38ce96f61c0137d12adb8789c3b1d803634776dedfcaa7896692ecba2f6b6f70

General

Target

38ce96f61c0137d12adb8789c3b1d803634776dedfcaa7896692ecba2f6b6f70.dll
Size

68KB
MD5

b34df63fa32b017d2879b101cbc85c83
SHA1

936a82ce8d443e3824f990e64bfbe9e67ab46d68
SHA256

38ce96f61c0137d12adb8789c3b1d803634776dedfcaa7896692ecba2f6b6f70
SHA512

36f8e28367d5c168bb500498be3256b45626ca2367d606e815662b1091bc25a7e8885cf04950e285bb251ff682b159de55d7dfa1324607a19e7895bb8ae18937

Score

6^/10

adware stealer

Malware Config

Signatures

Installs/modifies Browser Helper Object 2 TTPs
BHOs are DLL modules which act as plugins for Internet Explorer.
stealer adware

Modify Registry
T1112

Browser Extensions
T1176

Modifies registry class 60 IoCs

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BACA5B3B-DD57-4E62-B986-9A5677FBF001}\TypeLib\ = "{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8853B70A-2C8B-4C82-BDD9-ED2675076DEF}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3561FA4B-C6C0-4FF0-A4A4-F1528F79E1A8}\ = "IBho"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3561FA4B-C6C0-4FF0-A4A4-F1528F79E1A8}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BhoNew.Bho\ = "IE Optimizer"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BACA5B3B-DD57-4E62-B986-9A5677FBF001}\VersionIndependentProgID\ = "BhoNew.Bho"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8853B70A-2C8B-4C82-BDD9-ED2675076DEF}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BACA5B3B-DD57-4E62-B986-9A5677FBF001}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8853B70A-2C8B-4C82-BDD9-ED2675076DEF}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8853B70A-2C8B-4C82-BDD9-ED2675076DEF}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3561FA4B-C6C0-4FF0-A4A4-F1528F79E1A8}\TypeLib\ = "{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BACA5B3B-DD57-4E62-B986-9A5677FBF001}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BACA5B3B-DD57-4E62-B986-9A5677FBF001}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3561FA4B-C6C0-4FF0-A4A4-F1528F79E1A8}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8853B70A-2C8B-4C82-BDD9-ED2675076DEF}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8853B70A-2C8B-4C82-BDD9-ED2675076DEF}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BACA5B3B-DD57-4E62-B986-9A5677FBF001}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\38CE96~1.DLL"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BACA5B3B-DD57-4E62-B986-9A5677FBF001}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8853B70A-2C8B-4C82-BDD9-ED2675076DEF}\TypeLib\ = "{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3561FA4B-C6C0-4FF0-A4A4-F1528F79E1A8}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BhoNew.Bho	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BACA5B3B-DD57-4E62-B986-9A5677FBF001}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3561FA4B-C6C0-4FF0-A4A4-F1528F79E1A8}\ = "IBho"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BACA5B3B-DD57-4E62-B986-9A5677FBF001}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8853B70A-2C8B-4C82-BDD9-ED2675076DEF}\ = "_IBhoEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BhoNew.Bho\CLSID\ = "{BACA5B3B-DD57-4E62-B986-9A5677FBF001}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8853B70A-2C8B-4C82-BDD9-ED2675076DEF}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8853B70A-2C8B-4C82-BDD9-ED2675076DEF}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3561FA4B-C6C0-4FF0-A4A4-F1528F79E1A8}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3561FA4B-C6C0-4FF0-A4A4-F1528F79E1A8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3561FA4B-C6C0-4FF0-A4A4-F1528F79E1A8}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3561FA4B-C6C0-4FF0-A4A4-F1528F79E1A8}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0\ = "Type Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\38ce96f61c0137d12adb8789c3b1d803634776dedfcaa7896692ecba2f6b6f70.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IE32\CLSID\ = "{BACA5B3B-DD57-4E62-B986-9A5677FBF001}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BhoNew.Bho\CurVer\ = "IE32"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8853B70A-2C8B-4C82-BDD9-ED2675076DEF}\TypeLib\ = "{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3561FA4B-C6C0-4FF0-A4A4-F1528F79E1A8}\TypeLib\ = "{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IE32\ = "IE Optimizer"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BhoNew.Bho\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BACA5B3B-DD57-4E62-B986-9A5677FBF001}\ = "IE Optimizer"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BACA5B3B-DD57-4E62-B986-9A5677FBF001}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8853B70A-2C8B-4C82-BDD9-ED2675076DEF}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3561FA4B-C6C0-4FF0-A4A4-F1528F79E1A8}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IE32\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BhoNew.Bho\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BACA5B3B-DD57-4E62-B986-9A5677FBF001}\ProgID\ = "IE32"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3561FA4B-C6C0-4FF0-A4A4-F1528F79E1A8}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8853B70A-2C8B-4C82-BDD9-ED2675076DEF}\ = "_IBhoEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8853B70A-2C8B-4C82-BDD9-ED2675076DEF}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3561FA4B-C6C0-4FF0-A4A4-F1528F79E1A8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IE32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0\0	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 3416 wrote to memory of 4740	3416	regsvr32.exe	regsvr32.exe
PID 3416 wrote to memory of 4740	3416	regsvr32.exe	regsvr32.exe
PID 3416 wrote to memory of 4740	3416	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\38ce96f61c0137d12adb8789c3b1d803634776dedfcaa7896692ecba2f6b6f70.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3416

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\38ce96f61c0137d12adb8789c3b1d803634776dedfcaa7896692ecba2f6b6f70.dll
2⤵
- Modifies registry class
PID:4740

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4740-130-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing