04110139f3e883d76c24824ed486d81a3326bbf0bdfe2e27693d7ebedd28a70e

General

Target

04110139f3e883d76c24824ed486d81a3326bbf0bdfe2e27693d7ebedd28a70e.dll
Size

607KB
MD5

c6533375a497fa461ff839fb4a091594
SHA1

74fc2ad362a6b7ca6791b36c4916688fe06dc883
SHA256

04110139f3e883d76c24824ed486d81a3326bbf0bdfe2e27693d7ebedd28a70e
SHA512

b371f7f45798dd80df0b0eb946c4adc3c81fea92925fe5153e46e9a6434499e45224ec9de6d660d42945b8fad1b4d6220c405aaa6b6c607cc755411ba05e1efd

Score

6^/10

adware stealer

Malware Config

Signatures

Installs/modifies Browser Helper Object 2 TTPs
BHOs are DLL modules which act as plugins for Internet Explorer.
stealer adware

Modify Registry
T1112

Browser Extensions
T1176

Modifies registry class 11 IoCs

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\04110139f3e883d76c24824ed486d81a3326bbf0bdfe2e27693d7ebedd28a70e.iwc	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\04110139f3e883d76c24824ed486d81a3326bbf0bdfe2e27693d7ebedd28a70e.iwc\Clsid\ = "{CC01FC6C-7C33-EF32-5FFA-B317BE19D484}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-7C33-EF32-5FFA-B317BE19D484}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-7C33-EF32-5FFA-B317BE19D484}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-7C33-EF32-5FFA-B317BE19D484}\ = "iwc"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-7C33-EF32-5FFA-B317BE19D484}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\04110139f3e883d76c24824ed486d81a3326bbf0bdfe2e27693d7ebedd28a70e.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-7C33-EF32-5FFA-B317BE19D484}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-7C33-EF32-5FFA-B317BE19D484}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\04110139f3e883d76c24824ed486d81a3326bbf0bdfe2e27693d7ebedd28a70e.iwc\ = "iwc"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\04110139f3e883d76c24824ed486d81a3326bbf0bdfe2e27693d7ebedd28a70e.iwc\Clsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-7C33-EF32-5FFA-B317BE19D484}\ProgID\ = "04110139f3e883d76c24824ed486d81a3326bbf0bdfe2e27693d7ebedd28a70e.iwc"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1064 wrote to memory of 1636	1064	regsvr32.exe	regsvr32.exe
PID 1064 wrote to memory of 1636	1064	regsvr32.exe	regsvr32.exe
PID 1064 wrote to memory of 1636	1064	regsvr32.exe	regsvr32.exe
PID 1064 wrote to memory of 1636	1064	regsvr32.exe	regsvr32.exe
PID 1064 wrote to memory of 1636	1064	regsvr32.exe	regsvr32.exe
PID 1064 wrote to memory of 1636	1064	regsvr32.exe	regsvr32.exe
PID 1064 wrote to memory of 1636	1064	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\04110139f3e883d76c24824ed486d81a3326bbf0bdfe2e27693d7ebedd28a70e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1064

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\04110139f3e883d76c24824ed486d81a3326bbf0bdfe2e27693d7ebedd28a70e.dll
2⤵
- Modifies registry class
PID:1636

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1064-54-0x000007FEFBA81000-0x000007FEFBA83000-memory.dmp

Filesize
8KB

Download
memory/1636-55-0x0000000000000000-mapping.dmp

Download
memory/1636-56-0x0000000075DE1000-0x0000000075DE3000-memory.dmp

Filesize
8KB

Download
memory/1636-57-0x00000000007A0000-0x000000000083D000-memory.dmp

Filesize
628KB

Download

Analysis

Sharing