e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda

General

Target

e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Size

3.5MB
MD5

8ca20090f9f747055a283712d0d4bf40
SHA1

953d1cd44eb589e975b161754d12470f65304c9a
SHA256

e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda
SHA512

a651004107aaa19ac176af164a36e54dab358e49d234a5873171601719e64f55d00505c4f9600adf45a7037c1ad94811d6f1df600986a2108525f1feaa80f9d3
SSDEEP

49152:+9aAsmOTmJadWMh8BBmTsgTMMchqMoVkIBL7o2TFFTkco2L0iMVE/:gsmOTKadT8BBX8sEMskIZMOFAcpLpMW

Score

8^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

regsvr32.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3e42b49-58d9-4ef9-b773-b7b317e7b005}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3e42b49-58d9-4ef9-b773-b7b317e7b005}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3e42b49-58d9-4ef9-b773-b7b317e7b005}\InprocServer32\ = "C:\\Program Files (x86)\\SmartOnes\\1iAfuUXG4cXSWQ.x64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3e42b49-58d9-4ef9-b773-b7b317e7b005}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe

Loads dropped DLL 3 IoCs

Processes:

e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exeregsvr32.exeregsvr32.exe

pid process

2036 e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
1368 regsvr32.exe
1564 regsvr32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exeregsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{d3e42b49-58d9-4ef9-b773-b7b317e7b005}	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{d3e42b49-58d9-4ef9-b773-b7b317e7b005}\ = "SmartOnes"	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{d3e42b49-58d9-4ef9-b773-b7b317e7b005}\NoExplorer = "1"	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{d3e42b49-58d9-4ef9-b773-b7b317e7b005}	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d3e42b49-58d9-4ef9-b773-b7b317e7b005}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d3e42b49-58d9-4ef9-b773-b7b317e7b005}\ = "SmartOnes"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d3e42b49-58d9-4ef9-b773-b7b317e7b005}\NoExplorer = "1"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d3e42b49-58d9-4ef9-b773-b7b317e7b005}	regsvr32.exe

Drops file in Program Files directory 8 IoCs

Processes:

e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe

description	ioc	process
File created	C:\Program Files (x86)\SmartOnes\1iAfuUXG4cXSWQ.dll	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
File opened for modification	C:\Program Files (x86)\SmartOnes\1iAfuUXG4cXSWQ.dll	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
File created	C:\Program Files (x86)\SmartOnes\1iAfuUXG4cXSWQ.tlb	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
File opened for modification	C:\Program Files (x86)\SmartOnes\1iAfuUXG4cXSWQ.tlb	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
File created	C:\Program Files (x86)\SmartOnes\1iAfuUXG4cXSWQ.dat	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
File opened for modification	C:\Program Files (x86)\SmartOnes\1iAfuUXG4cXSWQ.dat	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
File created	C:\Program Files (x86)\SmartOnes\1iAfuUXG4cXSWQ.x64.dll	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
File opened for modification	C:\Program Files (x86)\SmartOnes\1iAfuUXG4cXSWQ.x64.dll	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

Processes:

regsvr32.exee1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe

description	ioc	process
Key deleted	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{D3E42B49-58D9-4EF9-B773-B7B317E7B005}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{d3e42b49-58d9-4ef9-b773-b7b317e7b005}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{d3e42b49-58d9-4ef9-b773-b7b317e7b005}	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{D3E42B49-58D9-4EF9-B773-B7B317E7B005}	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe

Modifies registry class 64 IoCs

Processes:

regsvr32.exee1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3e42b49-58d9-4ef9-b773-b7b317e7b005}\ = "SmartOnes"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID\ = "{d3e42b49-58d9-4ef9-b773-b7b317e7b005}"	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein"	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3e42b49-58d9-4ef9-b773-b7b317e7b005}\VersionIndependentProgID\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\ = "SmartOnes"	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{d3e42b49-58d9-4ef9-b773-b7b317e7b005}\Programmable	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3e42b49-58d9-4ef9-b773-b7b317e7b005}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D3E42B49-58D9-4EF9-B773-B7B317E7B005}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{d3e42b49-58d9-4ef9-b773-b7b317e7b005}\ProgID	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D3E42B49-58D9-4EF9-B773-B7B317E7B005}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{d3e42b49-58d9-4ef9-b773-b7b317e7b005}\InprocServer32	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry"	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer\ = ".9"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D3E42B49-58D9-4EF9-B773-B7B317E7B005}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein"	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D3E42B49-58D9-4EF9-B773-B7B317E7B005}	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0"	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{d3e42b49-58d9-4ef9-b773-b7b317e7b005}\Programmable	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{d3e42b49-58d9-4ef9-b773-b7b317e7b005}\InprocServer32\ThreadingModel = "Apartment"	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{d3e42b49-58d9-4ef9-b773-b7b317e7b005}	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3e42b49-58d9-4ef9-b773-b7b317e7b005}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3e42b49-58d9-4ef9-b773-b7b317e7b005}\InprocServer32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3e42b49-58d9-4ef9-b773-b7b317e7b005}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID\ = "{d3e42b49-58d9-4ef9-b773-b7b317e7b005}"	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{d3e42b49-58d9-4ef9-b773-b7b317e7b005}\ = "SmartOnes"	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{d3e42b49-58d9-4ef9-b773-b7b317e7b005}\VersionIndependentProgID\	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3e42b49-58d9-4ef9-b773-b7b317e7b005}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3e42b49-58d9-4ef9-b773-b7b317e7b005}\InprocServer32\ = "C:\\Program Files (x86)\\SmartOnes\\1iAfuUXG4cXSWQ.x64.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{d3e42b49-58d9-4ef9-b773-b7b317e7b005}	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\Program Files (x86)\\SmartOnes\\1iAfuUXG4cXSWQ.tlb"	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0"	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID\ = "{d3e42b49-58d9-4ef9-b773-b7b317e7b005}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\..9	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{d3e42b49-58d9-4ef9-b773-b7b317e7b005}\InprocServer32	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D3E42B49-58D9-4EF9-B773-B7B317E7B005}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry"	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3e42b49-58d9-4ef9-b773-b7b317e7b005}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3e42b49-58d9-4ef9-b773-b7b317e7b005}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer\ = ".9"	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{d3e42b49-58d9-4ef9-b773-b7b317e7b005}\InprocServer32\ = "C:\\Program Files (x86)\\SmartOnes\\1iAfuUXG4cXSWQ.dll"	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe

pid	process
2036	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
2036	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
2036	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
2036	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
2036	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
2036	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe

description	pid	process
Token: SeDebugPrivilege	2036	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Token: SeDebugPrivilege	2036	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Token: SeDebugPrivilege	2036	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Token: SeDebugPrivilege	2036	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Token: SeDebugPrivilege	2036	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Token: SeDebugPrivilege	2036	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exeregsvr32.exe

description	pid	process	target process
PID 2036 wrote to memory of 1368	2036	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe	regsvr32.exe
PID 2036 wrote to memory of 1368	2036	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe	regsvr32.exe
PID 2036 wrote to memory of 1368	2036	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe	regsvr32.exe
PID 2036 wrote to memory of 1368	2036	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe	regsvr32.exe
PID 2036 wrote to memory of 1368	2036	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe	regsvr32.exe
PID 2036 wrote to memory of 1368	2036	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe	regsvr32.exe
PID 2036 wrote to memory of 1368	2036	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe	regsvr32.exe
PID 1368 wrote to memory of 1564	1368	regsvr32.exe	regsvr32.exe
PID 1368 wrote to memory of 1564	1368	regsvr32.exe	regsvr32.exe
PID 1368 wrote to memory of 1564	1368	regsvr32.exe	regsvr32.exe
PID 1368 wrote to memory of 1564	1368	regsvr32.exe	regsvr32.exe
PID 1368 wrote to memory of 1564	1368	regsvr32.exe	regsvr32.exe
PID 1368 wrote to memory of 1564	1368	regsvr32.exe	regsvr32.exe
PID 1368 wrote to memory of 1564	1368	regsvr32.exe	regsvr32.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{d3e42b49-58d9-4ef9-b773-b7b317e7b005} = "1"	e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe

C:\Users\Admin\AppData\Local\Temp\e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe
"C:\Users\Admin\AppData\Local\Temp\e1bd8f677f78f574e2f3ac0ead89ee7d2ca059265b903bdf3ff2376ff0fe8bda.exe"
1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2036

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s "C:\Program Files (x86)\SmartOnes\1iAfuUXG4cXSWQ.x64.dll"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1368

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\SmartOnes\1iAfuUXG4cXSWQ.x64.dll"
3⤵
- Registers COM server for autorun
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
PID:1564

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\SmartOnes\1iAfuUXG4cXSWQ.dat

Filesize
3KB

MD5
89aab67f72ad1adc0b59c3655d626e27

SHA1
78d2269e4d662d2edd27715783a831ca6315463d

SHA256
7d3bac353cebdf774920746cb7ec9261fc7b3e344e29e1e9cfe091da8127e787

SHA512
b66b2808b9cc6c4b85b80d0b0a93312f1fe40123db2075749ea5a245fb6d57dd84e8f1964411e558e5cc0a00675658a9b220512b4d539eedb0a95ea38c0f9ac3

Download Submit
C:\Program Files (x86)\SmartOnes\1iAfuUXG4cXSWQ.tlb

Filesize
3KB

MD5
49377d67ace525f846d959ba7d436dc4

SHA1
4ac51ead78ae8a1b501bf11ffe0df7e2c5700035

SHA256
7ff7fa97212623b68ab6d68484bff006973e3810a17b498feb019d40b8dfbae3

SHA512
6374f3db5d25c08d0afddd4af7ad1c613a9efbd7bb6e8958c09079cb5348a35e4b1c06d403169c3798d585cb59c8fd7d0c882f3203eb4144f5898cff6c7f20bc

Download Submit
C:\Program Files (x86)\SmartOnes\1iAfuUXG4cXSWQ.x64.dll

Filesize
712KB

MD5
6ecb34751b09be3226d2209478c84813

SHA1
9378fa3629680167e5e191d7d949819613989cb9

SHA256
c108b08dbfd2aeedc1757fa53f022f6f5d0714d5ee84bc20430044718aac7a76

SHA512
6d48cf102d5f983d1b08f8152bdd424f8bc2136b09ac5ef409181fd0f754b544eb62bb6df559c0bcf5a129ddb946b6e2f27b043326d0bdd70a86eff640684299

Download Submit
\Program Files (x86)\SmartOnes\1iAfuUXG4cXSWQ.dll

Filesize
633KB

MD5
b44b1bc7a8aab6a7d7aab228332e49d9

SHA1
d9e76789fdbe9feb40d671f2200247255b7fbd94

SHA256
23d34c7fbd46c8952e593435443be566ff84a76adfba19cfd86cb081a105ebae

SHA512
fb751469b384d81c0d1d2983f9146039b1a5254bb13ce2f578008bbe719c08a27cf548d7b9f9374485c869306507917bc2f18c83e9be00a703fa6cfa16d9363f

Download Submit
\Program Files (x86)\SmartOnes\1iAfuUXG4cXSWQ.x64.dll

Filesize
712KB

MD5
6ecb34751b09be3226d2209478c84813

SHA1
9378fa3629680167e5e191d7d949819613989cb9

SHA256
c108b08dbfd2aeedc1757fa53f022f6f5d0714d5ee84bc20430044718aac7a76

SHA512
6d48cf102d5f983d1b08f8152bdd424f8bc2136b09ac5ef409181fd0f754b544eb62bb6df559c0bcf5a129ddb946b6e2f27b043326d0bdd70a86eff640684299

Download Submit
\Program Files (x86)\SmartOnes\1iAfuUXG4cXSWQ.x64.dll

Filesize
712KB

MD5
6ecb34751b09be3226d2209478c84813

SHA1
9378fa3629680167e5e191d7d949819613989cb9

SHA256
c108b08dbfd2aeedc1757fa53f022f6f5d0714d5ee84bc20430044718aac7a76

SHA512
6d48cf102d5f983d1b08f8152bdd424f8bc2136b09ac5ef409181fd0f754b544eb62bb6df559c0bcf5a129ddb946b6e2f27b043326d0bdd70a86eff640684299

Download Submit
memory/1368-61-0x0000000000000000-mapping.dmp

Download
memory/1564-65-0x0000000000000000-mapping.dmp

Download
memory/1564-66-0x000007FEFBA81000-0x000007FEFBA83000-memory.dmp

Filesize
8KB

Download
memory/2036-54-0x0000000075521000-0x0000000075523000-memory.dmp

Filesize
8KB

Download
memory/2036-55-0x0000000000790000-0x0000000000832000-memory.dmp

Filesize
648KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads