df2d9eb9427860ea926b1ea8c7f6ad90f7443ed8aae61fb9ba27f9680b5ff911

General

Target
df2d9eb9427860ea926b1ea8c7f6ad90f7443ed8aae61fb9ba27f9680b5ff911.exe
Size 5.9MB
Sample260826-vghv8aed48
SHA256 df2d9eb9427860ea926b1ea8c7f6ad90f7443ed8aae61fb9ba27f9680b5ff911
MD5 d310c319edf9a006f1c7133b0f348134
SHA1 21465f3c7d190544ec95251272cb6ee18839c2f4
SHA512 2d30d330ff0e27d2e8524693e5457b7b7cce32f14ff24a2d849e923bcb5162018b9887b7b37f3036a639e7a62ba67e8abb941f06a3d2d2d99dc116c11934ff3b
SSDEEP 98304:GPqrx0NqMbwXPNwXU36QJ3moKlpQZqvogXkf11bePPVJh1L/oEpV9u1:0mSqiwXF6UKQxip8qkfaPVp7RpVM
TLSH
T140563353A7E28570E9811678CE34D6506CD37B7E64F4A08B7EBCCE3D0778944983AA72
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery installer spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
64	5100	df2d9eb9427860ea926b1ea8c7f6ad90f7443ed8aae61fb9ba27f9680b5ff911.tmp

Executes dropped EXE 1 IoCs

pid	Process
5100	df2d9eb9427860ea926b1ea8c7f6ad90f7443ed8aae61fb9ba27f9680b5ff911.tmp

Loads dropped DLL 1 IoCs

pid	Process
5100	df2d9eb9427860ea926b1ea8c7f6ad90f7443ed8aae61fb9ba27f9680b5ff911.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	df2d9eb9427860ea926b1ea8c7f6ad90f7443ed8aae61fb9ba27f9680b5ff911.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	df2d9eb9427860ea926b1ea8c7f6ad90f7443ed8aae61fb9ba27f9680b5ff911.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/1832-0-0x0000000000400000-0x0000000000428000-memory.dmp	innosetup
behavioral1/memory/1832-11-0x0000000000400000-0x0000000000428000-memory.dmp	innosetup

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F	df2d9eb9427860ea926b1ea8c7f6ad90f7443ed8aae61fb9ba27f9680b5ff911.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F\Blob = 5c0000000100000004000000000800000f00000001000000200000001504593902ec8a0bab29f03bf35c3058b5fd1807a74dab92cb61ed4a9908afa40b000000010000006200000041006d0061007a006f006e00200053006500720076006900630065007300200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020002d002d002000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000002500000030233021060b6086480186fd6e0107180330123010060a2b0601040182373c0101030200c0620000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab51400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf21191831d000000010000001000000052135310639a10f77f886b229b9f7afc7f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000925a8f8d2c6d04e0665f596aff22d863e8256f3f19000000010000001000000014d4b19434670e6dc091d154abb20edc2000000001000000f3030000308203ef308202d7a003020102020100300d06092a864886f70d01010b0500308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183300d06092a864886f70d01010b050003820101004b36a6847769dd3b199f6723086f0e61c9fd84dc5fd83681cdd81b412d9f60ddc71a68d9d16e86e18823cf13de43cfe234b3049d1f29d5bff85ec8d5c1bdee926f3274f291822fbd82427aad2ab7207d4dbc7a5512c215eabdf76a952e6c749fcf1cb4f2c501a385d0723ead73ab0b9b750c6d45b78e94ac9637b5a0d08f15470ee3e883dd8ffdef410177cc27a9628533f23708ef71cf7706dec8191d8840cf7d461dff1ec7e1ceff23dbc6fa8d554ea902e74711463ef4fdbd7b2926bba961623728b62d2af6108664c970a7d2adb7297079ea3cda63259ffd68b730ec70fb758ab76d6067b21ec8b9e9d8a86f028b670d4d265771da20fcc14a508db128ba	df2d9eb9427860ea926b1ea8c7f6ad90f7443ed8aae61fb9ba27f9680b5ff911.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 5100	1832	df2d9eb9427860ea926b1ea8c7f6ad90f7443ed8aae61fb9ba27f9680b5ff911.exe	85

C:\Users\Admin\AppData\Local\Temp\df2d9eb9427860ea926b1ea8c7f6ad90f7443ed8aae61fb9ba27f9680b5ff911.exe
"C:\Users\Admin\AppData\Local\Temp\df2d9eb9427860ea926b1ea8c7f6ad90f7443ed8aae61fb9ba27f9680b5ff911.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Users\Admin\AppData\Local\Temp\is-LB5SB.tmp\df2d9eb9427860ea926b1ea8c7f6ad90f7443ed8aae61fb9ba27f9680b5ff911.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-LB5SB.tmp\df2d9eb9427860ea926b1ea8c7f6ad90f7443ed8aae61fb9ba27f9680b5ff911.tmp" /SL5="$A01E2,5711300,121344,C:\Users\Admin\AppData\Local\Temp\df2d9eb9427860ea926b1ea8c7f6ad90f7443ed8aae61fb9ba27f9680b5ff911.exe"
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  PID:5100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

idp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-JJMAE.tmp\idp.dll
Size 232KB
SHA256 54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed
MD5 55c310c0319260d798757557ab3bf636
SHA1 0892eb7ed31d8bb20a56c6835990749011a2d8de
SHA512 e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57
SSDEEP 3072:dnSx3lws+iWbUmJmE8dxMw7r+mjT5PbzEFwyGIyTcHY10tSB9j:IP0bUmQEUr+mRcbTx4N
TLSH
T13434AF00B6CBC073D98F0778842B975C0B7AB95557348ACBEB985DADCD213C2AD371A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

df2d9eb9427860ea926b1ea8c7f6ad90f7443ed8aae61fb9ba27f9680b5ff911.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-LB5SB.tmp\df2d9eb9427860ea926b1ea8c7f6ad90f7443ed8aae61fb9ba27f9680b5ff911.tmp
Size 1.1MB
SHA256 9c81817acd4982632d8c7f1df3898fca1477577738184265d735f49fc5480f07
MD5 34acc2bdb45a9c436181426828c4cb49
SHA1 5adaa1ac822e6128b8d4b59a54d19901880452ae
SHA512 134ff4022571efd46f7a62e99b857ebe834e9916c786345908010f9e1fb90be226b740ddee16ae9290fe45c86be7238c4555e422abe66a461d11545e19734beb
SSDEEP 24576:/nbbPImgK4brDi4IxgRqzwqNb+Yz73P2EMZbG0JEtdqxyt:/HeKh4nqzF3PYdSto
TLSH
T1AD453A22A3D28437D5732E759D6BD2946C367E202EB4E44A7EF89E0C0E35B41BD35392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1832-0-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1832-11-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/5100-5-0x00000000007D0000-0x00000000007D1000-memory.dmp

Download

memory/5100-12-0x0000000000400000-0x000000000052E000-memory.dmp

Download

memory/5100-13-0x00000000007D0000-0x00000000007D1000-memory.dmp

Download

memory/5100-44-0x0000000000400000-0x000000000052E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads