Analysis
-
max time kernel
24s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 19:22
Static task
static1
Behavioral task
behavioral1
Sample
c8d2f20cdd681fb638bb5e9a255c8dde4ac846f5589dccd3c51fee5e8a2ed329.exe
Resource
win7-20220812-en
General
-
Target
c8d2f20cdd681fb638bb5e9a255c8dde4ac846f5589dccd3c51fee5e8a2ed329.exe
-
Size
2.5MB
-
MD5
588527e9fab690b353c86c540bf1b768
-
SHA1
e782f49ae428a1c67f7f821d5b53863e41b1645e
-
SHA256
c8d2f20cdd681fb638bb5e9a255c8dde4ac846f5589dccd3c51fee5e8a2ed329
-
SHA512
2a5fc3b5edd5b5c39721b1e4ecf370dcbdd396470f48b76186e8c24e5dbe3131c61d9a38f2ee84400c40b924941ac6c2e21c24ef3624bfa9ae386145206ff83f
-
SSDEEP
49152:h1Os2+QK3xQpjajXKioFMpYphqd3ArqvFUmEaDxEAxh4UR9TEu:h1OWQCjbKioVg3ArKh40h
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
EeoudPT1WmZWV58.exepid process 1876 EeoudPT1WmZWV58.exe -
Loads dropped DLL 4 IoCs
Processes:
c8d2f20cdd681fb638bb5e9a255c8dde4ac846f5589dccd3c51fee5e8a2ed329.exeEeoudPT1WmZWV58.exeregsvr32.exeregsvr32.exepid process 1960 c8d2f20cdd681fb638bb5e9a255c8dde4ac846f5589dccd3c51fee5e8a2ed329.exe 1876 EeoudPT1WmZWV58.exe 1552 regsvr32.exe 1500 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs 11 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
regsvr32.exeEeoudPT1WmZWV58.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435B-BC74-9C25C1C588A9} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} EeoudPT1WmZWV58.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects EeoudPT1WmZWV58.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\ EeoudPT1WmZWV58.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} EeoudPT1WmZWV58.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} EeoudPT1WmZWV58.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ regsvr32.exe -
Drops file in Program Files directory 8 IoCs
Processes:
EeoudPT1WmZWV58.exedescription ioc process File opened for modification C:\Program Files (x86)\YoutubeAdBlocke\m7ZDRU8zPDzUFR.dat EeoudPT1WmZWV58.exe File created C:\Program Files (x86)\YoutubeAdBlocke\m7ZDRU8zPDzUFR.x64.dll EeoudPT1WmZWV58.exe File opened for modification C:\Program Files (x86)\YoutubeAdBlocke\m7ZDRU8zPDzUFR.x64.dll EeoudPT1WmZWV58.exe File created C:\Program Files (x86)\YoutubeAdBlocke\m7ZDRU8zPDzUFR.dll EeoudPT1WmZWV58.exe File opened for modification C:\Program Files (x86)\YoutubeAdBlocke\m7ZDRU8zPDzUFR.dll EeoudPT1WmZWV58.exe File created C:\Program Files (x86)\YoutubeAdBlocke\m7ZDRU8zPDzUFR.tlb EeoudPT1WmZWV58.exe File opened for modification C:\Program Files (x86)\YoutubeAdBlocke\m7ZDRU8zPDzUFR.tlb EeoudPT1WmZWV58.exe File created C:\Program Files (x86)\YoutubeAdBlocke\m7ZDRU8zPDzUFR.dat EeoudPT1WmZWV58.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
EeoudPT1WmZWV58.exepid process 1876 EeoudPT1WmZWV58.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
c8d2f20cdd681fb638bb5e9a255c8dde4ac846f5589dccd3c51fee5e8a2ed329.exeEeoudPT1WmZWV58.exeregsvr32.exedescription pid process target process PID 1960 wrote to memory of 1876 1960 c8d2f20cdd681fb638bb5e9a255c8dde4ac846f5589dccd3c51fee5e8a2ed329.exe EeoudPT1WmZWV58.exe PID 1960 wrote to memory of 1876 1960 c8d2f20cdd681fb638bb5e9a255c8dde4ac846f5589dccd3c51fee5e8a2ed329.exe EeoudPT1WmZWV58.exe PID 1960 wrote to memory of 1876 1960 c8d2f20cdd681fb638bb5e9a255c8dde4ac846f5589dccd3c51fee5e8a2ed329.exe EeoudPT1WmZWV58.exe PID 1960 wrote to memory of 1876 1960 c8d2f20cdd681fb638bb5e9a255c8dde4ac846f5589dccd3c51fee5e8a2ed329.exe EeoudPT1WmZWV58.exe PID 1876 wrote to memory of 1552 1876 EeoudPT1WmZWV58.exe regsvr32.exe PID 1876 wrote to memory of 1552 1876 EeoudPT1WmZWV58.exe regsvr32.exe PID 1876 wrote to memory of 1552 1876 EeoudPT1WmZWV58.exe regsvr32.exe PID 1876 wrote to memory of 1552 1876 EeoudPT1WmZWV58.exe regsvr32.exe PID 1876 wrote to memory of 1552 1876 EeoudPT1WmZWV58.exe regsvr32.exe PID 1876 wrote to memory of 1552 1876 EeoudPT1WmZWV58.exe regsvr32.exe PID 1876 wrote to memory of 1552 1876 EeoudPT1WmZWV58.exe regsvr32.exe PID 1552 wrote to memory of 1500 1552 regsvr32.exe regsvr32.exe PID 1552 wrote to memory of 1500 1552 regsvr32.exe regsvr32.exe PID 1552 wrote to memory of 1500 1552 regsvr32.exe regsvr32.exe PID 1552 wrote to memory of 1500 1552 regsvr32.exe regsvr32.exe PID 1552 wrote to memory of 1500 1552 regsvr32.exe regsvr32.exe PID 1552 wrote to memory of 1500 1552 regsvr32.exe regsvr32.exe PID 1552 wrote to memory of 1500 1552 regsvr32.exe regsvr32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c8d2f20cdd681fb638bb5e9a255c8dde4ac846f5589dccd3c51fee5e8a2ed329.exe"C:\Users\Admin\AppData\Local\Temp\c8d2f20cdd681fb638bb5e9a255c8dde4ac846f5589dccd3c51fee5e8a2ed329.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4184.tmp\EeoudPT1WmZWV58.exe.\EeoudPT1WmZWV58.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\YoutubeAdBlocke\m7ZDRU8zPDzUFR.x64.dll"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\YoutubeAdBlocke\m7ZDRU8zPDzUFR.x64.dll"4⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\YoutubeAdBlocke\m7ZDRU8zPDzUFR.datFilesize
6KB
MD55d9fbb0912f2e9e9e5d4f60ea3247195
SHA13c768c859d21289a53097f5639a6752505fdba36
SHA256e6f7f7bb2aeae1f293d535e7070ab303257418307f51b06412ce756efc7e655f
SHA51254907b5b5638a9a22d552e6386fd507926c60cd95fe06ad9478d39fb62fb8a9cc0b4a7ace36a53cf1c30e2032923f875de29bfa547d6664cc3bf163775df1c7d
-
C:\Program Files (x86)\YoutubeAdBlocke\m7ZDRU8zPDzUFR.x64.dllFilesize
887KB
MD5fe714aa952e86e33b2cc1652e0f7f6cb
SHA125927512b7bef5f0586f7edab4d4804ec43409aa
SHA256c4fc97da6b3393137f1711238c3ac18d36f903d256a9205fd40e71b4c99ce579
SHA512fe5ac276c14bf2f5e59a1c4acccb98404cbbbe0bceed92a69e5860445682c44d8575ef6926706b9d750bcbf8dca539503547c4f693a8b28cb2e3463760c2c5a7
-
C:\Users\Admin\AppData\Local\Temp\7zS4184.tmp\EeoudPT1WmZWV58.datFilesize
6KB
MD55d9fbb0912f2e9e9e5d4f60ea3247195
SHA13c768c859d21289a53097f5639a6752505fdba36
SHA256e6f7f7bb2aeae1f293d535e7070ab303257418307f51b06412ce756efc7e655f
SHA51254907b5b5638a9a22d552e6386fd507926c60cd95fe06ad9478d39fb62fb8a9cc0b4a7ace36a53cf1c30e2032923f875de29bfa547d6664cc3bf163775df1c7d
-
C:\Users\Admin\AppData\Local\Temp\7zS4184.tmp\EeoudPT1WmZWV58.exeFilesize
765KB
MD5102dfa10cc29d7f1ded876dfd7274280
SHA1f26e57d916bf7c5c3a4b49a2edaf30e945b0b44e
SHA25667d9ee9e36b29e081ff2084dc488b0b6c4120e791a5c33ce6027cf89718e4bb3
SHA512c3b7bb463873420f1582880308acca440c24fefaf45c9ad75319665e07c0f4548bd6fe07fabec48edd138a495a2607297773b16400e351e68a7462b45fb2c0c2
-
C:\Users\Admin\AppData\Local\Temp\7zS4184.tmp\EeoudPT1WmZWV58.exeFilesize
765KB
MD5102dfa10cc29d7f1ded876dfd7274280
SHA1f26e57d916bf7c5c3a4b49a2edaf30e945b0b44e
SHA25667d9ee9e36b29e081ff2084dc488b0b6c4120e791a5c33ce6027cf89718e4bb3
SHA512c3b7bb463873420f1582880308acca440c24fefaf45c9ad75319665e07c0f4548bd6fe07fabec48edd138a495a2607297773b16400e351e68a7462b45fb2c0c2
-
C:\Users\Admin\AppData\Local\Temp\7zS4184.tmp\[email protected]\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS4184.tmp\[email protected]\chrome.manifestFilesize
35B
MD5740a7984c4969e2af812834adc4387ea
SHA1b289741b8cf755f4ba80b3369e2194831e75fa9a
SHA2565d58a04c9512e817cf19172812d4a8d33322c98de3b0ab43e6ca36beaf9b49b0
SHA51252d167845c13d838543098510a9e4287354794147d3c87a2896f893ba7dcd176aa53f1d55ab865c7f461d548c71c6fee9c335ea0749e95b4ea3bf4a3682f253d
-
C:\Users\Admin\AppData\Local\Temp\7zS4184.tmp\[email protected]\content\bg.jsFilesize
7KB
MD53e039de03c91261bb2d1aae1f14c2074
SHA1c7cf0b2dd72d255b4f2501d9eed17367a5e5c995
SHA256e0b581c30491733f88263fcbdc68cbe705749324f332fa407159aa72a3a96be7
SHA51261cc0badce4588c8f374144c31773b1afe37ece06d01da579b0eb00a10cc7f4cb06f53557c8eaa8e673742ca729df835ed5686a119933f85bb793efe9bd999d8
-
C:\Users\Admin\AppData\Local\Temp\7zS4184.tmp\[email protected]\install.rdfFilesize
600B
MD5042cb3c2d8ce95c431294633fad8f91e
SHA1b5e202144fe43ec0e25696c1c5886b55c88c9809
SHA256e149a83447e527d5918c1515b0d3797dda4b115fa0f1cb9f85e5b4a924f4b796
SHA512e0c7c3e0cc5bdd733896e160f4da804cda49ad16b408131cf4b1254dc0812554c920cb36bb05c58ddb1ce100539117f43054ede903bdb73da0b9f3b6e7de55ac
-
C:\Users\Admin\AppData\Local\Temp\7zS4184.tmp\m7ZDRU8zPDzUFR.dllFilesize
748KB
MD5c4836ef373cdfa7eac3738c59ae9fb83
SHA12f019c1b3357e3be378ac804acfc98ec4f80b576
SHA2565c7ba1a9e0bf346f3b4baa8e6965981b0ff412eabc879ecc531e98f268c34e3e
SHA512e459aeba63802639c8e7245afc139d86e75a805e14b90318b926ff00fe384d14ac209dc76fb88319218c89fe1562c737ed4c5847cd92e698d529ba6737c2fb4d
-
C:\Users\Admin\AppData\Local\Temp\7zS4184.tmp\m7ZDRU8zPDzUFR.tlbFilesize
3KB
MD5f461159d95e1a49a534ad0320ff3984b
SHA1e3363285437846f046b126adbcd8e4789aa1f486
SHA256d6967480d6f6fd4b9d31fb7e38ee6f04c76c36edd2795f852ec3938d984993d6
SHA5122a12587d4a69c967771d8b4ed43e857a81899e177d5ec8ddf8365eaa4e8752032fac8d25b5c3a89ae5efc82b4c6dfd4ba2d26e998b3ad95cc8fdc6ef0c7416ed
-
C:\Users\Admin\AppData\Local\Temp\7zS4184.tmp\m7ZDRU8zPDzUFR.x64.dllFilesize
887KB
MD5fe714aa952e86e33b2cc1652e0f7f6cb
SHA125927512b7bef5f0586f7edab4d4804ec43409aa
SHA256c4fc97da6b3393137f1711238c3ac18d36f903d256a9205fd40e71b4c99ce579
SHA512fe5ac276c14bf2f5e59a1c4acccb98404cbbbe0bceed92a69e5860445682c44d8575ef6926706b9d750bcbf8dca539503547c4f693a8b28cb2e3463760c2c5a7
-
C:\Users\Admin\AppData\Local\Temp\7zS4184.tmp\null\background.htmlFilesize
146B
MD5590e79e284aaf1f722568774e59634c3
SHA1a171123006ddecc2b5d24f54afda6e1fd9d50551
SHA25692fcbcfb3bcd92b01de36e55e0a9537d6accb4aeea4abf75c7b21e4041da15b8
SHA512f6c8ae6905290d37641738327e53ac882e9ecee2e2aab05258b9a4228e071e39ef5acca9fa43d89f3cc413557aa204342bae6ffb4e33c7ed88fb57d4c7c06b7b
-
C:\Users\Admin\AppData\Local\Temp\7zS4184.tmp\null\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zS4184.tmp\null\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zS4184.tmp\null\manifest.jsonFilesize
507B
MD5d429395a45a9aa09e4ee9054e9196b30
SHA1c5dbab4e27650b07d4d159c305d08a9d578c3a3e
SHA256674fc32cde82ed69cb8595bbea9f70f69097062c39bd6a3a505227a4f4a45344
SHA5124a5bc7c005e573bf0cdb89489d676fb26c5fe116d397a6cd7a1ebb2cae9605b3d1657378e17d354cb102e93c39b32fa8d2963f375af37c871452f3170356101e
-
C:\Users\Admin\AppData\Local\Temp\7zS4184.tmp\null\z685S6ML0.jsFilesize
5KB
MD59d0c8f3f1bccbd3bd6188745714aeaec
SHA1dbf012c9c4d3a5638d87445732633e6d0a2c129c
SHA2564c2028d3777bbcb4891db9badf0b27edffa892de2ba3c09d01d5b22000d243ec
SHA51223d8d49e435c70d7d266a351426082f693242e560fc4b2e64174242c5fe867663c1d615765b31c9c3afe11684bea0c697487cd31b06434f9c1e9066f0f7daa32
-
\Program Files (x86)\YoutubeAdBlocke\m7ZDRU8zPDzUFR.dllFilesize
748KB
MD5c4836ef373cdfa7eac3738c59ae9fb83
SHA12f019c1b3357e3be378ac804acfc98ec4f80b576
SHA2565c7ba1a9e0bf346f3b4baa8e6965981b0ff412eabc879ecc531e98f268c34e3e
SHA512e459aeba63802639c8e7245afc139d86e75a805e14b90318b926ff00fe384d14ac209dc76fb88319218c89fe1562c737ed4c5847cd92e698d529ba6737c2fb4d
-
\Program Files (x86)\YoutubeAdBlocke\m7ZDRU8zPDzUFR.x64.dllFilesize
887KB
MD5fe714aa952e86e33b2cc1652e0f7f6cb
SHA125927512b7bef5f0586f7edab4d4804ec43409aa
SHA256c4fc97da6b3393137f1711238c3ac18d36f903d256a9205fd40e71b4c99ce579
SHA512fe5ac276c14bf2f5e59a1c4acccb98404cbbbe0bceed92a69e5860445682c44d8575ef6926706b9d750bcbf8dca539503547c4f693a8b28cb2e3463760c2c5a7
-
\Program Files (x86)\YoutubeAdBlocke\m7ZDRU8zPDzUFR.x64.dllFilesize
887KB
MD5fe714aa952e86e33b2cc1652e0f7f6cb
SHA125927512b7bef5f0586f7edab4d4804ec43409aa
SHA256c4fc97da6b3393137f1711238c3ac18d36f903d256a9205fd40e71b4c99ce579
SHA512fe5ac276c14bf2f5e59a1c4acccb98404cbbbe0bceed92a69e5860445682c44d8575ef6926706b9d750bcbf8dca539503547c4f693a8b28cb2e3463760c2c5a7
-
\Users\Admin\AppData\Local\Temp\7zS4184.tmp\EeoudPT1WmZWV58.exeFilesize
765KB
MD5102dfa10cc29d7f1ded876dfd7274280
SHA1f26e57d916bf7c5c3a4b49a2edaf30e945b0b44e
SHA25667d9ee9e36b29e081ff2084dc488b0b6c4120e791a5c33ce6027cf89718e4bb3
SHA512c3b7bb463873420f1582880308acca440c24fefaf45c9ad75319665e07c0f4548bd6fe07fabec48edd138a495a2607297773b16400e351e68a7462b45fb2c0c2
-
memory/1500-77-0x0000000000000000-mapping.dmp
-
memory/1500-78-0x000007FEFB881000-0x000007FEFB883000-memory.dmpFilesize
8KB
-
memory/1552-73-0x0000000000000000-mapping.dmp
-
memory/1876-56-0x0000000000000000-mapping.dmp
-
memory/1960-54-0x0000000075A11000-0x0000000075A13000-memory.dmpFilesize
8KB