eca9ecb77e977cbeadbec99fcaa5b78bac200c832d47f59927cb8945cbdfb95157731b848dec8566a1d7d08d98b878b090203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604142f1491a2bfb793c0a15cfbdd70f8981ebfdd12a4300d06092a864886f70d01010b0500038201010049dafc3184e090c7aa1451d7769d71ad202244cc15f66041e6c2d1bdbacb7562ddadf946a7ba13aa5452ba6cc661cf307b12c8db353131b72cef993ed2535242024f4eda8c472897eba414f1445c64502325421a3c4e36ddbe369f10f60665c03f4427760a8337a122d64fa86bf6f341eb95d62330971c80ff2c76c4168c2b002cfa7e36f382c244abf114d62f0f4a7075781b93d4c3173385b678ab664990eccf08a0c6d5758440c37be32c5df633507e4bc383917f74c4fd7ba4b979aec66136c1f7f35939121612797aa67b52f2e0877edcc49b8d26739a360c5e8dd2590dd2643d0a57d4c8df35acaedd3e149d3e142244ea13dfe50ec98e098ccd43b799	15a2debbfae31b70d4a4ec64f70244af4e7cfe9862cb56fe24b0d2727124f115.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\discord-1497095332507680778	15a2debbfae31b70d4a4ec64f70244af4e7cfe9862cb56fe24b0d2727124f115.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\discord-1497095332507680778\URL Protocol	15a2debbfae31b70d4a4ec64f70244af4e7cfe9862cb56fe24b0d2727124f115.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\discord-1497095332507680778\DefaultIcon	15a2debbfae31b70d4a4ec64f70244af4e7cfe9862cb56fe24b0d2727124f115.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\discord-1497095332507680778\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\15a2debbfae31b70d4a4ec64f70244af4e7cfe9862cb56fe24b0d2727124f115.exe"	15a2debbfae31b70d4a4ec64f70244af4e7cfe9862cb56fe24b0d2727124f115.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\discord-1497095332507680778\shell	15a2debbfae31b70d4a4ec64f70244af4e7cfe9862cb56fe24b0d2727124f115.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\discord-1497095332507680778\shell\open	15a2debbfae31b70d4a4ec64f70244af4e7cfe9862cb56fe24b0d2727124f115.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\discord-1497095332507680778\ = "URL:Run game 1497095332507680778 protocol"	15a2debbfae31b70d4a4ec64f70244af4e7cfe9862cb56fe24b0d2727124f115.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\discord-1497095332507680778\shell\open\command	15a2debbfae31b70d4a4ec64f70244af4e7cfe9862cb56fe24b0d2727124f115.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\discord-1497095332507680778\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\15a2debbfae31b70d4a4ec64f70244af4e7cfe9862cb56fe24b0d2727124f115.exe"	15a2debbfae31b70d4a4ec64f70244af4e7cfe9862cb56fe24b0d2727124f115.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\C3EEF63CB8D8654B361A32748380426DB41BB382	15a2debbfae31b70d4a4ec64f70244af4e7cfe9862cb56fe24b0d2727124f115.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3436	15a2debbfae31b70d4a4ec64f70244af4e7cfe9862cb56fe24b0d2727124f115.exe
3436	15a2debbfae31b70d4a4ec64f70244af4e7cfe9862cb56fe24b0d2727124f115.exe
3436	15a2debbfae31b70d4a4ec64f70244af4e7cfe9862cb56fe24b0d2727124f115.exe
3436	15a2debbfae31b70d4a4ec64f70244af4e7cfe9862cb56fe24b0d2727124f115.exe
3436	15a2debbfae31b70d4a4ec64f70244af4e7cfe9862cb56fe24b0d2727124f115.exe
3436	15a2debbfae31b70d4a4ec64f70244af4e7cfe9862cb56fe24b0d2727124f115.exe

C:\Users\Admin\AppData\Local\Temp\15a2debbfae31b70d4a4ec64f70244af4e7cfe9862cb56fe24b0d2727124f115.exe
"C:\Users\Admin\AppData\Local\Temp\15a2debbfae31b70d4a4ec64f70244af4e7cfe9862cb56fe24b0d2727124f115.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Modifies trusted root certificate store through registry
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:3436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

2

T1553

Install Root Certificate

2

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

discord-rpc.dll

Path C:\Users\Admin\AppData\Local\Temp\discord-rpc.dll
Size 231KB
SHA256 410645fe9c828fad3330b1c6ef084c9edbc253c0b9d860ef1b77f0d14eeeff1f
MD5 a6d17e939e25172d80853536a0be3880
SHA1 fa668163107742d4b826d48aa567442cbffe6e19
SHA512 a5d958683704eff1869cca93370d8734819bb18ee37dacaae2d0a846f21fed2328b2210c9e132acb34aa9e764d839cbc6cae922c43581ebb60de9de6d56bb12d
SSDEEP 3072:Tkjmjwh2JhcQCUMUtMZJaZ5mEvy6bMNi/W+H+Q5IyWImga7fS7RMjM:TkjmjuEhcQCT+VPIzE+/sWjM
TLSH
T19A347C1AB7E50CB9EDB38279C9934602D2B27C504720D7DF03A0466A9F2F7D0957EB26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mod.dll

Path C:\Users\Admin\AppData\Local\Temp\netcache\Mod.dll
Size 374KB
SHA256 8a85587bbe575f025bf1b638927d2c50adbd74ddfbc1c7b0c0e652db8982a6a8
MD5 b5dc372fc3afc39f87311e8f82df7736
SHA1 00a5e7d843a4e9c9aee86ce9211d5ea6d5b06f6a
SHA512 d8e11ada28211b2c3781ddc5fefaf9fac74e8dae0beee5e639bac413a5c5cbf540753025faaaeb6944fe5a8c380d20b00a0c7942f30c6ff56a393cc631586e33
SSDEEP 6144:mZgd2roqeoAAE1+N+sjrxhZQGSiZ053zVzdwGli:LUrqeYsjrPZQuZUz
TLSH
T1DD846C25EBA404B9E17791B8C9738902D772BC8E0760ABCF23944A961F37FD4963E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads