b5988e2e80430e808cb5fd8c2a348c5cdd673adc6000cfd42e184911b68959d0

General

Target

b5988e2e80430e808cb5fd8c2a348c5cdd673adc6000cfd42e184911b68959d0.exe
Size

1.8MB
MD5

be97f4e7d6f818daa91958271369bd8b
SHA1

103fca3dc5ea42ab34bb40e5f817cc7ff66347aa
SHA256

b5988e2e80430e808cb5fd8c2a348c5cdd673adc6000cfd42e184911b68959d0
SHA512

4dddd27fb9385e4b202ce015023b0c3edea57905417f5d861fed3cd9d3cdf465a025cf45bc2fd4b16e821b786f6c625c3c5c1009715120d536fe444f88307c84
SSDEEP

49152:gCQ0U/SJPVaJuPh4QwEvLX4f48dwUtzLN:gJXShRbLXd8Z

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

Iexplorer.exe

pid process

2040 Iexplorer.exe
Drops startup file 1 IoCs

Processes:

Iexplorer.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win7.exe Iexplorer.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win7.exe	Iexplorer.exe

Loads dropped DLL 2 IoCs

Processes:

b5988e2e80430e808cb5fd8c2a348c5cdd673adc6000cfd42e184911b68959d0.exe

pid	process
1252	b5988e2e80430e808cb5fd8c2a348c5cdd673adc6000cfd42e184911b68959d0.exe
1252	b5988e2e80430e808cb5fd8c2a348c5cdd673adc6000cfd42e184911b68959d0.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

regedit.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\MOZILLA = "C:\\Arquivos de programas\\Mozilla Firefox\\firefox.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\Firefox = "C:\\Program Files\\Mozilla Firefox\\firefox.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\mp = "C:\\Arquivos de programas\\player.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\temp = "C:\\Windows\\Temp\\firefox.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\seb = "C:\\Program Files\\GbPlugin\\seb.exe"	regedit.exe

Drops file in Program Files directory 3 IoCs

Processes:

Iexplorer.exe

description	ioc	process
File created	C:\Program Files\GbPlugin\seb.exe	Iexplorer.exe
File created	C:\Program Files\Mozilla Firefox\firefox.exe	Iexplorer.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	Iexplorer.exe

Drops file in Windows directory 2 IoCs

Processes:

Iexplorer.exe

description ioc process

File created C:\Windows\Regs.reg Iexplorer.exe
File created C:\WINDOWS\aviso.bak Iexplorer.exe
Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

Iexplorer.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main Iexplorer.exe

description	ioc	process
File created	C:\Windows\Regs.reg	Iexplorer.exe
File created	C:\WINDOWS\aviso.bak	Iexplorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	Iexplorer.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

Iexplorer.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Iexplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	Iexplorer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Iexplorer.exe

Runs .reg file with regedit 1 IoCs

Processes:

regedit.exe

pid process

524 regedit.exe

pid	process
524	regedit.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Iexplorer.exe

pid	process
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe
2040	Iexplorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Iexplorer.exe

pid process

2040 Iexplorer.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

Iexplorer.exe

pid process

2040 Iexplorer.exe
2040 Iexplorer.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

b5988e2e80430e808cb5fd8c2a348c5cdd673adc6000cfd42e184911b68959d0.exeIexplorer.execmd.exe

description	pid	process	target process
PID 1252 wrote to memory of 2040	1252	b5988e2e80430e808cb5fd8c2a348c5cdd673adc6000cfd42e184911b68959d0.exe	Iexplorer.exe
PID 1252 wrote to memory of 2040	1252	b5988e2e80430e808cb5fd8c2a348c5cdd673adc6000cfd42e184911b68959d0.exe	Iexplorer.exe
PID 1252 wrote to memory of 2040	1252	b5988e2e80430e808cb5fd8c2a348c5cdd673adc6000cfd42e184911b68959d0.exe	Iexplorer.exe
PID 1252 wrote to memory of 2040	1252	b5988e2e80430e808cb5fd8c2a348c5cdd673adc6000cfd42e184911b68959d0.exe	Iexplorer.exe
PID 2040 wrote to memory of 676	2040	Iexplorer.exe	cmd.exe
PID 2040 wrote to memory of 676	2040	Iexplorer.exe	cmd.exe
PID 2040 wrote to memory of 676	2040	Iexplorer.exe	cmd.exe
PID 2040 wrote to memory of 676	2040	Iexplorer.exe	cmd.exe
PID 676 wrote to memory of 524	676	cmd.exe	regedit.exe
PID 676 wrote to memory of 524	676	cmd.exe	regedit.exe
PID 676 wrote to memory of 524	676	cmd.exe	regedit.exe
PID 676 wrote to memory of 524	676	cmd.exe	regedit.exe

C:\Users\Admin\AppData\Local\Temp\b5988e2e80430e808cb5fd8c2a348c5cdd673adc6000cfd42e184911b68959d0.exe
"C:\Users\Admin\AppData\Local\Temp\b5988e2e80430e808cb5fd8c2a348c5cdd673adc6000cfd42e184911b68959d0.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1252

C:\Windows\Temp\Iexplorer.exe
C:\Windows\Temp\Iexplorer.exe
2⤵
- Executes dropped EXE
- Drops startup file
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\cmd.exe
C:\Windows\System32\cmd.exe /k regedit /s %windir%\Regs.reg
3⤵
- Suspicious use of WriteProcessMemory
PID:676

C:\Windows\SysWOW64\regedit.exe
regedit /s C:\Windows\Regs.reg
4⤵
- Adds Run key to start application
- Runs .reg file with regedit
PID:524

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Install Root Certificate

1

T1130

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Regs.reg
Filesize
370B

MD5
fcf7aa57c5f619ff66d8904d27cfbba6

SHA1
ca436c3e353a3dc4dac11627e9eeb8bcc5f94a0d

SHA256
4d27c0fe4717d7efbb41a141599cb1633771aa6a262e2f5aa0b3faf2512d4ef0

SHA512
3eaff73d43bb35f943fac695c49d84bb2c070131a85301bdd1bcf7411c8481ee08d22e75092959816d004c7e708e3f7f1420e1b2a13439a997870486432e716d

Download Submit
C:\Windows\Temp\Iexplorer.exe
Filesize
1.4MB

MD5
153e1939f47040db225a7d88af4cfc96

SHA1
137157e7cef2d203e319447e400aa102625bf382

SHA256
7650bba620e575c8a4130605b5bca334c526724f7813a948079af543824d1fa1

SHA512
8029dc22e0ecde68c5d7a968f67832917b012534ccbc1e833349ad481517c313e907e592ce27ad29ad6570ea648b77810f4732cd2053cb4e5fa23b22b2ce3d82

Download Submit
C:\Windows\Temp\Iexplorer.exe
Filesize
1.4MB

MD5
153e1939f47040db225a7d88af4cfc96

SHA1
137157e7cef2d203e319447e400aa102625bf382

SHA256
7650bba620e575c8a4130605b5bca334c526724f7813a948079af543824d1fa1

SHA512
8029dc22e0ecde68c5d7a968f67832917b012534ccbc1e833349ad481517c313e907e592ce27ad29ad6570ea648b77810f4732cd2053cb4e5fa23b22b2ce3d82

Download Submit
\Windows\Temp\Iexplorer.exe
Filesize
1.4MB

MD5
153e1939f47040db225a7d88af4cfc96

SHA1
137157e7cef2d203e319447e400aa102625bf382

SHA256
7650bba620e575c8a4130605b5bca334c526724f7813a948079af543824d1fa1

SHA512
8029dc22e0ecde68c5d7a968f67832917b012534ccbc1e833349ad481517c313e907e592ce27ad29ad6570ea648b77810f4732cd2053cb4e5fa23b22b2ce3d82

Download Submit
\Windows\Temp\Iexplorer.exe
Filesize
1.4MB

MD5
153e1939f47040db225a7d88af4cfc96

SHA1
137157e7cef2d203e319447e400aa102625bf382

SHA256
7650bba620e575c8a4130605b5bca334c526724f7813a948079af543824d1fa1

SHA512
8029dc22e0ecde68c5d7a968f67832917b012534ccbc1e833349ad481517c313e907e592ce27ad29ad6570ea648b77810f4732cd2053cb4e5fa23b22b2ce3d82

Download Submit
memory/524-63-0x0000000000000000-mapping.dmp

Download
memory/524-64-0x0000000076381000-0x0000000076383000-memory.dmp

Filesize
8KB

Download
memory/676-62-0x0000000000000000-mapping.dmp

Download
memory/1252-59-0x0000000002CA0000-0x0000000004AA9000-memory.dmp

Filesize
30.0MB

Download
memory/1252-58-0x0000000002CA0000-0x0000000004AA9000-memory.dmp

Filesize
30.0MB

Download
memory/1252-67-0x0000000002CA0000-0x0000000004AA9000-memory.dmp

Filesize
30.0MB

Download
memory/2040-61-0x0000000000400000-0x0000000002209000-memory.dmp

Filesize
30.0MB

Download
memory/2040-56-0x0000000000000000-mapping.dmp

Download
memory/2040-68-0x0000000000400000-0x0000000002209000-memory.dmp

Filesize
30.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads