ee3e04e7169d3a0e28e4fcc00ac468569abd51ed474a02c017ebdd3fd8b4176f

General

Target

ee3e04e7169d3a0e28e4fcc00ac468569abd51ed474a02c017ebdd3fd8b4176f.dll
Size

1.8MB
MD5

90b3bb3cafad739c92bfcc49854385d6
SHA1

8ae60bc1ab1359066767ee5c2963aef907435945
SHA256

ee3e04e7169d3a0e28e4fcc00ac468569abd51ed474a02c017ebdd3fd8b4176f
SHA512

85fa244626394b65351afa7ad62c10dfafd1bed614d80ea2ff2b9daf48557c88a4b67c776ebcef514430103c37a3e115e4f6cba7c8c1c82b23428503189b4b91

Score

6^/10

adware stealer

Malware Config

Signatures

Installs/modifies Browser Helper Object 2 TTPs
BHOs are DLL modules which act as plugins for Internet Explorer.
stealer adware

Modify Registry
T1112

Browser Extensions
T1176

Modifies registry class 46 IoCs

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0BEBABF-1785-4075-8C4D-8FEE7833D3CD}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DAF9F01C-30F0-4A52-AF52-E236961977F4}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D42047D9-38C2-4FD1-8337-F69C8F835A30}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ee3e04e7169d3a0e28e4fcc00ac468569abd51ed474a02c017ebdd3fd8b4176f.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D42047D9-38C2-4FD1-8337-F69C8F835A30}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C0BEBABF-1785-4075-8C4D-8FEE7833D3CD}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C0BEBABF-1785-4075-8C4D-8FEE7833D3CD}\TypeLib\ = "{D42047D9-38C2-4FD1-8337-F69C8F835A30}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0BEBABF-1785-4075-8C4D-8FEE7833D3CD}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DAF9F01C-30F0-4A52-AF52-E236961977F4}\ = "IEHlprObj Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C0BEBABF-1785-4075-8C4D-8FEE7833D3CD}\ = "IIEHlprObj"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0BEBABF-1785-4075-8C4D-8FEE7833D3CD}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IEHelper.IEHlprObj	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IEHelper.IEHlprObj\ = "IEHlprObj Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DAF9F01C-30F0-4A52-AF52-E236961977F4}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C0BEBABF-1785-4075-8C4D-8FEE7833D3CD}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C0BEBABF-1785-4075-8C4D-8FEE7833D3CD}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0BEBABF-1785-4075-8C4D-8FEE7833D3CD}\ = "IIEHlprObj"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DAF9F01C-30F0-4A52-AF52-E236961977F4}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D42047D9-38C2-4FD1-8337-F69C8F835A30}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IEHelper.IEHlprObj.1\CLSID\ = "{DAF9F01C-30F0-4A52-AF52-E236961977F4}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IEHelper.IEHlprObj\CLSID\ = "{DAF9F01C-30F0-4A52-AF52-E236961977F4}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DAF9F01C-30F0-4A52-AF52-E236961977F4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DAF9F01C-30F0-4A52-AF52-E236961977F4}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D42047D9-38C2-4FD1-8337-F69C8F835A30}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IEHelper.IEHlprObj.1\ = "IEHlprObj Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IEHelper.IEHlprObj.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IEHelper.IEHlprObj\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DAF9F01C-30F0-4A52-AF52-E236961977F4}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D42047D9-38C2-4FD1-8337-F69C8F835A30}\1.0\ = "IEHelper 1.0 Type Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D42047D9-38C2-4FD1-8337-F69C8F835A30}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DAF9F01C-30F0-4A52-AF52-E236961977F4}\TypeLib\ = "{D42047D9-38C2-4FD1-8337-F69C8F835A30}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D42047D9-38C2-4FD1-8337-F69C8F835A30}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IEHelper.IEHlprObj.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IEHelper.IEHlprObj\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IEHelper.IEHlprObj\CurVer\ = "IEHelper.IEHlprObj.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DAF9F01C-30F0-4A52-AF52-E236961977F4}\ProgID\ = "IEHelper.IEHlprObj.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DAF9F01C-30F0-4A52-AF52-E236961977F4}\VersionIndependentProgID\ = "IEHelper.IEHlprObj"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DAF9F01C-30F0-4A52-AF52-E236961977F4}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D42047D9-38C2-4FD1-8337-F69C8F835A30}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C0BEBABF-1785-4075-8C4D-8FEE7833D3CD}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C0BEBABF-1785-4075-8C4D-8FEE7833D3CD}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0BEBABF-1785-4075-8C4D-8FEE7833D3CD}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0BEBABF-1785-4075-8C4D-8FEE7833D3CD}\TypeLib\ = "{D42047D9-38C2-4FD1-8337-F69C8F835A30}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DAF9F01C-30F0-4A52-AF52-E236961977F4}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ee3e04e7169d3a0e28e4fcc00ac468569abd51ed474a02c017ebdd3fd8b4176f.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D42047D9-38C2-4FD1-8337-F69C8F835A30}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D42047D9-38C2-4FD1-8337-F69C8F835A30}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0BEBABF-1785-4075-8C4D-8FEE7833D3CD}\TypeLib\Version = "1.0"	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

regsvr32.exe

pid process

1360 regsvr32.exe

pid	process
1360	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 468 wrote to memory of 1360	468	regsvr32.exe	regsvr32.exe
PID 468 wrote to memory of 1360	468	regsvr32.exe	regsvr32.exe
PID 468 wrote to memory of 1360	468	regsvr32.exe	regsvr32.exe
PID 468 wrote to memory of 1360	468	regsvr32.exe	regsvr32.exe
PID 468 wrote to memory of 1360	468	regsvr32.exe	regsvr32.exe
PID 468 wrote to memory of 1360	468	regsvr32.exe	regsvr32.exe
PID 468 wrote to memory of 1360	468	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ee3e04e7169d3a0e28e4fcc00ac468569abd51ed474a02c017ebdd3fd8b4176f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:468

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\ee3e04e7169d3a0e28e4fcc00ac468569abd51ed474a02c017ebdd3fd8b4176f.dll
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1360

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/468-59-0x000007FEFB531000-0x000007FEFB533000-memory.dmp

Filesize
8KB

Download
memory/1360-60-0x0000000000000000-mapping.dmp

Download
memory/1360-61-0x0000000075051000-0x0000000075053000-memory.dmp

Filesize
8KB

Download
memory/1360-62-0x0000000010000000-0x00000000104A3000-memory.dmp

Filesize
4.6MB

Download
memory/1360-63-0x0000000000140000-0x0000000000142000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing