e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa

General

Target

e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Size

3.8MB
MD5

713da7b9cc097b59a4f1ef06c8a1067f
SHA1

3981c0c9c2f3aadd66eb320961fc65a3b34e26c1
SHA256

e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa
SHA512

101d2b84830b85ae2c9362ae181a87a6657fdfac32edc5ae9d943e327b18ee93bdeba60ddb9bd31c476347121607f0a021097e40330108189bab5125b9e401b0
SSDEEP

49152:TXGoXjSTWWc6Yak5g2F2r7R7TC7G53wJnLj+oT7sv2CK9rzWXrsGowS:eTI6YrWVC7G8nLioT7svrK9rzAr

Score

8^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{fb2e8a9a-5ddc-4ac2-8c12-997022ecf3e9}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{fb2e8a9a-5ddc-4ac2-8c12-997022ecf3e9}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{fb2e8a9a-5ddc-4ac2-8c12-997022ecf3e9}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{fb2e8a9a-5ddc-4ac2-8c12-997022ecf3e9}\InprocServer32\ = "C:\\Program Files (x86)\\GoSavve\\gZRLalxtDotIno.x64.dll"	regsvr32.exe

Loads dropped DLL 3 IoCs

Processes:

e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exeregsvr32.exeregsvr32.exe

pid process

1664 e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
856 regsvr32.exe
1720 regsvr32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 3 IoCs

Processes:

e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe

description	ioc	process
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ldflipnomncbkddlaipeigjcknanjgec\2.0\manifest.json	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\ldflipnomncbkddlaipeigjcknanjgec\2.0\manifest.json	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ldflipnomncbkddlaipeigjcknanjgec\2.0\manifest.json	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exeregsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{fb2e8a9a-5ddc-4ac2-8c12-997022ecf3e9}	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{fb2e8a9a-5ddc-4ac2-8c12-997022ecf3e9}\ = "GoSavve"	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{fb2e8a9a-5ddc-4ac2-8c12-997022ecf3e9}\NoExplorer = "1"	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FB2E8A9A-5DDC-4AC2-8C12-997022ECF3E9}	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{fb2e8a9a-5ddc-4ac2-8c12-997022ecf3e9}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{fb2e8a9a-5ddc-4ac2-8c12-997022ecf3e9}\ = "GoSavve"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{fb2e8a9a-5ddc-4ac2-8c12-997022ecf3e9}\NoExplorer = "1"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{fb2e8a9a-5ddc-4ac2-8c12-997022ecf3e9}	regsvr32.exe

Drops file in System32 directory 4 IoCs

Processes:

e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe

description	ioc	process
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
File opened for modification	C:\Windows\System32\GroupPolicy	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe

Drops file in Program Files directory 8 IoCs

Processes:

e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\GoSavve\gZRLalxtDotIno.tlb	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
File created	C:\Program Files (x86)\GoSavve\gZRLalxtDotIno.dat	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
File opened for modification	C:\Program Files (x86)\GoSavve\gZRLalxtDotIno.dat	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
File created	C:\Program Files (x86)\GoSavve\gZRLalxtDotIno.x64.dll	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
File opened for modification	C:\Program Files (x86)\GoSavve\gZRLalxtDotIno.x64.dll	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
File created	C:\Program Files (x86)\GoSavve\gZRLalxtDotIno.dll	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
File opened for modification	C:\Program Files (x86)\GoSavve\gZRLalxtDotIno.dll	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
File created	C:\Program Files (x86)\GoSavve\gZRLalxtDotIno.tlb	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

Processes:

regsvr32.exee9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe

description	ioc	process
Key deleted	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{FB2E8A9A-5DDC-4AC2-8C12-997022ECF3E9}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{fb2e8a9a-5ddc-4ac2-8c12-997022ecf3e9}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{fb2e8a9a-5ddc-4ac2-8c12-997022ecf3e9}	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{FB2E8A9A-5DDC-4AC2-8C12-997022ECF3E9}	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe

Modifies registry class 64 IoCs

Processes:

e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exeregsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\ = "GoSavve"	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{fb2e8a9a-5ddc-4ac2-8c12-997022ecf3e9}\VersionIndependentProgID	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\GoSavve"	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0"	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\..9	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0"	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{fb2e8a9a-5ddc-4ac2-8c12-997022ecf3e9}\VersionIndependentProgID\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\ = "GoSavve"	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0"	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID\ = "{fb2e8a9a-5ddc-4ac2-8c12-997022ecf3e9}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{fb2e8a9a-5ddc-4ac2-8c12-997022ecf3e9}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID\ = "{fb2e8a9a-5ddc-4ac2-8c12-997022ecf3e9}"	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{fb2e8a9a-5ddc-4ac2-8c12-997022ecf3e9}\VersionIndependentProgID	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{fb2e8a9a-5ddc-4ac2-8c12-997022ecf3e9}\Programmable	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FB2E8A9A-5DDC-4AC2-8C12-997022ECF3E9}	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\Program Files (x86)\\GoSavve\\gZRLalxtDotIno.tlb"	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0"	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0"	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{fb2e8a9a-5ddc-4ac2-8c12-997022ecf3e9}\ProgID\ = ".9"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB2E8A9A-5DDC-4AC2-8C12-997022ECF3E9}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{fb2e8a9a-5ddc-4ac2-8c12-997022ecf3e9}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{fb2e8a9a-5ddc-4ac2-8c12-997022ecf3e9}\VersionIndependentProgID\	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{fb2e8a9a-5ddc-4ac2-8c12-997022ecf3e9}\InprocServer32	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{fb2e8a9a-5ddc-4ac2-8c12-997022ecf3e9}\Programmable	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{fb2e8a9a-5ddc-4ac2-8c12-997022ecf3e9}\ProgID	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{fb2e8a9a-5ddc-4ac2-8c12-997022ecf3e9}\ = "GoSavve"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{fb2e8a9a-5ddc-4ac2-8c12-997022ecf3e9}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry"	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{fb2e8a9a-5ddc-4ac2-8c12-997022ecf3e9}\InprocServer32\ = "C:\\Program Files (x86)\\GoSavve\\gZRLalxtDotIno.x64.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB2E8A9A-5DDC-4AC2-8C12-997022ECF3E9}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{fb2e8a9a-5ddc-4ac2-8c12-997022ecf3e9}\InprocServer32	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage"	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0"	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{fb2e8a9a-5ddc-4ac2-8c12-997022ecf3e9}\Programmable	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{fb2e8a9a-5ddc-4ac2-8c12-997022ecf3e9}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB2E8A9A-5DDC-4AC2-8C12-997022ECF3E9}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe

pid	process
1664	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
1664	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exeregsvr32.exe

description	pid	process	target process
PID 1664 wrote to memory of 856	1664	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe	regsvr32.exe
PID 1664 wrote to memory of 856	1664	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe	regsvr32.exe
PID 1664 wrote to memory of 856	1664	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe	regsvr32.exe
PID 1664 wrote to memory of 856	1664	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe	regsvr32.exe
PID 1664 wrote to memory of 856	1664	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe	regsvr32.exe
PID 1664 wrote to memory of 856	1664	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe	regsvr32.exe
PID 1664 wrote to memory of 856	1664	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe	regsvr32.exe
PID 856 wrote to memory of 1720	856	regsvr32.exe	regsvr32.exe
PID 856 wrote to memory of 1720	856	regsvr32.exe	regsvr32.exe
PID 856 wrote to memory of 1720	856	regsvr32.exe	regsvr32.exe
PID 856 wrote to memory of 1720	856	regsvr32.exe	regsvr32.exe
PID 856 wrote to memory of 1720	856	regsvr32.exe	regsvr32.exe
PID 856 wrote to memory of 1720	856	regsvr32.exe	regsvr32.exe
PID 856 wrote to memory of 1720	856	regsvr32.exe	regsvr32.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{fb2e8a9a-5ddc-4ac2-8c12-997022ecf3e9} = "1"	e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe

C:\Users\Admin\AppData\Local\Temp\e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe
"C:\Users\Admin\AppData\Local\Temp\e9d38b2630843db65ad107806857edfeb8366f5357d7ede5235d3794bf9322fa.exe"
1⤵
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1664

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s "C:\Program Files (x86)\GoSavve\gZRLalxtDotIno.x64.dll"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:856

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\GoSavve\gZRLalxtDotIno.x64.dll"
3⤵
- Registers COM server for autorun
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
PID:1720

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\GoSavve\gZRLalxtDotIno.dat
Filesize
4KB

MD5
d5128090e1b0595d7bc02dc198255fee

SHA1
5aa4967c10a6871235a52f7d4d6db749b47bbec4

SHA256
3539b1c4b72dbfdf4ad09cfe3d8b6367ad0383f9223057f2241cfe946dcfd35a

SHA512
976fecedc029f1b364ccbbaef12657c51c77d5cb5d3e130d925ffd14b5ad512ba9a2bd99e0d724afe483e3dd49efbfe1be3ac96e7cb086d464b26d239c026c52

Download Submit
C:\Program Files (x86)\GoSavve\gZRLalxtDotIno.tlb
Filesize
3KB

MD5
e1ccf2e2dc93dd6a8927a6a4c375cbf3

SHA1
6bb9a0affe3c3b578a9260203e27cf075f0c1e97

SHA256
bf1bebb0095af9e438bc56a22b44e8afc85be11c724101bb9ec5c73086cfd411

SHA512
4a63951366c5cfbb05168bb3c232f5b4ca88e1104fc417fcace08479b11e171928379b2eace384e471f0a96e39aa9c22b8153683c43c961830d2f74c1eae23de

Download Submit
C:\Program Files (x86)\GoSavve\gZRLalxtDotIno.x64.dll
Filesize
698KB

MD5
98554a06d97cb19eb00faf80f1dd48aa

SHA1
ae493d7183f9882f6f130435ab7179da39bca8bd

SHA256
703c564e8a6a1a133a54d15fafe8649f6e4f0b95ca433ef8d4392193e62ebe85

SHA512
5316afa98627223997288d37688acc769fa138368adecb501e1cc62823856c1a2d6175c34ad90bc0e4a6ee6a3d87d70ff6fccee13ae848562ae3eb97cc526cd5

Download Submit
\Program Files (x86)\GoSavve\gZRLalxtDotIno.dll
Filesize
619KB

MD5
5e35cea39dca842e67bac26c3fdd9d1c

SHA1
df707169ba389d66f018c6c91b44fed189bf90f7

SHA256
2ffd483b8f32d93802a44acf46c920ba91a7dcaee0e6bf8b7fd22cecdc27fa3f

SHA512
9ba60c200a22712b86d20407bf98e70e8a9a3a104d0dd5be6a1fb4a547a77d28c1fd824a5af8c6201ff3a98ee451c1ee4fd7902ee79c01e82221e149100e0665

Download Submit
\Program Files (x86)\GoSavve\gZRLalxtDotIno.x64.dll
Filesize
698KB

MD5
98554a06d97cb19eb00faf80f1dd48aa

SHA1
ae493d7183f9882f6f130435ab7179da39bca8bd

SHA256
703c564e8a6a1a133a54d15fafe8649f6e4f0b95ca433ef8d4392193e62ebe85

SHA512
5316afa98627223997288d37688acc769fa138368adecb501e1cc62823856c1a2d6175c34ad90bc0e4a6ee6a3d87d70ff6fccee13ae848562ae3eb97cc526cd5

Download Submit
\Program Files (x86)\GoSavve\gZRLalxtDotIno.x64.dll
Filesize
698KB

MD5
98554a06d97cb19eb00faf80f1dd48aa

SHA1
ae493d7183f9882f6f130435ab7179da39bca8bd

SHA256
703c564e8a6a1a133a54d15fafe8649f6e4f0b95ca433ef8d4392193e62ebe85

SHA512
5316afa98627223997288d37688acc769fa138368adecb501e1cc62823856c1a2d6175c34ad90bc0e4a6ee6a3d87d70ff6fccee13ae848562ae3eb97cc526cd5

Download Submit
memory/856-61-0x0000000000000000-mapping.dmp

Download
memory/1664-54-0x0000000076181000-0x0000000076183000-memory.dmp

Filesize
8KB

Download
memory/1664-55-0x00000000028A0000-0x0000000002942000-memory.dmp

Filesize
648KB

Download
memory/1720-65-0x0000000000000000-mapping.dmp

Download
memory/1720-66-0x000007FEFC621000-0x000007FEFC623000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads