8e2538a244ae726aeefdd4b6af84fe587d2a0070d5dfa8d27da73b2e74e89d65

General

Target

8e2538a244ae726aeefdd4b6af84fe587d2a0070d5dfa8d27da73b2e74e89d65.dll
Size

216KB
MD5

7935bc141a35f7978a4a2014ba5f10b7
SHA1

c0bfd3ec7ba8d8223f5e2433c8603060d81b19d3
SHA256

8e2538a244ae726aeefdd4b6af84fe587d2a0070d5dfa8d27da73b2e74e89d65
SHA512

b4d0e8f860b18d409f7e6db9e4bd6b7419d0b2e62bbd67d2fa29f244d039f4f6076e33042ea55a67829737120449fd6088b586d3286170af885181252786a448

Score

6^/10

adware stealer

Malware Config

Signatures

Installs/modifies Browser Helper Object 2 TTPs
BHOs are DLL modules which act as plugins for Internet Explorer.
stealer adware

Modify Registry
T1112

Browser Extensions
T1176

Modifies registry class 56 IoCs

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{21157F64-2CA3-48FC-B33F-4B010D58B049}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A1B37CE5-DD64-4AE2-953C-F1A75CAC1E59}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB2963E8-6425-4723-809D-7D8785740590}\VersionIndependentProgID\ = "RDL.Rolex"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6F9ED24F-A59A-4791-8A25-F9121C29187A}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1B37CE5-DD64-4AE2-953C-F1A75CAC1E59}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6F9ED24F-A59A-4791-8A25-F9121C29187A}\1.0\ = "afnv TL"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6F9ED24F-A59A-4791-8A25-F9121C29187A}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{21157F64-2CA3-48FC-B33F-4B010D58B049}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A1B37CE5-DD64-4AE2-953C-F1A75CAC1E59}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A1B37CE5-DD64-4AE2-953C-F1A75CAC1E59}\TypeLib\ = "{6F9ED24F-A59A-4791-8A25-F9121C29187A}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB2963E8-6425-4723-809D-7D8785740590}\ProgID\ = "RDL.Rolex"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB2963E8-6425-4723-809D-7D8785740590}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSVPS.MSVPSApp	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{21157F64-2CA3-48FC-B33F-4B010D58B049}\TypeLib\ = "{6F9ED24F-A59A-4791-8A25-F9121C29187A}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A1B37CE5-DD64-4AE2-953C-F1A75CAC1E59}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1B37CE5-DD64-4AE2-953C-F1A75CAC1E59}\TypeLib\ = "{6F9ED24F-A59A-4791-8A25-F9121C29187A}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1B37CE5-DD64-4AE2-953C-F1A75CAC1E59}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{21157F64-2CA3-48FC-B33F-4B010D58B049}\TypeLib\ = "{6F9ED24F-A59A-4791-8A25-F9121C29187A}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6F9ED24F-A59A-4791-8A25-F9121C29187A}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{21157F64-2CA3-48FC-B33F-4B010D58B049}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{21157F64-2CA3-48FC-B33F-4B010D58B049}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSVPS.MSVPSApp\ = "RDL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSVPS.MSVPSApp\CurVer\ = "RDL.Rolex"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB2963E8-6425-4723-809D-7D8785740590}\ = "RDL Rolex"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB2963E8-6425-4723-809D-7D8785740590}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1B37CE5-DD64-4AE2-953C-F1A75CAC1E59}\ = "Iafnv"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSVPS.MSVPSApp\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6F9ED24F-A59A-4791-8A25-F9121C29187A}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8e2538a244ae726aeefdd4b6af84fe587d2a0070d5dfa8d27da73b2e74e89d65.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1B37CE5-DD64-4AE2-953C-F1A75CAC1E59}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB2963E8-6425-4723-809D-7D8785740590}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB2963E8-6425-4723-809D-7D8785740590}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8e2538a244ae726aeefdd4b6af84fe587d2a0070d5dfa8d27da73b2e74e89d65.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6F9ED24F-A59A-4791-8A25-F9121C29187A}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1B37CE5-DD64-4AE2-953C-F1A75CAC1E59}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB2963E8-6425-4723-809D-7D8785740590}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB2963E8-6425-4723-809D-7D8785740590}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6F9ED24F-A59A-4791-8A25-F9121C29187A}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6F9ED24F-A59A-4791-8A25-F9121C29187A}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{21157F64-2CA3-48FC-B33F-4B010D58B049}\ = "_IafnvEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{21157F64-2CA3-48FC-B33F-4B010D58B049}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB2963E8-6425-4723-809D-7D8785740590}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6F9ED24F-A59A-4791-8A25-F9121C29187A}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{21157F64-2CA3-48FC-B33F-4B010D58B049}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{21157F64-2CA3-48FC-B33F-4B010D58B049}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{21157F64-2CA3-48FC-B33F-4B010D58B049}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A1B37CE5-DD64-4AE2-953C-F1A75CAC1E59}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A1B37CE5-DD64-4AE2-953C-F1A75CAC1E59}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB2963E8-6425-4723-809D-7D8785740590}\TypeLib\ = "{6F9ED24F-A59A-4791-8A25-F9121C29187A}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6F9ED24F-A59A-4791-8A25-F9121C29187A}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{21157F64-2CA3-48FC-B33F-4B010D58B049}\ = "_IafnvEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSVPS.MSVPSApp\CLSID\ = "{EB2963E8-6425-4723-809D-7D8785740590}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1B37CE5-DD64-4AE2-953C-F1A75CAC1E59}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSVPS.MSVPSApp\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB2963E8-6425-4723-809D-7D8785740590}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{21157F64-2CA3-48FC-B33F-4B010D58B049}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{21157F64-2CA3-48FC-B33F-4B010D58B049}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A1B37CE5-DD64-4AE2-953C-F1A75CAC1E59}\ = "Iafnv"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1876 wrote to memory of 4972	1876	regsvr32.exe	regsvr32.exe
PID 1876 wrote to memory of 4972	1876	regsvr32.exe	regsvr32.exe
PID 1876 wrote to memory of 4972	1876	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8e2538a244ae726aeefdd4b6af84fe587d2a0070d5dfa8d27da73b2e74e89d65.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1876

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\8e2538a244ae726aeefdd4b6af84fe587d2a0070d5dfa8d27da73b2e74e89d65.dll
2⤵
- Modifies registry class
PID:4972

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4972-130-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing