d3e08737dbca961b90c1da8a7cdc162d5fcee69a927c0ad0c24bcb2464bcb7e8

General

Target

d3e08737dbca961b90c1da8a7cdc162d5fcee69a927c0ad0c24bcb2464bcb7e8.dll
Size

19KB
MD5

2cca5e64480f406dae66f5d6ec27330e
SHA1

8da803b72806ef3716a741492eea4bb1761b2183
SHA256

d3e08737dbca961b90c1da8a7cdc162d5fcee69a927c0ad0c24bcb2464bcb7e8
SHA512

e19946116006f7889dc9bd31370cb9b761a44d7ba86cfe0356ee0801558e6a21f9cb9c1e129c59ab6a8bc043b34de585b7ab9e7fe454d36dba0d35081b707a34

Score

6^/10

adware persistence stealer

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\IExplore adviser = "Regsvr32.exe /s C:\\Users\\Admin\\AppData\\Local\\Temp\\d3e08737dbca961b90c1da8a7cdc162d5fcee69a927c0ad0c24bcb2464bcb7e8.dll"	regsvr32.exe

Installs/modifies Browser Helper Object 2 TTPs
BHOs are DLL modules which act as plugins for Internet Explorer.
stealer adware

Modify Registry
T1112

Browser Extensions
T1176

Modifies registry class 6 IoCs

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9C5875B8-93F3-429D-FF34-660B206D897A}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9C5875B8-93F3-429D-FF34-660B206D897A}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d3e08737dbca961b90c1da8a7cdc162d5fcee69a927c0ad0c24bcb2464bcb7e8.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9C5875B8-93F3-429D-FF34-660B206D897A}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9C5875B8-93F3-429D-FF34-660B206D897A}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1836 wrote to memory of 1660	1836	regsvr32.exe	regsvr32.exe
PID 1836 wrote to memory of 1660	1836	regsvr32.exe	regsvr32.exe
PID 1836 wrote to memory of 1660	1836	regsvr32.exe	regsvr32.exe
PID 1836 wrote to memory of 1660	1836	regsvr32.exe	regsvr32.exe
PID 1836 wrote to memory of 1660	1836	regsvr32.exe	regsvr32.exe
PID 1836 wrote to memory of 1660	1836	regsvr32.exe	regsvr32.exe
PID 1836 wrote to memory of 1660	1836	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d3e08737dbca961b90c1da8a7cdc162d5fcee69a927c0ad0c24bcb2464bcb7e8.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1836

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\d3e08737dbca961b90c1da8a7cdc162d5fcee69a927c0ad0c24bcb2464bcb7e8.dll
2⤵
- Adds Run key to start application
- Modifies registry class
PID:1660

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1660-55-0x0000000000000000-mapping.dmp

Download
memory/1660-56-0x0000000076421000-0x0000000076423000-memory.dmp

Filesize
8KB

Download
memory/1836-54-0x000007FEFBB11000-0x000007FEFBB13000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads