0d1c29f9674d7dd038221e8d3053b70f1e36bce54531eff08b0d122b3cdd8472

General

Target

0d1c29f9674d7dd038221e8d3053b70f1e36bce54531eff08b0d122b3cdd8472.exe
Size

1000KB
MD5

501c35c30856063578d5f66e21af9de8
SHA1

a1bbcfa137ac506b4d9b0af6ba71fa4d75c652f8
SHA256

0d1c29f9674d7dd038221e8d3053b70f1e36bce54531eff08b0d122b3cdd8472
SHA512

f26df8ad2b366901138a180a3a4800a4ad864a017bc2973dd44e04df6620f352ae3cb54c597b6980b934fd716b7733d6900abc48701433f19fae0f12b373cdd8

Score

7^/10

adware discovery spyware stealer

Malware Config

Signatures

Loads dropped DLL 2 IoCs

Processes:

0d1c29f9674d7dd038221e8d3053b70f1e36bce54531eff08b0d122b3cdd8472.exeregsvr32.exe

pid process

1948 0d1c29f9674d7dd038221e8d3053b70f1e36bce54531eff08b0d122b3cdd8472.exe
1936 regsvr32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Installs/modifies Browser Helper Object 2 TTPs
BHOs are DLL modules which act as plugins for Internet Explorer.
stealer adware

Modify Registry
T1112

Browser Extensions
T1176

Drops file in Program Files directory 22 IoCs

Processes:

0d1c29f9674d7dd038221e8d3053b70f1e36bce54531eff08b0d122b3cdd8472.exe

description	ioc	process
File created	C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta7334\ie\VideoPlayerV3beta7334.dll	0d1c29f9674d7dd038221e8d3053b70f1e36bce54531eff08b0d122b3cdd8472.exe
File opened for modification	C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta7334\ff\chrome	0d1c29f9674d7dd038221e8d3053b70f1e36bce54531eff08b0d122b3cdd8472.exe
File created	C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta7334\ff\chrome\content\ffVideoPlayerV3beta7334.js	0d1c29f9674d7dd038221e8d3053b70f1e36bce54531eff08b0d122b3cdd8472.exe
File opened for modification	C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta7334\ff\chrome\content\ffVideoPlayerV3beta7334.js	0d1c29f9674d7dd038221e8d3053b70f1e36bce54531eff08b0d122b3cdd8472.exe
File opened for modification	C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta7334\ff\chrome\content\icons\default\VideoPlayerV3beta7334_32.png	0d1c29f9674d7dd038221e8d3053b70f1e36bce54531eff08b0d122b3cdd8472.exe
File created	C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta7334\ff\chrome.manifest	0d1c29f9674d7dd038221e8d3053b70f1e36bce54531eff08b0d122b3cdd8472.exe
File created	C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta7334\ff\install.rdf	0d1c29f9674d7dd038221e8d3053b70f1e36bce54531eff08b0d122b3cdd8472.exe
File opened for modification	C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta7334\ff\chrome\content	0d1c29f9674d7dd038221e8d3053b70f1e36bce54531eff08b0d122b3cdd8472.exe
File created	C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta7334\ff\chrome\content\overlay.xul	0d1c29f9674d7dd038221e8d3053b70f1e36bce54531eff08b0d122b3cdd8472.exe
File opened for modification	C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta7334\ff\chrome\content\overlay.xul	0d1c29f9674d7dd038221e8d3053b70f1e36bce54531eff08b0d122b3cdd8472.exe
File created	C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta7334\uninstall.exe	0d1c29f9674d7dd038221e8d3053b70f1e36bce54531eff08b0d122b3cdd8472.exe
File created	C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta7334\ch\VideoPlayerV3beta7334.crx	0d1c29f9674d7dd038221e8d3053b70f1e36bce54531eff08b0d122b3cdd8472.exe
File opened for modification	C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta7334\ff\install.rdf	0d1c29f9674d7dd038221e8d3053b70f1e36bce54531eff08b0d122b3cdd8472.exe
File opened for modification	C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta7334\ff\chrome\content\icons\default	0d1c29f9674d7dd038221e8d3053b70f1e36bce54531eff08b0d122b3cdd8472.exe
File opened for modification	C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta7334\ch\VideoPlayerV3beta7334.crx	0d1c29f9674d7dd038221e8d3053b70f1e36bce54531eff08b0d122b3cdd8472.exe
File opened for modification	C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta7334\ff\chrome.manifest	0d1c29f9674d7dd038221e8d3053b70f1e36bce54531eff08b0d122b3cdd8472.exe
File created	C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta7334\ff\chrome\content\ffVideoPlayerV3beta7334ffaction.js	0d1c29f9674d7dd038221e8d3053b70f1e36bce54531eff08b0d122b3cdd8472.exe
File opened for modification	C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta7334\ff\chrome\content\ffVideoPlayerV3beta7334ffaction.js	0d1c29f9674d7dd038221e8d3053b70f1e36bce54531eff08b0d122b3cdd8472.exe
File opened for modification	C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta7334\ff\chrome\content\icons	0d1c29f9674d7dd038221e8d3053b70f1e36bce54531eff08b0d122b3cdd8472.exe
File created	C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta7334\ff\chrome\content\icons\Thumbs.db	0d1c29f9674d7dd038221e8d3053b70f1e36bce54531eff08b0d122b3cdd8472.exe
File opened for modification	C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta7334\ff\chrome\content\icons\Thumbs.db	0d1c29f9674d7dd038221e8d3053b70f1e36bce54531eff08b0d122b3cdd8472.exe
File created	C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta7334\ff\chrome\content\icons\default\VideoPlayerV3beta7334_32.png	0d1c29f9674d7dd038221e8d3053b70f1e36bce54531eff08b0d122b3cdd8472.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

0d1c29f9674d7dd038221e8d3053b70f1e36bce54531eff08b0d122b3cdd8472.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Approved Extensions	0d1c29f9674d7dd038221e8d3053b70f1e36bce54531eff08b0d122b3cdd8472.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Approved Extensions\{4f26c14e-7084-4b81-acc8-73fd924be71d} = 51667a6c4c1d3b1b5edd3651b421ef0eb4c733bd9309ab08	0d1c29f9674d7dd038221e8d3053b70f1e36bce54531eff08b0d122b3cdd8472.exe

Modifies registry class 36 IoCs

Processes:

regsvr32.exe0d1c29f9674d7dd038221e8d3053b70f1e36bce54531eff08b0d122b3cdd8472.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4f26c14e-7084-4b81-acc8-73fd924be71d}\ = "VideoPlayerV3beta7334"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BA6B7E8D-FAD2-4AEE-92DE-C2D3C1C11E39}\1.1\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BA6B7E8D-FAD2-4AEE-92DE-C2D3C1C11E39}\1.1\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C4A64D7E-4C9B-4498-894E-D8BE8342901B}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C4A64D7E-4C9B-4498-894E-D8BE8342901B}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4A64D7E-4C9B-4498-894E-D8BE8342901B}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4A64D7E-4C9B-4498-894E-D8BE8342901B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4f26c14e-7084-4b81-acc8-73fd924be71d}\ = "Video Player"	0d1c29f9674d7dd038221e8d3053b70f1e36bce54531eff08b0d122b3cdd8472.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4f26c14e-7084-4b81-acc8-73fd924be71d}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C4A64D7E-4C9B-4498-894E-D8BE8342901B}\ = "IVideoPlayerV3beta7334BHO"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BA6B7E8D-FAD2-4AEE-92DE-C2D3C1C11E39}\1.1\0\win32\ = "C:\\Program Files (x86)\\VideoPlayerV3\\VideoPlayerV3beta7334\\ie\\VideoPlayerV3beta7334.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BA6B7E8D-FAD2-4AEE-92DE-C2D3C1C11E39}\1.1\HELPDIR\ = "C:\\Program Files (x86)\\VideoPlayerV3\\VideoPlayerV3beta7334\\ie"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4A64D7E-4C9B-4498-894E-D8BE8342901B}\TypeLib\Version = "1.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4A64D7E-4C9B-4498-894E-D8BE8342901B}\TypeLib\ = "{BA6B7E8D-FAD2-4AEE-92DE-C2D3C1C11E39}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4f26c14e-7084-4b81-acc8-73fd924be71d}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4f26c14e-7084-4b81-acc8-73fd924be71d}\TypeLib\ = "{ba6b7e8d-fad2-4aee-92de-c2d3c1c11e39}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4f26c14e-7084-4b81-acc8-73fd924be71d}\Version\ = "1.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C4A64D7E-4C9B-4498-894E-D8BE8342901B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C4A64D7E-4C9B-4498-894E-D8BE8342901B}\TypeLib\ = "{BA6B7E8D-FAD2-4AEE-92DE-C2D3C1C11E39}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4f26c14e-7084-4b81-acc8-73fd924be71d}	0d1c29f9674d7dd038221e8d3053b70f1e36bce54531eff08b0d122b3cdd8472.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4f26c14e-7084-4b81-acc8-73fd924be71d}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4f26c14e-7084-4b81-acc8-73fd924be71d}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BA6B7E8D-FAD2-4AEE-92DE-C2D3C1C11E39}\1.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BA6B7E8D-FAD2-4AEE-92DE-C2D3C1C11E39}\1.1\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4A64D7E-4C9B-4498-894E-D8BE8342901B}\ = "IVideoPlayerV3beta7334BHO"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C4A64D7E-4C9B-4498-894E-D8BE8342901B}\TypeLib\Version = "1.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4f26c14e-7084-4b81-acc8-73fd924be71d}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4f26c14e-7084-4b81-acc8-73fd924be71d}\InprocServer32\ = "C:\\Program Files (x86)\\VideoPlayerV3\\VideoPlayerV3beta7334\\ie\\VideoPlayerV3beta7334.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4f26c14e-7084-4b81-acc8-73fd924be71d}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BA6B7E8D-FAD2-4AEE-92DE-C2D3C1C11E39}\1.1\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C4A64D7E-4C9B-4498-894E-D8BE8342901B}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BA6B7E8D-FAD2-4AEE-92DE-C2D3C1C11E39}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BA6B7E8D-FAD2-4AEE-92DE-C2D3C1C11E39}\1.1\ = "VideoPlayerV3beta7334Lib"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BA6B7E8D-FAD2-4AEE-92DE-C2D3C1C11E39}\1.1\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4A64D7E-4C9B-4498-894E-D8BE8342901B}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4A64D7E-4C9B-4498-894E-D8BE8342901B}\TypeLib	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

0d1c29f9674d7dd038221e8d3053b70f1e36bce54531eff08b0d122b3cdd8472.exe

pid	process
1948	0d1c29f9674d7dd038221e8d3053b70f1e36bce54531eff08b0d122b3cdd8472.exe
1948	0d1c29f9674d7dd038221e8d3053b70f1e36bce54531eff08b0d122b3cdd8472.exe
1948	0d1c29f9674d7dd038221e8d3053b70f1e36bce54531eff08b0d122b3cdd8472.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

0d1c29f9674d7dd038221e8d3053b70f1e36bce54531eff08b0d122b3cdd8472.exe

description	pid	process	target process
PID 1948 wrote to memory of 1936	1948	0d1c29f9674d7dd038221e8d3053b70f1e36bce54531eff08b0d122b3cdd8472.exe	regsvr32.exe
PID 1948 wrote to memory of 1936	1948	0d1c29f9674d7dd038221e8d3053b70f1e36bce54531eff08b0d122b3cdd8472.exe	regsvr32.exe
PID 1948 wrote to memory of 1936	1948	0d1c29f9674d7dd038221e8d3053b70f1e36bce54531eff08b0d122b3cdd8472.exe	regsvr32.exe
PID 1948 wrote to memory of 1936	1948	0d1c29f9674d7dd038221e8d3053b70f1e36bce54531eff08b0d122b3cdd8472.exe	regsvr32.exe
PID 1948 wrote to memory of 1936	1948	0d1c29f9674d7dd038221e8d3053b70f1e36bce54531eff08b0d122b3cdd8472.exe	regsvr32.exe
PID 1948 wrote to memory of 1936	1948	0d1c29f9674d7dd038221e8d3053b70f1e36bce54531eff08b0d122b3cdd8472.exe	regsvr32.exe
PID 1948 wrote to memory of 1936	1948	0d1c29f9674d7dd038221e8d3053b70f1e36bce54531eff08b0d122b3cdd8472.exe	regsvr32.exe

C:\Users\Admin\AppData\Local\Temp\0d1c29f9674d7dd038221e8d3053b70f1e36bce54531eff08b0d122b3cdd8472.exe
"C:\Users\Admin\AppData\Local\Temp\0d1c29f9674d7dd038221e8d3053b70f1e36bce54531eff08b0d122b3cdd8472.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1948

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 "C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta7334\ie\VideoPlayerV3beta7334.dll" /s
2⤵
- Loads dropped DLL
- Modifies registry class
PID:1936

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta7334\ie\VideoPlayerV3beta7334.dll
Filesize
85KB

MD5
474430f69405c07f95f75feee5a50383

SHA1
63e8550d91e5b99776b5841b5568173b67f469fc

SHA256
41855f8991ac3b7df9c4fe78723ffafc4eb4c5e332a04d91efbc8f8f3e52f127

SHA512
85051703f3b2efd0815b11b3b9376efc2c3a69cf96d16fbcd11b7aeb4a9d7eb7a861a709c5a65a5cc4eddf6eea5c090c5559ddf76a274f01064f1fdc6b9ca0be

Download Submit
\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta7334\ie\VideoPlayerV3beta7334.dll
Filesize
85KB

MD5
474430f69405c07f95f75feee5a50383

SHA1
63e8550d91e5b99776b5841b5568173b67f469fc

SHA256
41855f8991ac3b7df9c4fe78723ffafc4eb4c5e332a04d91efbc8f8f3e52f127

SHA512
85051703f3b2efd0815b11b3b9376efc2c3a69cf96d16fbcd11b7aeb4a9d7eb7a861a709c5a65a5cc4eddf6eea5c090c5559ddf76a274f01064f1fdc6b9ca0be

Download Submit
\Users\Admin\AppData\Local\Temp\nsiEA8F.tmp\aminsis.dll
Filesize
822KB

MD5
678a22e736f3bfa0d74ae2b1133a4c77

SHA1
964bbaf745a2b82bc23de0879b221bf6551b7283

SHA256
c5799cbab76464874e857fbd16600c4b33298d809f4ef27a07b21f8724614f14

SHA512
058fa4ee5272623fcc9267958ad6d7befeb74efa079b8fa8e461830ec05b96ed933014360eac5ab61eff890b8ec1ea268d8b2781999515ed27ba0333751baa4a

Download Submit
memory/1936-56-0x0000000000000000-mapping.dmp

Download
memory/1948-54-0x0000000076721000-0x0000000076723000-memory.dmp

Filesize
8KB

Download

pid	process
1948	0d1c29f9674d7dd038221e8d3053b70f1e36bce54531eff08b0d122b3cdd8472.exe
1936	regsvr32.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads