76c2e1d965996cb1ea5cd94bb106ea25d709882d138f07c0e6175b5b2a6de8f8

Analysis

max time kernel
35s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 20:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

76c2e1d965996cb1ea5cd94bb106ea25d709882d138f07c0e6175b5b2a6de8f8.exe
Size

2.1MB
MD5

e70934771daf0c83d0569d3ccd5f0dcb
SHA1

a33e7385ba2026c2a8fc36a78352dfd80ef2bbb0
SHA256

76c2e1d965996cb1ea5cd94bb106ea25d709882d138f07c0e6175b5b2a6de8f8
SHA512

767a8ed2f7f3cb079bd352e44d1a7a17d471747dfe2aa69aa25312cca426f8aa40529730d77b3f9358d3df1e6b507483f0e8fe84b4210fa52d55db97752f3284
SSDEEP

49152:h1OsRBNPM6n5oHCZdw3CyvHht6wqM7M1cHi0:h1OCBjn5oHCZMDvHhrqMMo

Score

8^/10

adware discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1676	Qog1SB6fTWr2050.exe

Loads dropped DLL 4 IoCs

pid	Process
1944	76c2e1d965996cb1ea5cd94bb106ea25d709882d138f07c0e6175b5b2a6de8f8.exe
1676	Qog1SB6fTWr2050.exe
2024	regsvr32.exe
1992	regsvr32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpafmchpildkdpjojfbolkholmkjbgml\1.0\manifest.json	Qog1SB6fTWr2050.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpafmchpildkdpjojfbolkholmkjbgml\1.0\manifest.json	Qog1SB6fTWr2050.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpafmchpildkdpjojfbolkholmkjbgml\1.0\manifest.json	Qog1SB6fTWr2050.exe

Installs/modifies Browser Helper Object 2 TTPs 11 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435B-BC74-9C25C1C588A9}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}	Qog1SB6fTWr2050.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}	Qog1SB6fTWr2050.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\	Qog1SB6fTWr2050.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}	Qog1SB6fTWr2050.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects	Qog1SB6fTWr2050.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\YoutubeAdBlocke\VJeBqVQACH2ETF.dat	Qog1SB6fTWr2050.exe
File created	C:\Program Files (x86)\YoutubeAdBlocke\VJeBqVQACH2ETF.x64.dll	Qog1SB6fTWr2050.exe
File opened for modification	C:\Program Files (x86)\YoutubeAdBlocke\VJeBqVQACH2ETF.x64.dll	Qog1SB6fTWr2050.exe
File created	C:\Program Files (x86)\YoutubeAdBlocke\VJeBqVQACH2ETF.dll	Qog1SB6fTWr2050.exe
File opened for modification	C:\Program Files (x86)\YoutubeAdBlocke\VJeBqVQACH2ETF.dll	Qog1SB6fTWr2050.exe
File created	C:\Program Files (x86)\YoutubeAdBlocke\VJeBqVQACH2ETF.tlb	Qog1SB6fTWr2050.exe
File opened for modification	C:\Program Files (x86)\YoutubeAdBlocke\VJeBqVQACH2ETF.tlb	Qog1SB6fTWr2050.exe
File created	C:\Program Files (x86)\YoutubeAdBlocke\VJeBqVQACH2ETF.dat	Qog1SB6fTWr2050.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1676	Qog1SB6fTWr2050.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 1676	1944	76c2e1d965996cb1ea5cd94bb106ea25d709882d138f07c0e6175b5b2a6de8f8.exe	28
PID 1944 wrote to memory of 1676	1944	76c2e1d965996cb1ea5cd94bb106ea25d709882d138f07c0e6175b5b2a6de8f8.exe	28
PID 1944 wrote to memory of 1676	1944	76c2e1d965996cb1ea5cd94bb106ea25d709882d138f07c0e6175b5b2a6de8f8.exe	28
PID 1944 wrote to memory of 1676	1944	76c2e1d965996cb1ea5cd94bb106ea25d709882d138f07c0e6175b5b2a6de8f8.exe	28
PID 1676 wrote to memory of 2024	1676	Qog1SB6fTWr2050.exe	29
PID 1676 wrote to memory of 2024	1676	Qog1SB6fTWr2050.exe	29
PID 1676 wrote to memory of 2024	1676	Qog1SB6fTWr2050.exe	29
PID 1676 wrote to memory of 2024	1676	Qog1SB6fTWr2050.exe	29
PID 1676 wrote to memory of 2024	1676	Qog1SB6fTWr2050.exe	29
PID 1676 wrote to memory of 2024	1676	Qog1SB6fTWr2050.exe	29
PID 1676 wrote to memory of 2024	1676	Qog1SB6fTWr2050.exe	29
PID 2024 wrote to memory of 1992	2024	regsvr32.exe	30
PID 2024 wrote to memory of 1992	2024	regsvr32.exe	30
PID 2024 wrote to memory of 1992	2024	regsvr32.exe	30
PID 2024 wrote to memory of 1992	2024	regsvr32.exe	30
PID 2024 wrote to memory of 1992	2024	regsvr32.exe	30
PID 2024 wrote to memory of 1992	2024	regsvr32.exe	30
PID 2024 wrote to memory of 1992	2024	regsvr32.exe	30

C:\Users\Admin\AppData\Local\Temp\76c2e1d965996cb1ea5cd94bb106ea25d709882d138f07c0e6175b5b2a6de8f8.exe
"C:\Users\Admin\AppData\Local\Temp\76c2e1d965996cb1ea5cd94bb106ea25d709882d138f07c0e6175b5b2a6de8f8.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Users\Admin\AppData\Local\Temp\7zS1611.tmp\Qog1SB6fTWr2050.exe
  .\Qog1SB6fTWr2050.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1676
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Program Files (x86)\YoutubeAdBlocke\VJeBqVQACH2ETF.x64.dll"
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2024
  - - C:\Windows\system32\regsvr32.exe
      /s "C:\Program Files (x86)\YoutubeAdBlocke\VJeBqVQACH2ETF.x64.dll"
      4⤵
      Loads dropped DLL
      Installs/modifies Browser Helper Object
      PID:1992

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\YoutubeAdBlocke\VJeBqVQACH2ETF.dat

Filesize
6KB

MD5
65fe70122cc0167bc876bb29894c79e5

SHA1
a1338e9768b51931a9562494a13bdb9ab08fba44

SHA256
b02741d8520c7e73fc937e654c4f3896cdb52429333f512d92f23d78e55b5a91

SHA512
64a8cc104d13f7b81cb19bd22763799c1f4ef6a622220fa026088d1f15c8097a7ffa573a686d87f6ed93ec4a6a941ceff3bcf27757d56ae84e513ac68040bd28

Download Submit
C:\Program Files (x86)\YoutubeAdBlocke\VJeBqVQACH2ETF.x64.dll

Filesize
710KB

MD5
2d9b84b8a433eff58888a3240a3a4ff5

SHA1
a59f591168b33de4f42b680fb66c7c7f78b11056

SHA256
4df3323f9cfeb84add405bf9bf36445a22b368c1efb70e109200d94d880bfbb3

SHA512
1cdc6571ae7a8708aaef77f566222aa7cad9da7a77e3e904a56fcfa9238bb6c9993bd455c7f336e4b14e63e61ec8cf4f710567b4b9f420c3133da6dddd10d23e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1611.tmp\Qog1SB6fTWr2050.dat

Filesize
6KB

MD5
65fe70122cc0167bc876bb29894c79e5

SHA1
a1338e9768b51931a9562494a13bdb9ab08fba44

SHA256
b02741d8520c7e73fc937e654c4f3896cdb52429333f512d92f23d78e55b5a91

SHA512
64a8cc104d13f7b81cb19bd22763799c1f4ef6a622220fa026088d1f15c8097a7ffa573a686d87f6ed93ec4a6a941ceff3bcf27757d56ae84e513ac68040bd28

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1611.tmp\Qog1SB6fTWr2050.exe

Filesize
657KB

MD5
b831a4edee2ceadc357e0165ea586f14

SHA1
4bd2c00d1331f52acafd077cb358905bcc40a40b

SHA256
917f3a961b2105519fa358adac37496671751a49a215922ddba8dd3f047c8627

SHA512
805bb79c277be66d0ac821de3f5fe5fbdc2bedfcc5201868d354b63520cccd252b965f2e9c608cb678fc5f391050d42c466c9f79670bd591ea865912517cd6dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1611.tmp\Qog1SB6fTWr2050.exe

Filesize
657KB

MD5
b831a4edee2ceadc357e0165ea586f14

SHA1
4bd2c00d1331f52acafd077cb358905bcc40a40b

SHA256
917f3a961b2105519fa358adac37496671751a49a215922ddba8dd3f047c8627

SHA512
805bb79c277be66d0ac821de3f5fe5fbdc2bedfcc5201868d354b63520cccd252b965f2e9c608cb678fc5f391050d42c466c9f79670bd591ea865912517cd6dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1611.tmp\VJeBqVQACH2ETF.dll

Filesize
629KB

MD5
8f0476d4c7ef0c04523efe17f95ffff8

SHA1
a7605f6101031e5eec2ae964b6ed9d8775434e9e

SHA256
7277b7268f48043af02c5a6793e8c17cf815080bebef610fac956b3cb581d909

SHA512
21a8056c7a7f1d14240f28543bcda3a19fceeebf5dff24da51f71f97a2d4a2c6bdb1e308051eff62b52efe25af5b5de0f88130f9dad2dc440697b7997de36429

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1611.tmp\VJeBqVQACH2ETF.tlb

Filesize
3KB

MD5
ad50e349afc1c3ffb845262f7fc97603

SHA1
b0cc07253796476f702227739c5050247ca2b279

SHA256
8f8d4fc042feb74d414a3a5a761dc5394a4b96f1e5bd818bd01208d0b3e1bcb0

SHA512
6a11d1bab64ba21c5ce51faf209beb9d6a49e488a27a21e20e51f1d0216c8034be0442ceb351a942d3be4d2883c79495afffa776752dce0fd727a0a32e2740a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1611.tmp\VJeBqVQACH2ETF.x64.dll

Filesize
710KB

MD5
2d9b84b8a433eff58888a3240a3a4ff5

SHA1
a59f591168b33de4f42b680fb66c7c7f78b11056

SHA256
4df3323f9cfeb84add405bf9bf36445a22b368c1efb70e109200d94d880bfbb3

SHA512
1cdc6571ae7a8708aaef77f566222aa7cad9da7a77e3e904a56fcfa9238bb6c9993bd455c7f336e4b14e63e61ec8cf4f710567b4b9f420c3133da6dddd10d23e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1611.tmp\kpafmchpildkdpjojfbolkholmkjbgml\KNszI4fv.js

Filesize
5KB

MD5
7163414a23b4f4ef516db06fa7d5bff4

SHA1
09937b52aa6447f8743b91fd4abe82aa47800e17

SHA256
5183ef7adf004990fc8caac2a860f9620e3b4692d39af776b9fcedaa5d302338

SHA512
8f93c4225a79bc93f361ffd7722ddba78cd2437204840c1815806ca69c75e13cdb44c15051210232dfcb8077e7467c6d532b87b633e1b199c0b11f036e9a5257

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1611.tmp\kpafmchpildkdpjojfbolkholmkjbgml\background.html

Filesize
145B

MD5
4d390c60c75276f73a816b045d4cc922

SHA1
4f3b58da7a1df2e69cb98922d40224c91a9d7b9c

SHA256
0af0bb8325100860aa17a29384771f8e217405e4822be113535745bb95b4e1f1

SHA512
8aa2b812c73e4ac4d7879f0b8e5c3c438c9c02205505f5b681f8a98abd8af1b9c106c28369112450ba0d987a9047a6dd44bdc3a5270797e98ae8e1e5fe627d80

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1611.tmp\kpafmchpildkdpjojfbolkholmkjbgml\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1611.tmp\kpafmchpildkdpjojfbolkholmkjbgml\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1611.tmp\kpafmchpildkdpjojfbolkholmkjbgml\manifest.json

Filesize
507B

MD5
d429395a45a9aa09e4ee9054e9196b30

SHA1
c5dbab4e27650b07d4d159c305d08a9d578c3a3e

SHA256
674fc32cde82ed69cb8595bbea9f70f69097062c39bd6a3a505227a4f4a45344

SHA512
4a5bc7c005e573bf0cdb89489d676fb26c5fe116d397a6cd7a1ebb2cae9605b3d1657378e17d354cb102e93c39b32fa8d2963f375af37c871452f3170356101e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1611.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1611.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
31ffdd7bb929662eaa549976e7544d23

SHA1
f4b077b0c38586cfc594bba8757a13b419f05774

SHA256
1dffdb933e6a6f04fc5d8553f6ad1d4d367a8d75348066e9e101a724ed6832c0

SHA512
ddca951aae0b70356e31735047448299e0aca0c2ed8906b3bd2ecc5f259b9f968eb3dae7b825fad760a26bfe1f8398b16a245dc1e2c4e1c9bd952993eb9e38f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1611.tmp\[email protected]\content\bg.js

Filesize
7KB

MD5
d233f4cf4ae2556d948737520f91acbe

SHA1
49ca37a650854310a286a7f387445756f26a499b

SHA256
eb2618fb04cd213fe8440a4789a72fd205816a271c346d9bd28d64392c3b5aad

SHA512
d205f7cb58c7849fcf687acaf91a4871e47d14363f6c4d85bc6a8595d738ed394747947d003c941d8aec82bc9219d5c64d602ecc6efed9b3acbb07a060e28c6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1611.tmp\[email protected]\install.rdf

Filesize
607B

MD5
f2279c37b27d4c9316274ad07cf44fdc

SHA1
7dcdfabd0855a277c62d80b52da572421d1b52f3

SHA256
77332f60a1050c019079a1c354ec0ee524bce4a4c29623e35f4bf37f2dd1b253

SHA512
a33499881983109ee645efbbe30906dae119787d4097b819b3444109b1321d517e7d9ba21ef9b00abb291159522e675e971da6d8c08433b2f38895edad3ae09b

Download Submit
\Program Files (x86)\YoutubeAdBlocke\VJeBqVQACH2ETF.dll

Filesize
629KB

MD5
8f0476d4c7ef0c04523efe17f95ffff8

SHA1
a7605f6101031e5eec2ae964b6ed9d8775434e9e

SHA256
7277b7268f48043af02c5a6793e8c17cf815080bebef610fac956b3cb581d909

SHA512
21a8056c7a7f1d14240f28543bcda3a19fceeebf5dff24da51f71f97a2d4a2c6bdb1e308051eff62b52efe25af5b5de0f88130f9dad2dc440697b7997de36429

Download Submit
\Program Files (x86)\YoutubeAdBlocke\VJeBqVQACH2ETF.x64.dll

Filesize
710KB

MD5
2d9b84b8a433eff58888a3240a3a4ff5

SHA1
a59f591168b33de4f42b680fb66c7c7f78b11056

SHA256
4df3323f9cfeb84add405bf9bf36445a22b368c1efb70e109200d94d880bfbb3

SHA512
1cdc6571ae7a8708aaef77f566222aa7cad9da7a77e3e904a56fcfa9238bb6c9993bd455c7f336e4b14e63e61ec8cf4f710567b4b9f420c3133da6dddd10d23e

Download Submit
\Program Files (x86)\YoutubeAdBlocke\VJeBqVQACH2ETF.x64.dll

Filesize
710KB

MD5
2d9b84b8a433eff58888a3240a3a4ff5

SHA1
a59f591168b33de4f42b680fb66c7c7f78b11056

SHA256
4df3323f9cfeb84add405bf9bf36445a22b368c1efb70e109200d94d880bfbb3

SHA512
1cdc6571ae7a8708aaef77f566222aa7cad9da7a77e3e904a56fcfa9238bb6c9993bd455c7f336e4b14e63e61ec8cf4f710567b4b9f420c3133da6dddd10d23e

Download Submit
\Users\Admin\AppData\Local\Temp\7zS1611.tmp\Qog1SB6fTWr2050.exe

Filesize
657KB

MD5
b831a4edee2ceadc357e0165ea586f14

SHA1
4bd2c00d1331f52acafd077cb358905bcc40a40b

SHA256
917f3a961b2105519fa358adac37496671751a49a215922ddba8dd3f047c8627

SHA512
805bb79c277be66d0ac821de3f5fe5fbdc2bedfcc5201868d354b63520cccd252b965f2e9c608cb678fc5f391050d42c466c9f79670bd591ea865912517cd6dd

Download Submit
memory/1944-54-0x00000000753C1000-0x00000000753C3000-memory.dmp

Filesize
8KB

Download
memory/1992-78-0x000007FEFBA01000-0x000007FEFBA03000-memory.dmp

Filesize
8KB

Download