a5d832e86570145557e81d646bfbd37984c7040d3d45fe51dd5587cafb001438

Analysis

max time kernel
38s
max time network
43s
platform
windows7_x64
resource
win7-20220414-en
submitted
15-04-2022 13:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a5d832e86570145557e81d646bfbd37984c7040d3d45fe51dd5587cafb001438.dll
Size

49KB
MD5

b2b910809e1bddd88407f3ecb5e58a5e
SHA1

b5abcbf62fef039bf93395d7e4687120d5211eb3
SHA256

a5d832e86570145557e81d646bfbd37984c7040d3d45fe51dd5587cafb001438
SHA512

05536d5c76067b5502fbf7b19820ddf7352813d59e57032cb2319df0e7450020ca0499dd7e23488266c06e869cc97f3d29f356719928dac10eb1aa5255c0f0cd

Score

6^/10

adware stealer

Malware Config

Signatures

Installs/modifies Browser Helper Object 2 TTPs
BHOs are DLL modules which act as plugins for Internet Explorer.
stealer adware

Modify Registry
T1112

Browser Extensions
T1176
Drops file in System32 directory 2 IoCs

Processes:

regsvr32.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\stdole3.tlb regsvr32.exe
File created C:\Windows\SysWOW64\stdole3.tlb regsvr32.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\stdole3.tlb	regsvr32.exe
File created	C:\Windows\SysWOW64\stdole3.tlb	regsvr32.exe

Modifies registry class 5 IoCs

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6AB7158B-4BFF-4160-AD7D-4D622DF548CF}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6AB7158B-4BFF-4160-AD7D-4D622DF548CF}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a5d832e86570145557e81d646bfbd37984c7040d3d45fe51dd5587cafb001438.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6AB7158B-4BFF-4160-AD7D-4D622DF548CF}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6AB7158B-4BFF-4160-AD7D-4D622DF548CF}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6AB7158B-4BFF-4160-AD7D-4D622DF548CF}\ = "Nothing"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 860 wrote to memory of 1972	860	regsvr32.exe	regsvr32.exe
PID 860 wrote to memory of 1972	860	regsvr32.exe	regsvr32.exe
PID 860 wrote to memory of 1972	860	regsvr32.exe	regsvr32.exe
PID 860 wrote to memory of 1972	860	regsvr32.exe	regsvr32.exe
PID 860 wrote to memory of 1972	860	regsvr32.exe	regsvr32.exe
PID 860 wrote to memory of 1972	860	regsvr32.exe	regsvr32.exe
PID 860 wrote to memory of 1972	860	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a5d832e86570145557e81d646bfbd37984c7040d3d45fe51dd5587cafb001438.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:860

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\a5d832e86570145557e81d646bfbd37984c7040d3d45fe51dd5587cafb001438.dll
2⤵
- Drops file in System32 directory
- Modifies registry class
PID:1972

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/860-54-0x000007FEFBBD1000-0x000007FEFBBD3000-memory.dmp

Filesize
8KB

Download
memory/1972-55-0x0000000000000000-mapping.dmp

Download
memory/1972-56-0x0000000076191000-0x0000000076193000-memory.dmp

Filesize
8KB

Download