bc9beef3c353dbf8d24f60de3189936368027c08fa2d62d00e52586b892fd05f

General

Target

bc9beef3c353dbf8d24f60de3189936368027c08fa2d62d00e52586b892fd05f.dll
Size

285KB
MD5

434b415c098607a5470ccc9915c90740
SHA1

5b15a1c4d22b70979869aa14a5e3847da5a126c7
SHA256

bc9beef3c353dbf8d24f60de3189936368027c08fa2d62d00e52586b892fd05f
SHA512

73541bcaf01870c1d7c6abaa5249fa87cd9b5d1ee911df63127beb31b40378b6a5687b0fe6035c23f44601d7f6d18f7f5fb466ab8d360ebd6844378cb150dd07
SSDEEP

6144:+1xRVAt79v04Z/OgiOYSHl7TBJpylefRtlw:+1OV0iCwl7TrpmefRw

Score

6^/10

adware stealer

Malware Config

Signatures

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9F531FB1-7C1F-4e1a-8C0C-E8D6177130E2}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9F531FB1-7C1F-4e1a-8C0C-E8D6177130E2}\ = "AW Gaming Software"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9F531FB1-7C1F-4e1a-8C0C-E8D6177130E2}\NoExplorer = "1"	regsvr32.exe

Modifies registry class 64 IoCs

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{21C1577D-B190-4F9D-8034-F26DE5F9F3C2}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D9D903F6-26EF-4716-BBD0-D9513E8FDE9B}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D9D903F6-26EF-4716-BBD0-D9513E8FDE9B}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F531FB1-7C1F-4e1a-8C0C-E8D6177130E2}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F531FB1-7C1F-4e1a-8C0C-E8D6177130E2}\ProgID\ = "AWGames.Addon.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9D903F6-26EF-4716-BBD0-D9513E8FDE9B}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9D903F6-26EF-4716-BBD0-D9513E8FDE9B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F531FB1-7C1F-4e1a-8C0C-E8D6177130E2}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2A04A1D0-1969-400E-A53C-6A5433A4B658}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{21C1577D-B190-4F9D-8034-F26DE5F9F3C2}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AWGames.Addon\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{21C1577D-B190-4F9D-8034-F26DE5F9F3C2}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9D903F6-26EF-4716-BBD0-D9513E8FDE9B}\ = "IExtension"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2A04A1D0-1969-400E-A53C-6A5433A4B658}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{21C1577D-B190-4F9D-8034-F26DE5F9F3C2}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{21C1577D-B190-4F9D-8034-F26DE5F9F3C2}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{21C1577D-B190-4F9D-8034-F26DE5F9F3C2}\ = "_IExtensionEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AWGames.Addon.1\CLSID\ = "{9F531FB1-7C1F-4e1a-8C0C-E8D6177130E2}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F531FB1-7C1F-4e1a-8C0C-E8D6177130E2}\VersionIndependentProgID\ = "AWGames.Addon"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F531FB1-7C1F-4e1a-8C0C-E8D6177130E2}\TypeLib\ = "{2A04A1D0-1969-400e-A53C-6A5433A4B658}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D9D903F6-26EF-4716-BBD0-D9513E8FDE9B}\ = "IExtension"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AWGames.Addon\CLSID\ = "{9F531FB1-7C1F-4e1a-8C0C-E8D6177130E2}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F531FB1-7C1F-4e1a-8C0C-E8D6177130E2}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2A04A1D0-1969-400E-A53C-6A5433A4B658}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\ExplorerPlugin.DLL	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AWGames.Addon.1\ = "AW Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AWGames.Addon\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2A04A1D0-1969-400E-A53C-6A5433A4B658}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bc9beef3c353dbf8d24f60de3189936368027c08fa2d62d00e52586b892fd05f.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{21C1577D-B190-4F9D-8034-F26DE5F9F3C2}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{21C1577D-B190-4F9D-8034-F26DE5F9F3C2}\TypeLib\ = "{2A04A1D0-1969-400E-A53C-6A5433A4B658}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{21C1577D-B190-4F9D-8034-F26DE5F9F3C2}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9D903F6-26EF-4716-BBD0-D9513E8FDE9B}\TypeLib\ = "{2A04A1D0-1969-400E-A53C-6A5433A4B658}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AWGames.Addon\ = "AW Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2A04A1D0-1969-400E-A53C-6A5433A4B658}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{21C1577D-B190-4F9D-8034-F26DE5F9F3C2}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D9D903F6-26EF-4716-BBD0-D9513E8FDE9B}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D9D903F6-26EF-4716-BBD0-D9513E8FDE9B}\TypeLib\ = "{2A04A1D0-1969-400E-A53C-6A5433A4B658}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\ExplorerPlugin.DLL\AppID = "{659E2097-10E3-4208-91AA-E532EF4D9BEE}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AWGames.Addon\CurVer\ = "AWGames.Addon.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F531FB1-7C1F-4e1a-8C0C-E8D6177130E2}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{21C1577D-B190-4F9D-8034-F26DE5F9F3C2}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AWGames.Addon.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F531FB1-7C1F-4e1a-8C0C-E8D6177130E2}\ = "AW Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F531FB1-7C1F-4e1a-8C0C-E8D6177130E2}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bc9beef3c353dbf8d24f60de3189936368027c08fa2d62d00e52586b892fd05f.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2A04A1D0-1969-400E-A53C-6A5433A4B658}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2A04A1D0-1969-400E-A53C-6A5433A4B658}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D9D903F6-26EF-4716-BBD0-D9513E8FDE9B}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{21C1577D-B190-4F9D-8034-F26DE5F9F3C2}\ = "_IExtensionEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D9D903F6-26EF-4716-BBD0-D9513E8FDE9B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9D903F6-26EF-4716-BBD0-D9513E8FDE9B}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{659E2097-10E3-4208-91AA-E532EF4D9BEE}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AWGames.Addon	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2A04A1D0-1969-400E-A53C-6A5433A4B658}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F531FB1-7C1F-4e1a-8C0C-E8D6177130E2}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2A04A1D0-1969-400E-A53C-6A5433A4B658}\1.0\ = "ExpExt TLib"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{21C1577D-B190-4F9D-8034-F26DE5F9F3C2}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F531FB1-7C1F-4e1a-8C0C-E8D6177130E2}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2A04A1D0-1969-400E-A53C-6A5433A4B658}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{21C1577D-B190-4F9D-8034-F26DE5F9F3C2}\TypeLib\ = "{2A04A1D0-1969-400E-A53C-6A5433A4B658}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9D903F6-26EF-4716-BBD0-D9513E8FDE9B}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9D903F6-26EF-4716-BBD0-D9513E8FDE9B}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{659E2097-10E3-4208-91AA-E532EF4D9BEE}\ = "ExplorerPlugin"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AWGames.Addon.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F531FB1-7C1F-4e1a-8C0C-E8D6177130E2}\VersionIndependentProgID	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 3248 wrote to memory of 832	3248	regsvr32.exe	regsvr32.exe
PID 3248 wrote to memory of 832	3248	regsvr32.exe	regsvr32.exe
PID 3248 wrote to memory of 832	3248	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\bc9beef3c353dbf8d24f60de3189936368027c08fa2d62d00e52586b892fd05f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3248

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\bc9beef3c353dbf8d24f60de3189936368027c08fa2d62d00e52586b892fd05f.dll
2⤵
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:832

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/832-132-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads