c4c822d645b079641da3c60c2ab598422f234aebe6b016195643e76569fce123

Analysis

max time kernel
189s
max time network
196s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 19:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c4c822d645b079641da3c60c2ab598422f234aebe6b016195643e76569fce123.exe
Size

2.5MB
MD5

df102175dc7b5f366615a4fd78dc6e5c
SHA1

fbb18f0e13932b4d41bafb1a61fb2d15cc94f9e4
SHA256

c4c822d645b079641da3c60c2ab598422f234aebe6b016195643e76569fce123
SHA512

4c2f967586bdb081e594b366c28cb3763215f595a06c7c2b7f2a1b5cadb8b0af365199a11138c10cbc950ae30970ab03b17ca3c8d49d088fc1469bb6f760a79f
SSDEEP

49152:h1Os++QK3xQpjajXKioFMpYphqd3ArqvFUmEaDxEAxh4UR9TEB:h1O4QCjbKioVg3ArKh40W

Score

8^/10

adware discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

sZ8ZykxAk0DRALp.exe

pid process

4432 sZ8ZykxAk0DRALp.exe
Loads dropped DLL 3 IoCs

Processes:

sZ8ZykxAk0DRALp.exeregsvr32.exeregsvr32.exe

pid process

4432 sZ8ZykxAk0DRALp.exe
2540 regsvr32.exe
4748 regsvr32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
4432	sZ8ZykxAk0DRALp.exe

pid	process
4432	sZ8ZykxAk0DRALp.exe
2540	regsvr32.exe
4748	regsvr32.exe

Installs/modifies Browser Helper Object 2 TTPs 9 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

sZ8ZykxAk0DRALp.exeregsvr32.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	sZ8ZykxAk0DRALp.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	sZ8ZykxAk0DRALp.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	sZ8ZykxAk0DRALp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\	sZ8ZykxAk0DRALp.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{DBC80044-A445-435B-BC74-9C25C1C588A9}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\	regsvr32.exe

Drops file in Program Files directory 8 IoCs

Processes:

sZ8ZykxAk0DRALp.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\YoutubeAdBlocke\KvrDlqck6AYdAx.dat	sZ8ZykxAk0DRALp.exe
File created	C:\Program Files (x86)\YoutubeAdBlocke\KvrDlqck6AYdAx.x64.dll	sZ8ZykxAk0DRALp.exe
File opened for modification	C:\Program Files (x86)\YoutubeAdBlocke\KvrDlqck6AYdAx.x64.dll	sZ8ZykxAk0DRALp.exe
File created	C:\Program Files (x86)\YoutubeAdBlocke\KvrDlqck6AYdAx.dll	sZ8ZykxAk0DRALp.exe
File opened for modification	C:\Program Files (x86)\YoutubeAdBlocke\KvrDlqck6AYdAx.dll	sZ8ZykxAk0DRALp.exe
File created	C:\Program Files (x86)\YoutubeAdBlocke\KvrDlqck6AYdAx.tlb	sZ8ZykxAk0DRALp.exe
File opened for modification	C:\Program Files (x86)\YoutubeAdBlocke\KvrDlqck6AYdAx.tlb	sZ8ZykxAk0DRALp.exe
File created	C:\Program Files (x86)\YoutubeAdBlocke\KvrDlqck6AYdAx.dat	sZ8ZykxAk0DRALp.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

sZ8ZykxAk0DRALp.exe

pid process

4432 sZ8ZykxAk0DRALp.exe
4432 sZ8ZykxAk0DRALp.exe

pid	process
4432	sZ8ZykxAk0DRALp.exe
4432	sZ8ZykxAk0DRALp.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

c4c822d645b079641da3c60c2ab598422f234aebe6b016195643e76569fce123.exesZ8ZykxAk0DRALp.exeregsvr32.exe

description	pid	process	target process
PID 4236 wrote to memory of 4432	4236	c4c822d645b079641da3c60c2ab598422f234aebe6b016195643e76569fce123.exe	sZ8ZykxAk0DRALp.exe
PID 4236 wrote to memory of 4432	4236	c4c822d645b079641da3c60c2ab598422f234aebe6b016195643e76569fce123.exe	sZ8ZykxAk0DRALp.exe
PID 4236 wrote to memory of 4432	4236	c4c822d645b079641da3c60c2ab598422f234aebe6b016195643e76569fce123.exe	sZ8ZykxAk0DRALp.exe
PID 4432 wrote to memory of 2540	4432	sZ8ZykxAk0DRALp.exe	regsvr32.exe
PID 4432 wrote to memory of 2540	4432	sZ8ZykxAk0DRALp.exe	regsvr32.exe
PID 4432 wrote to memory of 2540	4432	sZ8ZykxAk0DRALp.exe	regsvr32.exe
PID 2540 wrote to memory of 4748	2540	regsvr32.exe	regsvr32.exe
PID 2540 wrote to memory of 4748	2540	regsvr32.exe	regsvr32.exe

C:\Users\Admin\AppData\Local\Temp\c4c822d645b079641da3c60c2ab598422f234aebe6b016195643e76569fce123.exe
"C:\Users\Admin\AppData\Local\Temp\c4c822d645b079641da3c60c2ab598422f234aebe6b016195643e76569fce123.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4236

C:\Users\Admin\AppData\Local\Temp\7zS253B.tmp\sZ8ZykxAk0DRALp.exe
.\sZ8ZykxAk0DRALp.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4432

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s "C:\Program Files (x86)\YoutubeAdBlocke\KvrDlqck6AYdAx.x64.dll"
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2540

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\YoutubeAdBlocke\KvrDlqck6AYdAx.x64.dll"
4⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
PID:4748

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\YoutubeAdBlocke\KvrDlqck6AYdAx.dat
Filesize
6KB

MD5
ce7cd7384272423708b76b1e3d09dbd5

SHA1
c208c24a7f3b2e9284c94c0023899b2f6e2a4ea6

SHA256
c15a7c9618dfbf47c31ed99172ac6be3a5b506664daded7b9205a9cab6bed19c

SHA512
88fb8220bb8447dd3d34e38adad0eefa85e198c138e646d90cb3e4dd6154ff6bd33db736e91048ddba10b4a1720631754bc9499aac7406d81ef66004ef77726f

Download Submit
C:\Program Files (x86)\YoutubeAdBlocke\KvrDlqck6AYdAx.dll
Filesize
748KB

MD5
c4836ef373cdfa7eac3738c59ae9fb83

SHA1
2f019c1b3357e3be378ac804acfc98ec4f80b576

SHA256
5c7ba1a9e0bf346f3b4baa8e6965981b0ff412eabc879ecc531e98f268c34e3e

SHA512
e459aeba63802639c8e7245afc139d86e75a805e14b90318b926ff00fe384d14ac209dc76fb88319218c89fe1562c737ed4c5847cd92e698d529ba6737c2fb4d

Download Submit
C:\Program Files (x86)\YoutubeAdBlocke\KvrDlqck6AYdAx.x64.dll
Filesize
887KB

MD5
fe714aa952e86e33b2cc1652e0f7f6cb

SHA1
25927512b7bef5f0586f7edab4d4804ec43409aa

SHA256
c4fc97da6b3393137f1711238c3ac18d36f903d256a9205fd40e71b4c99ce579

SHA512
fe5ac276c14bf2f5e59a1c4acccb98404cbbbe0bceed92a69e5860445682c44d8575ef6926706b9d750bcbf8dca539503547c4f693a8b28cb2e3463760c2c5a7

Download Submit
C:\Program Files (x86)\YoutubeAdBlocke\KvrDlqck6AYdAx.x64.dll
Filesize
887KB

MD5
fe714aa952e86e33b2cc1652e0f7f6cb

SHA1
25927512b7bef5f0586f7edab4d4804ec43409aa

SHA256
c4fc97da6b3393137f1711238c3ac18d36f903d256a9205fd40e71b4c99ce579

SHA512
fe5ac276c14bf2f5e59a1c4acccb98404cbbbe0bceed92a69e5860445682c44d8575ef6926706b9d750bcbf8dca539503547c4f693a8b28cb2e3463760c2c5a7

Download Submit
C:\Program Files (x86)\YoutubeAdBlocke\KvrDlqck6AYdAx.x64.dll
Filesize
887KB

MD5
fe714aa952e86e33b2cc1652e0f7f6cb

SHA1
25927512b7bef5f0586f7edab4d4804ec43409aa

SHA256
c4fc97da6b3393137f1711238c3ac18d36f903d256a9205fd40e71b4c99ce579

SHA512
fe5ac276c14bf2f5e59a1c4acccb98404cbbbe0bceed92a69e5860445682c44d8575ef6926706b9d750bcbf8dca539503547c4f693a8b28cb2e3463760c2c5a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS253B.tmp\KvrDlqck6AYdAx.dll
Filesize
748KB

MD5
c4836ef373cdfa7eac3738c59ae9fb83

SHA1
2f019c1b3357e3be378ac804acfc98ec4f80b576

SHA256
5c7ba1a9e0bf346f3b4baa8e6965981b0ff412eabc879ecc531e98f268c34e3e

SHA512
e459aeba63802639c8e7245afc139d86e75a805e14b90318b926ff00fe384d14ac209dc76fb88319218c89fe1562c737ed4c5847cd92e698d529ba6737c2fb4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS253B.tmp\KvrDlqck6AYdAx.tlb
Filesize
3KB

MD5
f461159d95e1a49a534ad0320ff3984b

SHA1
e3363285437846f046b126adbcd8e4789aa1f486

SHA256
d6967480d6f6fd4b9d31fb7e38ee6f04c76c36edd2795f852ec3938d984993d6

SHA512
2a12587d4a69c967771d8b4ed43e857a81899e177d5ec8ddf8365eaa4e8752032fac8d25b5c3a89ae5efc82b4c6dfd4ba2d26e998b3ad95cc8fdc6ef0c7416ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS253B.tmp\KvrDlqck6AYdAx.x64.dll
Filesize
887KB

MD5
fe714aa952e86e33b2cc1652e0f7f6cb

SHA1
25927512b7bef5f0586f7edab4d4804ec43409aa

SHA256
c4fc97da6b3393137f1711238c3ac18d36f903d256a9205fd40e71b4c99ce579

SHA512
fe5ac276c14bf2f5e59a1c4acccb98404cbbbe0bceed92a69e5860445682c44d8575ef6926706b9d750bcbf8dca539503547c4f693a8b28cb2e3463760c2c5a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS253B.tmp\null\background.html
Filesize
141B

MD5
3e59ca8aa5a95a2e051a97b33d538480

SHA1
22a64cf310c93307b5b657bca8592382eaeda505

SHA256
607d981239513cf6775c93a18e829b7c94d7df258dc944a618f61e749d8cc2f5

SHA512
05118d2738fa1a4f91daaf7da1f7f288481eb58ddc5d25f7dc1974721c4b2d66b5c0c4e978019b734d01c39a7185b0a0f173d2f9087da848c25d06aecbf12062

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS253B.tmp\null\cCJm.js
Filesize
5KB

MD5
7fb69795444f2b583693bc32eac96e96

SHA1
f235424bbe6d0cf0454db3a275a0aaf6184b5026

SHA256
e6e603c23bd648fb900a081030cc4dcd1c5cc654f92a3cf4ec15d491e96c230c

SHA512
9efe0ff365b67453cd0fb8ddd40d5eaae06bf3628e15275f01d204972a3af2b026dc745be2fd86a89fcaf1312d40a07fcc303d45097a8b6a00b9e89ee3fd1052

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS253B.tmp\null\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS253B.tmp\null\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS253B.tmp\null\manifest.json
Filesize
507B

MD5
d429395a45a9aa09e4ee9054e9196b30

SHA1
c5dbab4e27650b07d4d159c305d08a9d578c3a3e

SHA256
674fc32cde82ed69cb8595bbea9f70f69097062c39bd6a3a505227a4f4a45344

SHA512
4a5bc7c005e573bf0cdb89489d676fb26c5fe116d397a6cd7a1ebb2cae9605b3d1657378e17d354cb102e93c39b32fa8d2963f375af37c871452f3170356101e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS253B.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS253B.tmp\[email protected]\chrome.manifest
Filesize
35B

MD5
9bbac544eda174bce9181e9d98c5e0a2

SHA1
5f90cfb304855941ec2163271585a5d2ae74f909

SHA256
e132db5287286f3c6d7c629874b3d2115b3a66cbc6a8875c44187f15e2d9ecec

SHA512
d7c8a375c1b29b7416476b3e591b77d8924e537f47a1d2722bb2dc9e255ccbf90a18e00ec96e10b89080634f999520fc0a9a17b4392c1985dfeb3f92c2230586

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS253B.tmp\[email protected]\content\bg.js
Filesize
7KB

MD5
698915839ae9be0b56eca2687d1e896a

SHA1
c631206ee8870740718fad38ac80f0aef11a7e8a

SHA256
475a2c50db404c480ece6d15de33de7935032908f0e48d7a8ff4f0961e79eb9c

SHA512
8be6934f2ed78fbaf963d7cbfced7abac30a0c6f757a35bfb1d3f029bec4b48cf9671a6932f35fcbf17aa0b11ed7b1faa18cd737c58a8d7e629bc42b2be58332

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS253B.tmp\[email protected]\install.rdf
Filesize
606B

MD5
7002d082b7faf94c3c510de0b164c549

SHA1
2989e0f56e28df339bdfde1ef3b25cf1acebd74d

SHA256
078a9e39b80a5593a64a015f874f068643f75978acb1cf778e6df93ca5f76dc4

SHA512
fef951f8903ecd64450dc2bc98c7986d9abec6c3ac6156310b3d88e72e608aacd4c6b24f4490bae72d65e01b548a770442269be48b99319c4a90a7028b63b94c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS253B.tmp\sZ8ZykxAk0DRALp.dat
Filesize
6KB

MD5
ce7cd7384272423708b76b1e3d09dbd5

SHA1
c208c24a7f3b2e9284c94c0023899b2f6e2a4ea6

SHA256
c15a7c9618dfbf47c31ed99172ac6be3a5b506664daded7b9205a9cab6bed19c

SHA512
88fb8220bb8447dd3d34e38adad0eefa85e198c138e646d90cb3e4dd6154ff6bd33db736e91048ddba10b4a1720631754bc9499aac7406d81ef66004ef77726f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS253B.tmp\sZ8ZykxAk0DRALp.exe
Filesize
765KB

MD5
102dfa10cc29d7f1ded876dfd7274280

SHA1
f26e57d916bf7c5c3a4b49a2edaf30e945b0b44e

SHA256
67d9ee9e36b29e081ff2084dc488b0b6c4120e791a5c33ce6027cf89718e4bb3

SHA512
c3b7bb463873420f1582880308acca440c24fefaf45c9ad75319665e07c0f4548bd6fe07fabec48edd138a495a2607297773b16400e351e68a7462b45fb2c0c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS253B.tmp\sZ8ZykxAk0DRALp.exe
Filesize
765KB

MD5
102dfa10cc29d7f1ded876dfd7274280

SHA1
f26e57d916bf7c5c3a4b49a2edaf30e945b0b44e

SHA256
67d9ee9e36b29e081ff2084dc488b0b6c4120e791a5c33ce6027cf89718e4bb3

SHA512
c3b7bb463873420f1582880308acca440c24fefaf45c9ad75319665e07c0f4548bd6fe07fabec48edd138a495a2607297773b16400e351e68a7462b45fb2c0c2

Download Submit
memory/2540-149-0x0000000000000000-mapping.dmp

Download
memory/4432-132-0x0000000000000000-mapping.dmp

Download
memory/4748-152-0x0000000000000000-mapping.dmp

Download