e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65

General

Target

e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Size

3.6MB
MD5

b9cb9bc1a8172cfbc034f63d6f41d936
SHA1

84bcebd1db83918cdb80db9b25b4226bd4e982c0
SHA256

e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65
SHA512

c40ba8d3139db0707e0af2a966ebdb30f3931b57faf51350940ebfc683fba25cd15aa4422676c17431c9573fc018f4157fa9316993db0a1f89773e55445439c8
SSDEEP

49152:neGcMyDJW+hwBmwfurTGrZAX15BLNOPp+Rlm1bpm//HFUAW1VeQjMtMs8X:eRfdWdAhNOP7A/HanV

Score

8^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{60769cb9-8641-4795-9c5c-4444e0ca5a85}\InprocServer32\ = "C:\\Program Files (x86)\\GoSavea\\061yfsjVmjeRdE.x64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{60769cb9-8641-4795-9c5c-4444e0ca5a85}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{60769cb9-8641-4795-9c5c-4444e0ca5a85}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{60769cb9-8641-4795-9c5c-4444e0ca5a85}\InprocServer32	regsvr32.exe

Loads dropped DLL 3 IoCs

Processes:

e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exeregsvr32.exeregsvr32.exe

pid process

2352 e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
2580 regsvr32.exe
724 regsvr32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe

description	ioc	process
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\nhldanejcfhacjhjoefhpddakfhnngik\2.0\manifest.json	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\nhldanejcfhacjhjoefhpddakfhnngik\2.0\manifest.json	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\nhldanejcfhacjhjoefhpddakfhnngik\2.0\manifest.json	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\nhldanejcfhacjhjoefhpddakfhnngik\2.0\manifest.json	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nhldanejcfhacjhjoefhpddakfhnngik\2.0\manifest.json	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

regsvr32.exee8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{60769cb9-8641-4795-9c5c-4444e0ca5a85}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{60769cb9-8641-4795-9c5c-4444e0ca5a85}\ = "GoSavea"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{60769cb9-8641-4795-9c5c-4444e0ca5a85}\NoExplorer = "1"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{60769cb9-8641-4795-9c5c-4444e0ca5a85}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{60769cb9-8641-4795-9c5c-4444e0ca5a85}	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{60769cb9-8641-4795-9c5c-4444e0ca5a85}\ = "GoSavea"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{60769cb9-8641-4795-9c5c-4444e0ca5a85}\NoExplorer = "1"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{60769cb9-8641-4795-9c5c-4444e0ca5a85}	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe

Drops file in System32 directory 4 IoCs

Processes:

e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
File opened for modification	C:\Windows\System32\GroupPolicy	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe

Drops file in Program Files directory 8 IoCs

Processes:

e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\GoSavea\061yfsjVmjeRdE.tlb	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
File created	C:\Program Files (x86)\GoSavea\061yfsjVmjeRdE.dat	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
File opened for modification	C:\Program Files (x86)\GoSavea\061yfsjVmjeRdE.dat	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
File created	C:\Program Files (x86)\GoSavea\061yfsjVmjeRdE.x64.dll	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
File opened for modification	C:\Program Files (x86)\GoSavea\061yfsjVmjeRdE.x64.dll	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
File created	C:\Program Files (x86)\GoSavea\061yfsjVmjeRdE.dll	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
File opened for modification	C:\Program Files (x86)\GoSavea\061yfsjVmjeRdE.dll	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
File created	C:\Program Files (x86)\GoSavea\061yfsjVmjeRdE.tlb	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

Processes:

e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exeregsvr32.exe

description	ioc	process
Key deleted	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVEDEXTENSIONSMIGRATION\{60769CB9-8641-4795-9C5C-4444E0CA5A85}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{60769cb9-8641-4795-9c5c-4444e0ca5a85}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{60769cb9-8641-4795-9c5c-4444e0ca5a85}	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVEDEXTENSIONSMIGRATION\{60769CB9-8641-4795-9C5C-4444E0CA5A85}	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe

Modifies registry class 64 IoCs

Processes:

e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exeregsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID\ = "{60769cb9-8641-4795-9c5c-4444e0ca5a85}"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{60769CB9-8641-4795-9C5C-4444E0CA5A85}	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{60769cb9-8641-4795-9c5c-4444e0ca5a85}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID\ = "{60769cb9-8641-4795-9c5c-4444e0ca5a85}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{60769cb9-8641-4795-9c5c-4444e0ca5a85}\VersionIndependentProgID\	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{60769cb9-8641-4795-9c5c-4444e0ca5a85}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{60769cb9-8641-4795-9c5c-4444e0ca5a85}\VersionIndependentProgID	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{60769cb9-8641-4795-9c5c-4444e0ca5a85}\InprocServer32\ = "C:\\Program Files (x86)\\GoSavea\\061yfsjVmjeRdE.dll"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{60769CB9-8641-4795-9C5C-4444E0CA5A85}\Implemented Categories	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{60769cb9-8641-4795-9c5c-4444e0ca5a85}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{60769CB9-8641-4795-9C5C-4444E0CA5A85}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer\ = ".9"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{60769CB9-8641-4795-9C5C-4444E0CA5A85}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\GoSavea"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{60769CB9-8641-4795-9C5C-4444E0CA5A85}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\ = "GoSavea"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{60769cb9-8641-4795-9c5c-4444e0ca5a85}\InprocServer32	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{60769cb9-8641-4795-9c5c-4444e0ca5a85}\VersionIndependentProgID	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID\ = "{60769cb9-8641-4795-9c5c-4444e0ca5a85}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{60769cb9-8641-4795-9c5c-4444e0ca5a85}\ProgID\ = ".9"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\..9	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{60769cb9-8641-4795-9c5c-4444e0ca5a85}	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{60769cb9-8641-4795-9c5c-4444e0ca5a85}\ProgID	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{60769cb9-8641-4795-9c5c-4444e0ca5a85}\InprocServer32	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{60769cb9-8641-4795-9c5c-4444e0ca5a85}\ProgID	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{60769cb9-8641-4795-9c5c-4444e0ca5a85}\Programmable	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{60769cb9-8641-4795-9c5c-4444e0ca5a85}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{60769cb9-8641-4795-9c5c-4444e0ca5a85}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{60769cb9-8641-4795-9c5c-4444e0ca5a85}\Programmable	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{60769cb9-8641-4795-9c5c-4444e0ca5a85}\InprocServer32\ = "C:\\Program Files (x86)\\GoSavea\\061yfsjVmjeRdE.x64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{60769cb9-8641-4795-9c5c-4444e0ca5a85}\InprocServer32\ThreadingModel = "Apartment"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{60769cb9-8641-4795-9c5c-4444e0ca5a85}	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe

pid	process
2352	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
2352	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
2352	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
2352	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exeregsvr32.exe

description	pid	process	target process
PID 2352 wrote to memory of 2580	2352	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe	regsvr32.exe
PID 2352 wrote to memory of 2580	2352	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe	regsvr32.exe
PID 2352 wrote to memory of 2580	2352	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe	regsvr32.exe
PID 2580 wrote to memory of 724	2580	regsvr32.exe	regsvr32.exe
PID 2580 wrote to memory of 724	2580	regsvr32.exe	regsvr32.exe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

Processes:

e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{60769cb9-8641-4795-9c5c-4444e0ca5a85} = "1"	e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe

C:\Users\Admin\AppData\Local\Temp\e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe
"C:\Users\Admin\AppData\Local\Temp\e8f597ef867636d5df93046147c8cc401a79f8bf910da7c48cc481978a86be65.exe"
1⤵
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2352

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s "C:\Program Files (x86)\GoSavea\061yfsjVmjeRdE.x64.dll"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2580

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\GoSavea\061yfsjVmjeRdE.x64.dll"
3⤵
- Registers COM server for autorun
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
PID:724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:1540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:3264

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\GoSavea\061yfsjVmjeRdE.dat

Filesize
4KB

MD5
85c9ca66350585162623651e1345701c

SHA1
96bd16bf9a79aa1b728a05eddb5c3e8dc39c2716

SHA256
f4a8d2e73189f11a1c2a2cf1ee12409f34824c6aa9f08d7c94b6116877e700cf

SHA512
31d7af8e2d378981e2186d8cc197481f96e6bbb8de0e8ab7a0a4b837b58048818d57699cf8833e821effbd1a99dc81b972557933c7eca3271d846818faf4ed65

Download Submit
C:\Program Files (x86)\GoSavea\061yfsjVmjeRdE.dll

Filesize
615KB

MD5
ff5e433c6f29178bac73bb59690388e9

SHA1
c1ffbcdf7bfc725cbfe6dca5920d88491ea445b0

SHA256
f628bed0e2bbba0d403442a9d4ec81b5836b41545498e0e9b6633ed40689c861

SHA512
10f18270ae3002f8c428c8937bc5f88a2d06c8973c74ef34bd5ae16b346d658d57944aed459eff154eb1942bded03cc248d706feb18975f5b8107dd640661be6

Download Submit
C:\Program Files (x86)\GoSavea\061yfsjVmjeRdE.tlb

Filesize
3KB

MD5
b85e28ebb05db1bc98791f4ca29f89c3

SHA1
35255fda88e100483eea0a4d11303f68e3e37dad

SHA256
0f60549d695da16be688d5e4ab87ae734788c08d115023a2795f299f2b443c20

SHA512
655a7f6cdb3ae49333d0fb7a3c0f8f216c278e021b94783e7d5ff3c5b8b88cdf72424621d4831b7a339163e4d23cf3b00b5d0bc0c6a1c5fcffb92cbf6ec9a02a

Download Submit
C:\Program Files (x86)\GoSavea\061yfsjVmjeRdE.x64.dll

Filesize
694KB

MD5
295488797e3d9cc86059e14a22549c5b

SHA1
d01b332f2841a49dfc2bf37776921bc81de30bf2

SHA256
8a1af1647f2f95af8c953ac621629af8ffb860b4230fabef216bed97a6f897d2

SHA512
935f1f26a198cea3c2554405e3253cd28b9ffeb5faeebcd2eff3e2ac951c2339d2fafff561a6b175d7ccff4259ae62df99503ed66e418e5a10e0a12357eae75e

Download Submit
C:\Program Files (x86)\GoSavea\061yfsjVmjeRdE.x64.dll

Filesize
694KB

MD5
295488797e3d9cc86059e14a22549c5b

SHA1
d01b332f2841a49dfc2bf37776921bc81de30bf2

SHA256
8a1af1647f2f95af8c953ac621629af8ffb860b4230fabef216bed97a6f897d2

SHA512
935f1f26a198cea3c2554405e3253cd28b9ffeb5faeebcd2eff3e2ac951c2339d2fafff561a6b175d7ccff4259ae62df99503ed66e418e5a10e0a12357eae75e

Download Submit
C:\Program Files (x86)\GoSavea\061yfsjVmjeRdE.x64.dll

Filesize
694KB

MD5
295488797e3d9cc86059e14a22549c5b

SHA1
d01b332f2841a49dfc2bf37776921bc81de30bf2

SHA256
8a1af1647f2f95af8c953ac621629af8ffb860b4230fabef216bed97a6f897d2

SHA512
935f1f26a198cea3c2554405e3253cd28b9ffeb5faeebcd2eff3e2ac951c2339d2fafff561a6b175d7ccff4259ae62df99503ed66e418e5a10e0a12357eae75e

Download Submit
memory/724-141-0x0000000000000000-mapping.dmp

Download
memory/2352-132-0x0000000003280000-0x000000000332B000-memory.dmp

Filesize
684KB

Download
memory/2580-138-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads