707942729f0bae6fc0478c8b39357bd6801940c4154ee8db4632fa20ddbd6b1b

Analysis

max time kernel
18s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 20:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

707942729f0bae6fc0478c8b39357bd6801940c4154ee8db4632fa20ddbd6b1b.exe
Size

2.1MB
MD5

c83efe12c0e8789b2a338e5898582e9b
SHA1

b8593be8f142fddc764a8530fa86669f522c65d0
SHA256

707942729f0bae6fc0478c8b39357bd6801940c4154ee8db4632fa20ddbd6b1b
SHA512

f4b28a1cbce0ed3a122c68fd2efd1c3d8ddd4d60cf59373200df9777f647dec7f079dd4b5eda4f85f4e38712316519598f33900c6642a32b5743e2d52fc3b48d
SSDEEP

49152:h1Os2a+y5xECQXXb/tUkOHelsTTCjqYxq/:h1OztBOHSbe

Score

8^/10

adware discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
828	yAUXaeZWbiwNnaT.exe

Loads dropped DLL 4 IoCs

pid	Process
1128	707942729f0bae6fc0478c8b39357bd6801940c4154ee8db4632fa20ddbd6b1b.exe
828	yAUXaeZWbiwNnaT.exe
668	regsvr32.exe
1276	regsvr32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bebkeljmdkpmhcnclinijjoogllcgkjn\1.0\manifest.json	yAUXaeZWbiwNnaT.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\bebkeljmdkpmhcnclinijjoogllcgkjn\1.0\manifest.json	yAUXaeZWbiwNnaT.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\bebkeljmdkpmhcnclinijjoogllcgkjn\1.0\manifest.json	yAUXaeZWbiwNnaT.exe

Installs/modifies Browser Helper Object 2 TTPs 11 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\	yAUXaeZWbiwNnaT.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435B-BC74-9C25C1C588A9}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}	yAUXaeZWbiwNnaT.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}	yAUXaeZWbiwNnaT.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects	yAUXaeZWbiwNnaT.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}	yAUXaeZWbiwNnaT.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}	regsvr32.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\YoutubeAdBlocke\HbmZQTLauoNNVQ.dat	yAUXaeZWbiwNnaT.exe
File opened for modification	C:\Program Files (x86)\YoutubeAdBlocke\HbmZQTLauoNNVQ.dat	yAUXaeZWbiwNnaT.exe
File created	C:\Program Files (x86)\YoutubeAdBlocke\HbmZQTLauoNNVQ.x64.dll	yAUXaeZWbiwNnaT.exe
File opened for modification	C:\Program Files (x86)\YoutubeAdBlocke\HbmZQTLauoNNVQ.x64.dll	yAUXaeZWbiwNnaT.exe
File created	C:\Program Files (x86)\YoutubeAdBlocke\HbmZQTLauoNNVQ.dll	yAUXaeZWbiwNnaT.exe
File opened for modification	C:\Program Files (x86)\YoutubeAdBlocke\HbmZQTLauoNNVQ.dll	yAUXaeZWbiwNnaT.exe
File created	C:\Program Files (x86)\YoutubeAdBlocke\HbmZQTLauoNNVQ.tlb	yAUXaeZWbiwNnaT.exe
File opened for modification	C:\Program Files (x86)\YoutubeAdBlocke\HbmZQTLauoNNVQ.tlb	yAUXaeZWbiwNnaT.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 828	1128	707942729f0bae6fc0478c8b39357bd6801940c4154ee8db4632fa20ddbd6b1b.exe	28
PID 1128 wrote to memory of 828	1128	707942729f0bae6fc0478c8b39357bd6801940c4154ee8db4632fa20ddbd6b1b.exe	28
PID 1128 wrote to memory of 828	1128	707942729f0bae6fc0478c8b39357bd6801940c4154ee8db4632fa20ddbd6b1b.exe	28
PID 1128 wrote to memory of 828	1128	707942729f0bae6fc0478c8b39357bd6801940c4154ee8db4632fa20ddbd6b1b.exe	28
PID 828 wrote to memory of 668	828	yAUXaeZWbiwNnaT.exe	29
PID 828 wrote to memory of 668	828	yAUXaeZWbiwNnaT.exe	29
PID 828 wrote to memory of 668	828	yAUXaeZWbiwNnaT.exe	29
PID 828 wrote to memory of 668	828	yAUXaeZWbiwNnaT.exe	29
PID 828 wrote to memory of 668	828	yAUXaeZWbiwNnaT.exe	29
PID 828 wrote to memory of 668	828	yAUXaeZWbiwNnaT.exe	29
PID 828 wrote to memory of 668	828	yAUXaeZWbiwNnaT.exe	29
PID 668 wrote to memory of 1276	668	regsvr32.exe	30
PID 668 wrote to memory of 1276	668	regsvr32.exe	30
PID 668 wrote to memory of 1276	668	regsvr32.exe	30
PID 668 wrote to memory of 1276	668	regsvr32.exe	30
PID 668 wrote to memory of 1276	668	regsvr32.exe	30
PID 668 wrote to memory of 1276	668	regsvr32.exe	30
PID 668 wrote to memory of 1276	668	regsvr32.exe	30

C:\Users\Admin\AppData\Local\Temp\707942729f0bae6fc0478c8b39357bd6801940c4154ee8db4632fa20ddbd6b1b.exe
"C:\Users\Admin\AppData\Local\Temp\707942729f0bae6fc0478c8b39357bd6801940c4154ee8db4632fa20ddbd6b1b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Users\Admin\AppData\Local\Temp\7zSA5D2.tmp\yAUXaeZWbiwNnaT.exe
  .\yAUXaeZWbiwNnaT.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:828
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Program Files (x86)\YoutubeAdBlocke\HbmZQTLauoNNVQ.x64.dll"
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:668
  - - C:\Windows\system32\regsvr32.exe
      /s "C:\Program Files (x86)\YoutubeAdBlocke\HbmZQTLauoNNVQ.x64.dll"
      4⤵
      Loads dropped DLL
      Installs/modifies Browser Helper Object
      PID:1276

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\YoutubeAdBlocke\HbmZQTLauoNNVQ.dat

Filesize
6KB

MD5
886ac632395d7bdca6130447b422e47c

SHA1
5bcbcc1c39f991d6fd1738bfe8e0c90b2fdb2628

SHA256
98baece910c4ef91139cb7f9992b44ca332d1182341c121f7d3fc8fe99d357e3

SHA512
5a7c147513456a9d72ce43150ece10d2730cfa1f8e2c1fb9cf73c2c2f2f7defeef3b0f0794de83b98c957bf4db499d2d1bd51f9b686a542c325fa5889dd6907e

Download Submit
C:\Program Files (x86)\YoutubeAdBlocke\HbmZQTLauoNNVQ.x64.dll

Filesize
700KB

MD5
0fba9bd6e998f56bfab3ec37cbe6a631

SHA1
6d6e2713ffea8a6a02b97adce0cbcf4c642f1235

SHA256
357015113e010a4bb715d6b6b8c6b08286bdb34adb87656bc249c762a0d239d1

SHA512
88da22df4bf81b3008e143a696ab636748fea4605d77594d3521533416513b9c6ca13433e613bf26fa9678c14e9968b552ff5845c2df205852743032e56bb358

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA5D2.tmp\HbmZQTLauoNNVQ.dll

Filesize
618KB

MD5
080d8ffcd7f74bb06445d791f818881b

SHA1
db62fc6730b548489a72d9c9de26f3a6045d25ab

SHA256
346d5c9733935935c828115a3eed81322dd67cea4574fe135059582719bc2c68

SHA512
b75dab95829d3d6cff47ae2b66218bd0b92798b114bbc55b6a9cf52d38e6baea31071a2bc34ec2210536a1e7e5f67a8ecbc0468bf0c139ead6cabdc657c47d52

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA5D2.tmp\HbmZQTLauoNNVQ.tlb

Filesize
3KB

MD5
16dfbf4806c531622bd907bbbf20fd4d

SHA1
388ca199001cda40623ce6fbe72660553062fb87

SHA256
c569ac7f3994c0fef451e56cbf9c2403fd52b90410d06ce0d4539a0b304b9d83

SHA512
d86f503c052e9cd3e46e29d838ab79e7ffa158f7661c336971e7dfa307cd8b03688a3f9d3b82fc01b699d2167fd25d9eef2a27b6b55f478c6fb775004e6507ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA5D2.tmp\HbmZQTLauoNNVQ.x64.dll

Filesize
700KB

MD5
0fba9bd6e998f56bfab3ec37cbe6a631

SHA1
6d6e2713ffea8a6a02b97adce0cbcf4c642f1235

SHA256
357015113e010a4bb715d6b6b8c6b08286bdb34adb87656bc249c762a0d239d1

SHA512
88da22df4bf81b3008e143a696ab636748fea4605d77594d3521533416513b9c6ca13433e613bf26fa9678c14e9968b552ff5845c2df205852743032e56bb358

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA5D2.tmp\bebkeljmdkpmhcnclinijjoogllcgkjn\background.html

Filesize
145B

MD5
f842daa6598222453401d19bef9159ed

SHA1
44122653bd575667fe1dc9f1e809c9a500b9534d

SHA256
aa67390947064a3f15db8863dec249f01d5a2e3ae212bdfcc2f38c619664ccc4

SHA512
567d9690ca2a34fc2f8345a8d5c2de70dcca692ecea8df9ab567b028d7d95e4e83968555c489a34266773b1f215e6ebf7dbffe85245bd2d240a9ea37c6fe92a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA5D2.tmp\bebkeljmdkpmhcnclinijjoogllcgkjn\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA5D2.tmp\bebkeljmdkpmhcnclinijjoogllcgkjn\khdPnBQo.js

Filesize
5KB

MD5
dcd805bf4c0ab7535585c655e228a2e9

SHA1
eef582d10b8f906067c05fb45750efbb21ce0bad

SHA256
9f580882936b1508b97e5b315dccab6d3abc724d55b58504e92e6287d810d252

SHA512
4f259e9f14afda76c8d11ab60e7ebe3d7fc1492dc169954a39525942a866316963594b675f535df41f56209736b8df87b9ddb554b9d29722e44540cf40307e30

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA5D2.tmp\bebkeljmdkpmhcnclinijjoogllcgkjn\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA5D2.tmp\bebkeljmdkpmhcnclinijjoogllcgkjn\manifest.json

Filesize
507B

MD5
d429395a45a9aa09e4ee9054e9196b30

SHA1
c5dbab4e27650b07d4d159c305d08a9d578c3a3e

SHA256
674fc32cde82ed69cb8595bbea9f70f69097062c39bd6a3a505227a4f4a45344

SHA512
4a5bc7c005e573bf0cdb89489d676fb26c5fe116d397a6cd7a1ebb2cae9605b3d1657378e17d354cb102e93c39b32fa8d2963f375af37c871452f3170356101e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA5D2.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA5D2.tmp\[email protected]\chrome.manifest

Filesize
35B

MD5
cf1b224dc2700d2d94d4f5c58ecfddfe

SHA1
610519ba392f2937025a96650578a3021eaa8e32

SHA256
32926ea963313c5b3b9e68fa6a6201d48723b2b2f06f9aab4b667c5946e860c1

SHA512
6e5f5f7912e088d9cae1325b2d1d5db4923904ad52642000fd9bd765a3f6ea79028311cf6cd3c5fcd52fbaebd75db0e79d64ccf31fa64bb58f4bf627d179847a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA5D2.tmp\[email protected]\content\bg.js

Filesize
7KB

MD5
5ac8caa8f9d8a2bf61280fe92afa5daf

SHA1
1dbcd0756f6605aa0f403f2108365f9b3fee17ac

SHA256
a6149c88ecf3925ae90de351d789b0c38b6527e18d900083c8156e12fa4c1315

SHA512
67005aeeec6f694bb00d65b3d93f68d30877c263d6070d1d8ad00200eb77ade4aeb9ccfc031bc11ed52ff19b0cca7a9234c389a6421599bf19a42e1d3dbb40e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA5D2.tmp\[email protected]\install.rdf

Filesize
607B

MD5
c4db24165646dfc21cb9ece23335a507

SHA1
617b6b8fc1e9a0b9bd72bbc654245ac058e822b0

SHA256
22955d82405421376670e512e1539236b7b0943db029938e4e877c469ae0d1c7

SHA512
0579d52ce8f373698fa6ab988f362c042344256aa525534284c83671be2f7f9375a9579ceac29c73c2a5f7e27274f01cc34f4f1c14f30a01fd2a256f537a6e71

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA5D2.tmp\yAUXaeZWbiwNnaT.dat

Filesize
6KB

MD5
886ac632395d7bdca6130447b422e47c

SHA1
5bcbcc1c39f991d6fd1738bfe8e0c90b2fdb2628

SHA256
98baece910c4ef91139cb7f9992b44ca332d1182341c121f7d3fc8fe99d357e3

SHA512
5a7c147513456a9d72ce43150ece10d2730cfa1f8e2c1fb9cf73c2c2f2f7defeef3b0f0794de83b98c957bf4db499d2d1bd51f9b686a542c325fa5889dd6907e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA5D2.tmp\yAUXaeZWbiwNnaT.exe

Filesize
624KB

MD5
8440fce178bb6c85832b0fbcc81c160c

SHA1
4d9672221d8e16ad24a706d2ba02552d59e9172d

SHA256
f5778940bb1f43bdf05ed87ca14fe95026455aa35c4a71f2b6912f6ed858baaa

SHA512
8160eaff06cf00ea502e570616a4d89778163c2cf7f175801519ed38fb528a753cc32aa17cf627cd738689e213acf747836ecf42571422f2adede6026904e3c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA5D2.tmp\yAUXaeZWbiwNnaT.exe

Filesize
624KB

MD5
8440fce178bb6c85832b0fbcc81c160c

SHA1
4d9672221d8e16ad24a706d2ba02552d59e9172d

SHA256
f5778940bb1f43bdf05ed87ca14fe95026455aa35c4a71f2b6912f6ed858baaa

SHA512
8160eaff06cf00ea502e570616a4d89778163c2cf7f175801519ed38fb528a753cc32aa17cf627cd738689e213acf747836ecf42571422f2adede6026904e3c8

Download Submit
\Program Files (x86)\YoutubeAdBlocke\HbmZQTLauoNNVQ.dll

Filesize
618KB

MD5
080d8ffcd7f74bb06445d791f818881b

SHA1
db62fc6730b548489a72d9c9de26f3a6045d25ab

SHA256
346d5c9733935935c828115a3eed81322dd67cea4574fe135059582719bc2c68

SHA512
b75dab95829d3d6cff47ae2b66218bd0b92798b114bbc55b6a9cf52d38e6baea31071a2bc34ec2210536a1e7e5f67a8ecbc0468bf0c139ead6cabdc657c47d52

Download Submit
\Program Files (x86)\YoutubeAdBlocke\HbmZQTLauoNNVQ.x64.dll

Filesize
700KB

MD5
0fba9bd6e998f56bfab3ec37cbe6a631

SHA1
6d6e2713ffea8a6a02b97adce0cbcf4c642f1235

SHA256
357015113e010a4bb715d6b6b8c6b08286bdb34adb87656bc249c762a0d239d1

SHA512
88da22df4bf81b3008e143a696ab636748fea4605d77594d3521533416513b9c6ca13433e613bf26fa9678c14e9968b552ff5845c2df205852743032e56bb358

Download Submit
\Program Files (x86)\YoutubeAdBlocke\HbmZQTLauoNNVQ.x64.dll

Filesize
700KB

MD5
0fba9bd6e998f56bfab3ec37cbe6a631

SHA1
6d6e2713ffea8a6a02b97adce0cbcf4c642f1235

SHA256
357015113e010a4bb715d6b6b8c6b08286bdb34adb87656bc249c762a0d239d1

SHA512
88da22df4bf81b3008e143a696ab636748fea4605d77594d3521533416513b9c6ca13433e613bf26fa9678c14e9968b552ff5845c2df205852743032e56bb358

Download Submit
\Users\Admin\AppData\Local\Temp\7zSA5D2.tmp\yAUXaeZWbiwNnaT.exe

Filesize
624KB

MD5
8440fce178bb6c85832b0fbcc81c160c

SHA1
4d9672221d8e16ad24a706d2ba02552d59e9172d

SHA256
f5778940bb1f43bdf05ed87ca14fe95026455aa35c4a71f2b6912f6ed858baaa

SHA512
8160eaff06cf00ea502e570616a4d89778163c2cf7f175801519ed38fb528a753cc32aa17cf627cd738689e213acf747836ecf42571422f2adede6026904e3c8

Download Submit
memory/668-73-0x0000000000000000-mapping.dmp

Download
memory/828-56-0x0000000000000000-mapping.dmp

Download
memory/1128-54-0x0000000076531000-0x0000000076533000-memory.dmp

Filesize
8KB

Download
memory/1276-78-0x000007FEFC071000-0x000007FEFC073000-memory.dmp

Filesize
8KB

Download
memory/1276-77-0x0000000000000000-mapping.dmp

Download