be9241b344fed7341461c74920694e2bbf1ff61cfce8c97b64b2cada40e971fc

General

Target
be9241b344fed7341461c74920694e2bbf1ff61cfce8c97b64b2cada40e971fc.exe
Size 3.4MB
Sample261007-3kft2axvax
SHA256 be9241b344fed7341461c74920694e2bbf1ff61cfce8c97b64b2cada40e971fc
MD5 9258c3f3c0c55517545ea31195acc533
SHA1 96062c738149447575e894639bfae65890a41960
SHA512 bae082ce696614ed0809e16bf3ac236395c54f0abc540780a91be9d8ee286eb20fcd90108b94fc5122fb2517a59ee7b8614bd77bb3ce02b278c0ae82671c743d
SSDEEP 49152:8C9LvQEwksc7Z7eomdK4yoo4Gqeqxy8cwfR8lYqTFkP1W:P9Dwksc7ZcW17wfeOqT2NW
TLSH
T1E0F54C50A8C4D4E0C558C1F62A607F37F681BD1D06315A92F8ACFAE57B341E2AF14FA9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	be9241b344fed7341461c74920694e2bbf1ff61cfce8c97b64b2cada40e971fc.exe

Modifies trusted root certificate store through registry 1 TTPs 1 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\9B72DB9067F28F077AB47572E5D9115D14E50C2C\Blob = 0300000001000000140000009b72db9067f28f077ab47572e5d9115d14e50c2c2000000001000000bb020000308202b730820220a003020102020116300d06092a864886f70d010104050030818c310b300906035504061302434e310c300a060355040a130343434231143012060355040b130b4343425f4e657462616e6b310b300906035504081302424a311430120603550403130b43434220434120524f4f543111300f060355040713085869204368656e673123302106092a864886f70d010901161463612f7a682f636362406363622e636f6d2e636e301e170d3939303632393030303030305a170d3439303632393030303030305a30818c310b300906035504061302434e310c300a060355040a130343434231143012060355040b130b4343425f4e657462616e6b310b300906035504081302424a311430120603550403130b43434220434120524f4f543111300f060355040713085869204368656e673123302106092a864886f70d010901161463612f7a682f636362406363622e636f6d2e636e30819f300d06092a864886f70d010101050003818d0030818902818100a23f2503f132999d842fa2a865e6df59102f6e58f83414b79645bd301141ce1ad034dd3a17cfdfa3455be443c4636419c8eec65faa0271a186384b824e4ca640bec1212817dd5a9c5597a6104f1e11beb25227418bfbe2039168b99f725c077b5df50e008f6b51ed55c690e48858833ec98c0ea8ec3bf2a540e47a94bf8eb1870203010001a327302530120603551d130101ff040830060101ff020102300f0603551d0f0101ff04050303000600300d06092a864886f70d0101040500038181009b59c545937e1cfd655c6c211b797b191503290b45d76e3802162aeb00d131149c071ca1c151ebc7928cf737a7cc8f5bc2bc462df5fc8c9487ca42b56d3402501eaabbda40960a54b78749ab6ecdcb4870fed69bba1707518abfc585ae178651fad51569689e17b33bc450aaaa1ea163a0b7548cab7f28ce7b52e5bcca22a05f	be9241b344fed7341461c74920694e2bbf1ff61cfce8c97b64b2cada40e971fc.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	be9241b344fed7341461c74920694e2bbf1ff61cfce8c97b64b2cada40e971fc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be9241b344fed7341461c74920694e2bbf1ff61cfce8c97b64b2cada40e971fc.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\9B72DB9067F28F077AB47572E5D9115D14E50C2C	be9241b344fed7341461c74920694e2bbf1ff61cfce8c97b64b2cada40e971fc.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4568	be9241b344fed7341461c74920694e2bbf1ff61cfce8c97b64b2cada40e971fc.exe
4568	be9241b344fed7341461c74920694e2bbf1ff61cfce8c97b64b2cada40e971fc.exe
4568	be9241b344fed7341461c74920694e2bbf1ff61cfce8c97b64b2cada40e971fc.exe
4568	be9241b344fed7341461c74920694e2bbf1ff61cfce8c97b64b2cada40e971fc.exe

C:\Users\Admin\AppData\Local\Temp\be9241b344fed7341461c74920694e2bbf1ff61cfce8c97b64b2cada40e971fc.exe
"C:\Users\Admin\AppData\Local\Temp\be9241b344fed7341461c74920694e2bbf1ff61cfce8c97b64b2cada40e971fc.exe"
1⤵
- Checks whether UAC is enabled
- Modifies trusted root certificate store through registry
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
PID:4568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

2

T1553

Install Root Certificate

2

T1553.004

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OnKeyDetector.log

Path C:\OnKeyDetector.log
Size 1KB
SHA256 fe3220d0bb450e99344d5901844b6af76aee4011860ff10d98df655f8baf78d6
MD5 6c0c61eeec4cd00531a041425b3edd31
SHA1 8bc4b65356f47598d567e9afd034449c63ad7fe5
SHA512 e6cc4d4284988edcd857f3a4d04af31ece54f6d26a07b029dae965c922fab61d52675f0cefe3976834c2704e29254d1af836f6aac5575eaf102bf8dda63bab7a
TLSH
T1FE21F954063C8132456E3B2FA3B46AC38FC31FD043296C9DD529F9A42ECC985358EAED
MD5 SHA1 SHA512 TLSH

Submit Download

OnKeyDetector.log

Path C:\OnKeyDetector.log
Size 2KB
SHA256 f32fb1d283e37d9d40fb336394a60d350d09e8fc0a3355a1292d66999bc1724b
MD5 828c7481524fd9393b38504119883ab8
SHA1 5f6e93844190440dcdf57b6960b642f7bf086c4c
SHA512 89c09927f19e5a230946f410d826faad8644a47287a8cda00e40a3057794ca2f4d2e55c3a7ba146b97aa790a73a14faf07af50012956bba6fbafecb2e281a89f
TLSH
T1BF510864063CC132456F272E63B565C38F831FD043296C9DE929F9A42D8C985358EAEE
MD5 SHA1 SHA512 TLSH

Submit Download

OnKeyDetector.log

Path C:\OnKeyDetector.log
Size 3KB
SHA256 366d5b67f39750f2cfdfbb0e42c0f61e4a18c56c59e9c08754667174e998139d
MD5 0566a13fcc1e87c1aedb8fed803acc2b
SHA1 a390c2697db56dcc41977893cd6878e1fb28e940
SHA512 4b3470b75f534b8be00d443cd83dd6bc09e926994148c510dd2609a9f9aa537032e9d97208a611d6b462bdac90946183ec8b76d9d5aaf1dc3144fe9a5c02e7f7
TLSH
T188715D64053CC132496E662E63B569D38F831FD083356D9DE928F9A42D8CD86348EAE9
MD5 SHA1 SHA512 TLSH

Submit Download

OnKeyDetector.log

Path C:\OnKeyDetector.log
Size 5KB
SHA256 50019c0e8acae57aad497e1e393866bb9e1c6f7ac5384a65d14f41ac991a109a
MD5 8a097eaf6998b1ff551ed47d61b45cab
SHA1 1602da98809ca908ac3ea7237ce3083044f60b4c
SHA512 a4fd4e2aaeccbbe21b910d5b12aad2613e24d1f8f3cc3459906371e732b24ff97b9bf77bf44c93cd50db07d17c148af1fa7fb221f1ac2ffbf72244d4f0356b2d
SSDEEP 96:otP5r/5I5G5g5p5Z5I585M5R5N5l5Z5P5dj5Aj5V5N5V5Y5UT5gT5q5V5z7m5hr0:QrhCYqLbC+ujHPbRzMfHfyUdgdkfz8D2
TLSH
T190B191A4053CC172496E662E637475D38F831FD083357D5DE924F9E42D8CD86248EEE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccb[1]

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BBF28RIN\ccb[1]
Size 109KB
SHA256 7855dc7dabb4aef8f57ff63ff16d1270e50c3a930c8b10aa753194f5661f9695
MD5 dda7b5b37408a421f0062ce21107e42f
SHA1 fcea616f11667621a791cf41029713a7b9ee1e1f
SHA512 60451c4085a5fabd9b29bda0a97667c5d172d1a00c14a50b1b74fa9327cddb0b6080bb00b8067cd24a15274cbeea0147b2cfe0b26ff6812db6973bb86db19830
SSDEEP 1536:SVBlcK5oxpw4SV5F9OEqpX1KcHBlw6IIFM3rnJggq:4BlYgq
TLSH
T1AFB304B9C9F610E0AD12719F7528ABA53A602C95423AD39494FACCB5EFCE2F3441F45C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dialog[2]

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Q2Q51FI5\dialog[2]
Size 1KB
SHA256 4261af463911a5f682027d477946075a75477e5294c4e18eb06d52f89209b9ba
MD5 e20ed68829418cc47d7d504d58521e2f
SHA1 8f6acaba89fa354cd5f9b5dcc46c7a9708cd7507
SHA512 c9c0338a88472e147bdc5d9db4ac80275b3ec792e476034c03a2f43de95f21eb52da2d4ad29622cda589782b3d12bffdcd1f9ec97665ee64c81c3abab79e3b2f
TLSH
T199216524222D43602D91538E92388F93FC3B853AC75F7697626EDD6A3030C0B3EC5A60
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads