e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65

General

Target

e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Size

3.6MB
MD5

b9cb9bc1a8172cfbc034f63d6f41d936
SHA1

84bcebd1db83918cdb80db9b25b4226bd4e982c0
SHA256

e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65
SHA512

c40ba8d3139db0707e0af2a966ebdb30f3931b57faf51350940ebfc683fba25cd15aa4422676c17431c9573fc018f4157fa9316993db0a1f89773e55445439c8
SSDEEP

49152:neGcMyDJW+hwBmwfurTGrZAX15BLNOPp+Rlm1bpm//HFUAW1VeQjMtMs8X:eRfdWdAhNOP7A/HanV

Score

8^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

regsvr32.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{60769cb9-8641-4795-9c5c-4444e0ca5a85}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{60769cb9-8641-4795-9c5c-4444e0ca5a85}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{60769cb9-8641-4795-9c5c-4444e0ca5a85}\InprocServer32\ = "C:\\Program Files (x86)\\GoSavea\\061yfsjVmjeRdE.x64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{60769cb9-8641-4795-9c5c-4444e0ca5a85}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe

Loads dropped DLL 3 IoCs

Processes:

e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exeregsvr32.exeregsvr32.exe

pid process

832 e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
1728 regsvr32.exe
1968 regsvr32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 3 IoCs

Processes:

e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe

description	ioc	process
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\nhldanejcfhacjhjoefhpddakfhnngik\2.0\manifest.json	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\nhldanejcfhacjhjoefhpddakfhnngik\2.0\manifest.json	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nhldanejcfhacjhjoefhpddakfhnngik\2.0\manifest.json	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exeregsvr32.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{60769cb9-8641-4795-9c5c-4444e0ca5a85}	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{60769cb9-8641-4795-9c5c-4444e0ca5a85}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{60769cb9-8641-4795-9c5c-4444e0ca5a85}\ = "GoSavea"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{60769cb9-8641-4795-9c5c-4444e0ca5a85}\NoExplorer = "1"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{60769cb9-8641-4795-9c5c-4444e0ca5a85}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{60769cb9-8641-4795-9c5c-4444e0ca5a85}	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{60769cb9-8641-4795-9c5c-4444e0ca5a85}\ = "GoSavea"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{60769cb9-8641-4795-9c5c-4444e0ca5a85}\NoExplorer = "1"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe

Drops file in System32 directory 4 IoCs

Processes:

e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe

Drops file in Program Files directory 8 IoCs

Processes:

e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\GoSavea\061yfsjVmjeRdE.tlb	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
File created	C:\Program Files (x86)\GoSavea\061yfsjVmjeRdE.dat	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
File opened for modification	C:\Program Files (x86)\GoSavea\061yfsjVmjeRdE.dat	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
File created	C:\Program Files (x86)\GoSavea\061yfsjVmjeRdE.x64.dll	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
File opened for modification	C:\Program Files (x86)\GoSavea\061yfsjVmjeRdE.x64.dll	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
File created	C:\Program Files (x86)\GoSavea\061yfsjVmjeRdE.dll	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
File opened for modification	C:\Program Files (x86)\GoSavea\061yfsjVmjeRdE.dll	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
File created	C:\Program Files (x86)\GoSavea\061yfsjVmjeRdE.tlb	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

Processes:

regsvr32.exee8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{60769cb9-8641-4795-9c5c-4444e0ca5a85}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{60769cb9-8641-4795-9c5c-4444e0ca5a85}	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{60769CB9-8641-4795-9C5C-4444E0CA5A85}	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{60769CB9-8641-4795-9C5C-4444E0CA5A85}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe

Modifies registry class 64 IoCs

Processes:

regsvr32.exee8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{60769cb9-8641-4795-9c5c-4444e0ca5a85}\VersionIndependentProgID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{60769cb9-8641-4795-9c5c-4444e0ca5a85}\Programmable	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\ = "GoSavea"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{60769cb9-8641-4795-9c5c-4444e0ca5a85}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\..9	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{60769cb9-8641-4795-9c5c-4444e0ca5a85}\ = "GoSavea"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{60769cb9-8641-4795-9c5c-4444e0ca5a85}\InprocServer32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{60769cb9-8641-4795-9c5c-4444e0ca5a85}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID\ = "{60769cb9-8641-4795-9c5c-4444e0ca5a85}"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{60769cb9-8641-4795-9c5c-4444e0ca5a85}\InprocServer32	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{60769cb9-8641-4795-9c5c-4444e0ca5a85}\VersionIndependentProgID\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{60769CB9-8641-4795-9C5C-4444E0CA5A85}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\ = "GoSavea"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{60769cb9-8641-4795-9c5c-4444e0ca5a85}\InprocServer32\ = "C:\\Program Files (x86)\\GoSavea\\061yfsjVmjeRdE.dll"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{60769cb9-8641-4795-9c5c-4444e0ca5a85}\InprocServer32	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\Program Files (x86)\\GoSavea\\061yfsjVmjeRdE.tlb"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{60769cb9-8641-4795-9c5c-4444e0ca5a85}\ProgID\ = ".9"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{60769cb9-8641-4795-9c5c-4444e0ca5a85}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID\ = "{60769cb9-8641-4795-9c5c-4444e0ca5a85}"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer\ = ".9"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\GoSavea"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID\ = "{60769cb9-8641-4795-9c5c-4444e0ca5a85}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\ = "GoSavea"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{60769cb9-8641-4795-9c5c-4444e0ca5a85}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{60769cb9-8641-4795-9c5c-4444e0ca5a85}\InprocServer32\ = "C:\\Program Files (x86)\\GoSavea\\061yfsjVmjeRdE.x64.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{60769cb9-8641-4795-9c5c-4444e0ca5a85}\ProgID	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{60769cb9-8641-4795-9c5c-4444e0ca5a85}\InprocServer32\ThreadingModel = "Apartment"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{60769CB9-8641-4795-9C5C-4444E0CA5A85}	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{60769CB9-8641-4795-9C5C-4444E0CA5A85}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe

pid	process
832	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
832	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exeregsvr32.exe

description	pid	process	target process
PID 832 wrote to memory of 1728	832	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe	regsvr32.exe
PID 832 wrote to memory of 1728	832	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe	regsvr32.exe
PID 832 wrote to memory of 1728	832	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe	regsvr32.exe
PID 832 wrote to memory of 1728	832	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe	regsvr32.exe
PID 832 wrote to memory of 1728	832	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe	regsvr32.exe
PID 832 wrote to memory of 1728	832	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe	regsvr32.exe
PID 832 wrote to memory of 1728	832	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe	regsvr32.exe
PID 1728 wrote to memory of 1968	1728	regsvr32.exe	regsvr32.exe
PID 1728 wrote to memory of 1968	1728	regsvr32.exe	regsvr32.exe
PID 1728 wrote to memory of 1968	1728	regsvr32.exe	regsvr32.exe
PID 1728 wrote to memory of 1968	1728	regsvr32.exe	regsvr32.exe
PID 1728 wrote to memory of 1968	1728	regsvr32.exe	regsvr32.exe
PID 1728 wrote to memory of 1968	1728	regsvr32.exe	regsvr32.exe
PID 1728 wrote to memory of 1968	1728	regsvr32.exe	regsvr32.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{60769cb9-8641-4795-9c5c-4444e0ca5a85} = "1"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe

C:\Users\Admin\AppData\Local\Temp\e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
"C:\Users\Admin\AppData\Local\Temp\e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe"
1⤵
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:832

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s "C:\Program Files (x86)\GoSavea\061yfsjVmjeRdE.x64.dll"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1728

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\GoSavea\061yfsjVmjeRdE.x64.dll"
3⤵
- Registers COM server for autorun
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
PID:1968

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\GoSavea\061yfsjVmjeRdE.dat
Filesize
4KB

MD5
85c9ca66350585162623651e1345701c

SHA1
96bd16bf9a79aa1b728a05eddb5c3e8dc39c2716

SHA256
f4a8d2e73189f11a1c2a2cf1ee12409f34824c6aa9f08d7c94b6116877e700cf

SHA512
31d7af8e2d378981e2186d8cc197481f96e6bbb8de0e8ab7a0a4b837b58048818d57699cf8833e821effbd1a99dc81b972557933c7eca3271d846818faf4ed65

Download Submit
C:\Program Files (x86)\GoSavea\061yfsjVmjeRdE.tlb
Filesize
3KB

MD5
b85e28ebb05db1bc98791f4ca29f89c3

SHA1
35255fda88e100483eea0a4d11303f68e3e37dad

SHA256
0f60549d695da16be688d5e4ab87ae734788c08d115023a2795f299f2b443c20

SHA512
655a7f6cdb3ae49333d0fb7a3c0f8f216c278e021b94783e7d5ff3c5b8b88cdf72424621d4831b7a339163e4d23cf3b00b5d0bc0c6a1c5fcffb92cbf6ec9a02a

Download Submit
C:\Program Files (x86)\GoSavea\061yfsjVmjeRdE.x64.dll
Filesize
694KB

MD5
295488797e3d9cc86059e14a22549c5b

SHA1
d01b332f2841a49dfc2bf37776921bc81de30bf2

SHA256
8a1af1647f2f95af8c953ac621629af8ffb860b4230fabef216bed97a6f897d2

SHA512
935f1f26a198cea3c2554405e3253cd28b9ffeb5faeebcd2eff3e2ac951c2339d2fafff561a6b175d7ccff4259ae62df99503ed66e418e5a10e0a12357eae75e

Download Submit
\Program Files (x86)\GoSavea\061yfsjVmjeRdE.dll
Filesize
615KB

MD5
ff5e433c6f29178bac73bb59690388e9

SHA1
c1ffbcdf7bfc725cbfe6dca5920d88491ea445b0

SHA256
f628bed0e2bbba0d403442a9d4ec81b5836b41545498e0e9b6633ed40689c861

SHA512
10f18270ae3002f8c428c8937bc5f88a2d06c8973c74ef34bd5ae16b346d658d57944aed459eff154eb1942bded03cc248d706feb18975f5b8107dd640661be6

Download Submit
\Program Files (x86)\GoSavea\061yfsjVmjeRdE.x64.dll
Filesize
694KB

MD5
295488797e3d9cc86059e14a22549c5b

SHA1
d01b332f2841a49dfc2bf37776921bc81de30bf2

SHA256
8a1af1647f2f95af8c953ac621629af8ffb860b4230fabef216bed97a6f897d2

SHA512
935f1f26a198cea3c2554405e3253cd28b9ffeb5faeebcd2eff3e2ac951c2339d2fafff561a6b175d7ccff4259ae62df99503ed66e418e5a10e0a12357eae75e

Download Submit
\Program Files (x86)\GoSavea\061yfsjVmjeRdE.x64.dll
Filesize
694KB

MD5
295488797e3d9cc86059e14a22549c5b

SHA1
d01b332f2841a49dfc2bf37776921bc81de30bf2

SHA256
8a1af1647f2f95af8c953ac621629af8ffb860b4230fabef216bed97a6f897d2

SHA512
935f1f26a198cea3c2554405e3253cd28b9ffeb5faeebcd2eff3e2ac951c2339d2fafff561a6b175d7ccff4259ae62df99503ed66e418e5a10e0a12357eae75e

Download Submit
memory/832-64-0x00000000004B2000-0x00000000004B6000-memory.dmp

Filesize
16KB

Download
memory/832-60-0x00000000004B2000-0x00000000004B6000-memory.dmp

Filesize
16KB

Download
memory/832-66-0x00000000004B6000-0x00000000004B9000-memory.dmp

Filesize
12KB

Download
memory/832-65-0x00000000004B6000-0x00000000004B9000-memory.dmp

Filesize
12KB

Download
memory/832-54-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/832-63-0x00000000004B2000-0x00000000004B6000-memory.dmp

Filesize
16KB

Download
memory/832-62-0x00000000004B2000-0x00000000004B6000-memory.dmp

Filesize
16KB

Download
memory/832-71-0x00000000004B6000-0x00000000004B9000-memory.dmp

Filesize
12KB

Download
memory/832-68-0x00000000004B6000-0x00000000004B9000-memory.dmp

Filesize
12KB

Download
memory/832-67-0x00000000004B6000-0x00000000004B9000-memory.dmp

Filesize
12KB

Download
memory/832-69-0x00000000004B6000-0x00000000004B9000-memory.dmp

Filesize
12KB

Download
memory/832-70-0x00000000004B6000-0x00000000004B9000-memory.dmp

Filesize
12KB

Download
memory/832-55-0x0000000000590000-0x000000000063B000-memory.dmp

Filesize
684KB

Download
memory/832-61-0x00000000004B2000-0x00000000004B6000-memory.dmp

Filesize
16KB

Download
memory/1728-73-0x0000000000000000-mapping.dmp

Download
memory/1968-78-0x000007FEFB751000-0x000007FEFB753000-memory.dmp

Filesize
8KB

Download
memory/1968-77-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads