8526ac0597c18455b636ab661b1f880a2f5956bb52404397c5e4f1a7ffc848b4

Analysis

max time kernel
180s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 22:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8526ac0597c18455b636ab661b1f880a2f5956bb52404397c5e4f1a7ffc848b4.exe
Size

2.1MB
MD5

df303ebee65894547792468eb3fa8dec
SHA1

1cf5cc554b18c382db41e285efd6df59c8d0fc9d
SHA256

8526ac0597c18455b636ab661b1f880a2f5956bb52404397c5e4f1a7ffc848b4
SHA512

730e3cf211452cca642be2664124a2f5d77fc35da46d9c004906d7be50a1b69557b4adc654198be34dd663711e64f707aaab735189dd8060c9951f3e5db0ff7b
SSDEEP

49152:h1OsmPtqGqK2M8f3h4UO2sEYYQvLZwQE5m4o+:h1OxHoxLYYaS

Score

8^/10

adware discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4308	h0JwnQeLGr7Mbey.exe

Loads dropped DLL 3 IoCs

pid	Process
4308	h0JwnQeLGr7Mbey.exe
2004	regsvr32.exe
2232	regsvr32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\behgnlpnoikakicgikpgmhjflldfnjak\1.0\manifest.json	h0JwnQeLGr7Mbey.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\behgnlpnoikakicgikpgmhjflldfnjak\1.0\manifest.json	h0JwnQeLGr7Mbey.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\behgnlpnoikakicgikpgmhjflldfnjak\1.0\manifest.json	h0JwnQeLGr7Mbey.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\behgnlpnoikakicgikpgmhjflldfnjak\1.0\manifest.json	h0JwnQeLGr7Mbey.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\behgnlpnoikakicgikpgmhjflldfnjak\1.0\manifest.json	h0JwnQeLGr7Mbey.exe

Installs/modifies Browser Helper Object 2 TTPs 9 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\	h0JwnQeLGr7Mbey.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	h0JwnQeLGr7Mbey.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	h0JwnQeLGr7Mbey.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{DBC80044-A445-435B-BC74-9C25C1C588A9}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	h0JwnQeLGr7Mbey.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}	regsvr32.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\YoUtuebeAdBiloCKKeo\l6oX9pZTCoVoNv.dll	h0JwnQeLGr7Mbey.exe
File opened for modification	C:\Program Files (x86)\YoUtuebeAdBiloCKKeo\l6oX9pZTCoVoNv.dll	h0JwnQeLGr7Mbey.exe
File created	C:\Program Files (x86)\YoUtuebeAdBiloCKKeo\l6oX9pZTCoVoNv.tlb	h0JwnQeLGr7Mbey.exe
File opened for modification	C:\Program Files (x86)\YoUtuebeAdBiloCKKeo\l6oX9pZTCoVoNv.tlb	h0JwnQeLGr7Mbey.exe
File created	C:\Program Files (x86)\YoUtuebeAdBiloCKKeo\l6oX9pZTCoVoNv.dat	h0JwnQeLGr7Mbey.exe
File opened for modification	C:\Program Files (x86)\YoUtuebeAdBiloCKKeo\l6oX9pZTCoVoNv.dat	h0JwnQeLGr7Mbey.exe
File created	C:\Program Files (x86)\YoUtuebeAdBiloCKKeo\l6oX9pZTCoVoNv.x64.dll	h0JwnQeLGr7Mbey.exe
File opened for modification	C:\Program Files (x86)\YoUtuebeAdBiloCKKeo\l6oX9pZTCoVoNv.x64.dll	h0JwnQeLGr7Mbey.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4632 wrote to memory of 4308	4632	8526ac0597c18455b636ab661b1f880a2f5956bb52404397c5e4f1a7ffc848b4.exe	82
PID 4632 wrote to memory of 4308	4632	8526ac0597c18455b636ab661b1f880a2f5956bb52404397c5e4f1a7ffc848b4.exe	82
PID 4632 wrote to memory of 4308	4632	8526ac0597c18455b636ab661b1f880a2f5956bb52404397c5e4f1a7ffc848b4.exe	82
PID 4308 wrote to memory of 2004	4308	h0JwnQeLGr7Mbey.exe	83
PID 4308 wrote to memory of 2004	4308	h0JwnQeLGr7Mbey.exe	83
PID 4308 wrote to memory of 2004	4308	h0JwnQeLGr7Mbey.exe	83
PID 2004 wrote to memory of 2232	2004	regsvr32.exe	84
PID 2004 wrote to memory of 2232	2004	regsvr32.exe	84

C:\Users\Admin\AppData\Local\Temp\8526ac0597c18455b636ab661b1f880a2f5956bb52404397c5e4f1a7ffc848b4.exe
"C:\Users\Admin\AppData\Local\Temp\8526ac0597c18455b636ab661b1f880a2f5956bb52404397c5e4f1a7ffc848b4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Users\Admin\AppData\Local\Temp\7zS5D24.tmp\h0JwnQeLGr7Mbey.exe
  .\h0JwnQeLGr7Mbey.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:4308
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Program Files (x86)\YoUtuebeAdBiloCKKeo\l6oX9pZTCoVoNv.x64.dll"
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2004
  - - C:\Windows\system32\regsvr32.exe
      /s "C:\Program Files (x86)\YoUtuebeAdBiloCKKeo\l6oX9pZTCoVoNv.x64.dll"
      4⤵
      Loads dropped DLL
      Installs/modifies Browser Helper Object
      PID:2232

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\YoUtuebeAdBiloCKKeo\l6oX9pZTCoVoNv.dat

Filesize
6KB

MD5
86c1dbd33c3fec534bd135a9837ce10a

SHA1
588f8e114bf085870678f38b3a192ce14f250462

SHA256
cd0d8e74cf5bde5f052c576b59e4e36f6bf26d713c127df6eb12921b5fb67132

SHA512
b548d3bbefba89213aabfbbe0225161f1cdb38baf3c4ad1bedb96202672f8a0be317a61222c113c0aac27c659163a169c04fe08f640266c2b58edce1e0ed2ea4

Download Submit
C:\Program Files (x86)\YoUtuebeAdBiloCKKeo\l6oX9pZTCoVoNv.dll

Filesize
618KB

MD5
9e56f8bd63dc95894be8b9e660696f1c

SHA1
2efcb8fc0ce33f2ada28fb2a6a17ec43813f80cb

SHA256
93186596d2312706d0623df3c9b9dfdea35546d5506b20216d2a7efeb1d8d79a

SHA512
e52fa89e7cf8ed7419a5f410f6bf46a19695727f19f8eebd714dee9d6f8a9036acc528cd6b0033f70f11a04e18746b814ee2dc494f2fc82db104a876b479d827

Download Submit
C:\Program Files (x86)\YoUtuebeAdBiloCKKeo\l6oX9pZTCoVoNv.x64.dll

Filesize
698KB

MD5
4f474d78d3944242daf1069b024ba83c

SHA1
0ef8ee373b77bf05e3c0de0a66dd4d8589dff7d9

SHA256
935dfff0607280f142a69b4e109ac34ebabca578240d9c66c1561fc67ae4a1a8

SHA512
1da43bff1edf956a365200a4092a7647c0054bf6196155c5b2e2659c12d6d6adb43db6aed503cace12b8c97aba3343abddc34acdf1f663eef667eebc9153f6a2

Download Submit
C:\Program Files (x86)\YoUtuebeAdBiloCKKeo\l6oX9pZTCoVoNv.x64.dll

Filesize
698KB

MD5
4f474d78d3944242daf1069b024ba83c

SHA1
0ef8ee373b77bf05e3c0de0a66dd4d8589dff7d9

SHA256
935dfff0607280f142a69b4e109ac34ebabca578240d9c66c1561fc67ae4a1a8

SHA512
1da43bff1edf956a365200a4092a7647c0054bf6196155c5b2e2659c12d6d6adb43db6aed503cace12b8c97aba3343abddc34acdf1f663eef667eebc9153f6a2

Download Submit
C:\Program Files (x86)\YoUtuebeAdBiloCKKeo\l6oX9pZTCoVoNv.x64.dll

Filesize
698KB

MD5
4f474d78d3944242daf1069b024ba83c

SHA1
0ef8ee373b77bf05e3c0de0a66dd4d8589dff7d9

SHA256
935dfff0607280f142a69b4e109ac34ebabca578240d9c66c1561fc67ae4a1a8

SHA512
1da43bff1edf956a365200a4092a7647c0054bf6196155c5b2e2659c12d6d6adb43db6aed503cace12b8c97aba3343abddc34acdf1f663eef667eebc9153f6a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5D24.tmp\behgnlpnoikakicgikpgmhjflldfnjak\background.html

Filesize
146B

MD5
ce36c1e29ab9c9a6e192d2ec5f619c93

SHA1
c738b6e526c8ca5f6ac881b39786b69b5523409d

SHA256
2e71b1f464f7e0cf9b5ce0491fb6b1782e4f2e1a3f1d7f2c202476912bdec1fa

SHA512
612c3f00733eb8e0b8d4d1f1dbd5c432f31ea28b345f361d5f64f95403e5bfbffe6b753c04c346806600f99d59623ea89497efcfe478477ec926e21b250b185d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5D24.tmp\behgnlpnoikakicgikpgmhjflldfnjak\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5D24.tmp\behgnlpnoikakicgikpgmhjflldfnjak\goGp457TG.js

Filesize
5KB

MD5
6be357315873577a8d290d5f92fe9cd9

SHA1
5bd4e9bb27564dfc52636f1dc86519082d1be622

SHA256
cda91416d170e0dfd31c71ff950492653ecdfa9f59475db8b4e6fb1aca57028c

SHA512
c7be28e2161ec4e1b8d6189a74a9e6b57951d3d01c6d1c710998a242a8cebb56cc17f3a13dc832a0d0c0fa83a108a29272290d447eab58885a674f66487e6ea3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5D24.tmp\behgnlpnoikakicgikpgmhjflldfnjak\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5D24.tmp\behgnlpnoikakicgikpgmhjflldfnjak\manifest.json

Filesize
511B

MD5
3ab3956b18ae6fc8f79d09042ea65a7f

SHA1
dc0be8335260414ac3039bd791a47715f9d3b98b

SHA256
3c9f21ee467f033af82248fb2a737e5b41363b2ef6a8a7a568e8cc2148d18e8f

SHA512
dacf7f258ce489e17eabddb93051a0a036d15e437344bd1ebc6dac58301d18babb26c6ad532619f2f30c571d8e08bd8bc4753cd8bfd499726e3f43ef0c5683d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5D24.tmp\h0JwnQeLGr7Mbey.dat

Filesize
6KB

MD5
86c1dbd33c3fec534bd135a9837ce10a

SHA1
588f8e114bf085870678f38b3a192ce14f250462

SHA256
cd0d8e74cf5bde5f052c576b59e4e36f6bf26d713c127df6eb12921b5fb67132

SHA512
b548d3bbefba89213aabfbbe0225161f1cdb38baf3c4ad1bedb96202672f8a0be317a61222c113c0aac27c659163a169c04fe08f640266c2b58edce1e0ed2ea4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5D24.tmp\h0JwnQeLGr7Mbey.exe

Filesize
629KB

MD5
15dada567404c2049507d7098389e997

SHA1
508d8cc90c247e26ce5041c718825734079d841c

SHA256
888d66bccd07a163c4fcf59dca8fb4577fe6ecb7b11c427108b1e0aa45fccc58

SHA512
6fd82c0d06c43b309ce45c048c072c9696dfd6e9a81ec5149df64784f6428c6abe91b9be215b8a47dafc8859319be94bb13fbd2e4bc1795da61b970202a15261

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5D24.tmp\h0JwnQeLGr7Mbey.exe

Filesize
629KB

MD5
15dada567404c2049507d7098389e997

SHA1
508d8cc90c247e26ce5041c718825734079d841c

SHA256
888d66bccd07a163c4fcf59dca8fb4577fe6ecb7b11c427108b1e0aa45fccc58

SHA512
6fd82c0d06c43b309ce45c048c072c9696dfd6e9a81ec5149df64784f6428c6abe91b9be215b8a47dafc8859319be94bb13fbd2e4bc1795da61b970202a15261

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5D24.tmp\l6oX9pZTCoVoNv.dll

Filesize
618KB

MD5
9e56f8bd63dc95894be8b9e660696f1c

SHA1
2efcb8fc0ce33f2ada28fb2a6a17ec43813f80cb

SHA256
93186596d2312706d0623df3c9b9dfdea35546d5506b20216d2a7efeb1d8d79a

SHA512
e52fa89e7cf8ed7419a5f410f6bf46a19695727f19f8eebd714dee9d6f8a9036acc528cd6b0033f70f11a04e18746b814ee2dc494f2fc82db104a876b479d827

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5D24.tmp\l6oX9pZTCoVoNv.tlb

Filesize
3KB

MD5
713ab144897857b45ce9515c2a1e2d52

SHA1
607a46adbfe1892276898fb6b00e7c62dbf82772

SHA256
3ec756ec9b8c4b03cc723127bc372b67c406a4915fa0a82597b0fb29685096e6

SHA512
b54c6eaf989d9e51ba66278a0991daa14bde0f56e86c8c2fce67f2118e9557307b409fbc9ae48921c37c1869634b2801028d728f4cf3b871ad8971965e3004b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5D24.tmp\l6oX9pZTCoVoNv.x64.dll

Filesize
698KB

MD5
4f474d78d3944242daf1069b024ba83c

SHA1
0ef8ee373b77bf05e3c0de0a66dd4d8589dff7d9

SHA256
935dfff0607280f142a69b4e109ac34ebabca578240d9c66c1561fc67ae4a1a8

SHA512
1da43bff1edf956a365200a4092a7647c0054bf6196155c5b2e2659c12d6d6adb43db6aed503cace12b8c97aba3343abddc34acdf1f663eef667eebc9153f6a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5D24.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5D24.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
757517965fe290dc118a369733e89e00

SHA1
ef65396b5a5060498b0062512a1efc951f644ba2

SHA256
5dac05ad37999dd2b749f4fccfb029690285ee22d655d61205e0ad4b6d73a86b

SHA512
4f8e230415c53e3f719a5437ece476ab5fbf2457fe81537c848c11170d0d19a9a70e68585e2f0c73f57d50465cae1cf72a4d69909b3d0dd010d7dc809a6a3f04

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5D24.tmp\[email protected]\content\bg.js

Filesize
7KB

MD5
36638007bec932c129afa1bf6e903330

SHA1
c588c0579bdf2d23969c387306057f66ad922e61

SHA256
0533b169b9018e0d268aa1d2395ab837a73162e7e71e91a0a6f4c04bd3360f2a

SHA512
b000426eaf3f30ef9edd87425231d38f862eba31858f59248a01cb0a851545a3f6e36e85759a6b3a166c7950fbed8843346fd0eaeba59865c74c0d1729eaec06

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5D24.tmp\[email protected]\install.rdf

Filesize
610B

MD5
4d57e2b76513238b41f0395df6dd73e3

SHA1
cd01510679d7a0a45840183f823b6ac6450c7187

SHA256
d25ddd64e13b33c061cfd94a19d4f75096d33a15438c830e809c0bb41b7bdea1

SHA512
5181f24d5f84a6bf02ef07a7a09cecda126136dfb687dea6a38586f64ddd7af44042ec71b99bcc2652cca4c412da7fe5d5cddba964ed07de97405bb7364a1726

Download Submit