3cc16476c3a2aac538254a1f1cf58e8d82be587f6b3d0d934642ce4bdc09afde

Analysis

max time kernel
162s
max time network
171s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 08:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3cc16476c3a2aac538254a1f1cf58e8d82be587f6b3d0d934642ce4bdc09afde.exe
Size

3.4MB
MD5

2aaaf07dfe5d67a8521b5f25b5b59664
SHA1

4d7d00cfe863ec188aae41d24b7aee28d0ec1c5b
SHA256

3cc16476c3a2aac538254a1f1cf58e8d82be587f6b3d0d934642ce4bdc09afde
SHA512

954d37ea820f7986aa256474b1805147b656fb491e0d7ed975ef82c30311f211b3b2fbbbdcd343be9d56acd0aef1a3ee93309735a34401a4c59bd3bb4532fe71
SSDEEP

49152:d38YCNewREqae79PndEAPywjFkfSNzSUXcPRNwjCGKRQqEW7riNjocCc4qaC:l8XUgPfzZkq19CGbRoclaC

Score

8^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2016	dllhosts.exe
772	aspnetstate.exe
1156	setup.exe

Loads dropped DLL 15 IoCs

pid	Process
1684	3cc16476c3a2aac538254a1f1cf58e8d82be587f6b3d0d934642ce4bdc09afde.exe
1684	3cc16476c3a2aac538254a1f1cf58e8d82be587f6b3d0d934642ce4bdc09afde.exe
2016	dllhosts.exe
2016	dllhosts.exe
1684	3cc16476c3a2aac538254a1f1cf58e8d82be587f6b3d0d934642ce4bdc09afde.exe
2016	dllhosts.exe
2016	dllhosts.exe
772	aspnetstate.exe
772	aspnetstate.exe
1156	setup.exe
1156	setup.exe
1156	setup.exe
2016	dllhosts.exe
772	aspnetstate.exe
2016	dllhosts.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\svurqisqtgkdcp = "C:\\Windows\\System32\\regsvr32.exe /s \"C:\\Windows\\system32\\vleumrqevovx.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	aspnetstate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\svurqisqtgkdcp = "C:\\Windows\\System32\\regsvr32.exe /s \"C:\\Users\\Admin\\AppData\\Local\\Temp\\nst68B5.tmp.dll\""	aspnetstate.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 6 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{ee0703a2-f718-b183-ce84-ca617a466abc}\NoExplorer = "0"	dllhosts.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D2647D08-D131-2CEC-B9CA-1A7DDBEF154D}	aspnetstate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{D2647D08-D131-2CEC-B9CA-1A7DDBEF154D}\NoExplorer = "1"	aspnetstate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D2647D08-D131-2CEC-B9CA-1A7DDBEF154D}	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{D2647D08-D131-2CEC-B9CA-1A7DDBEF154D}\NoExplorer = "1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ee0703a2-f718-b183-ce84-ca617a466abc}	dllhosts.exe

Maps connected drives based on registry 3 TTPs 9 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\Count	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\Count	dllhosts.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	dllhosts.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	aspnetstate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	aspnetstate.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	dllhosts.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\Count	aspnetstate.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ygabdevonwuho.exe	aspnetstate.exe
File created	C:\Windows\SysWOW64\3afeb524.dll	dllhosts.exe
File created	C:\Windows\SysWOW64\745d5c3e.exe	dllhosts.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 18 IoCs

installer

resource	yara_rule
behavioral1/files/0x000a000000013109-55.dat	nsis_installer_1
behavioral1/files/0x000a000000013109-55.dat	nsis_installer_2
behavioral1/files/0x000a000000013109-57.dat	nsis_installer_1
behavioral1/files/0x000a000000013109-57.dat	nsis_installer_2
behavioral1/files/0x00070000000133af-59.dat	nsis_installer_1
behavioral1/files/0x00070000000133af-59.dat	nsis_installer_2
behavioral1/files/0x00070000000133af-61.dat	nsis_installer_1
behavioral1/files/0x00070000000133af-61.dat	nsis_installer_2
behavioral1/files/0x000a000000013109-63.dat	nsis_installer_1
behavioral1/files/0x000a000000013109-63.dat	nsis_installer_2
behavioral1/files/0x00070000000133e5-66.dat	nsis_installer_1
behavioral1/files/0x00070000000133af-70.dat	nsis_installer_1
behavioral1/files/0x00070000000133af-70.dat	nsis_installer_2
behavioral1/files/0x00070000000133e5-74.dat	nsis_installer_1
behavioral1/files/0x00070000000133e5-76.dat	nsis_installer_1
behavioral1/files/0x00070000000133e5-77.dat	nsis_installer_1
behavioral1/files/0x00070000000133e5-79.dat	nsis_installer_1
behavioral1/files/0x00070000000133e5-78.dat	nsis_installer_1

Modifies Internet Explorer Protected Mode 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	dllhosts.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	aspnetstate.exe

Modifies Internet Explorer Protected Mode Banner 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	dllhosts.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	aspnetstate.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	dllhosts.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3D9F414E-7843-D5DE-C661-D390B704FF01}\Policy = "3"	aspnetstate.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{63EFDF11-6ED7-11ED-A4E1-5E5304B417C2} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3D9F414E-7843-D5DE-C661-D390B704FF01}	aspnetstate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3D9F414E-7843-D5DE-C661-D390B704FF01}\AppName = "regsvr32.exe"	aspnetstate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3D9F414E-7843-D5DE-C661-D390B704FF01}\AppPath = "C:\\Windows\\System32"	aspnetstate.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	aspnetstate.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376375666"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Modifies registry class 17 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ee0703a2-f718-b183-ce84-ca617a466abc}\InProcServer32	dllhosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ee0703a2-f718-b183-ce84-ca617a466abc}\InProcServer32\ThreadingModel = "Apartment"	dllhosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{b33ee05e-0e9f-5672-5ac7-4fedac3dbf5c}\3140288821 = "òÀ¶¢òíô÷ïÇ÷½ªû¶À¦"	dllhosts.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D2647D08-D131-2CEC-B9CA-1A7DDBEF154D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D2647D08-D131-2CEC-B9CA-1A7DDBEF154D}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D2647D08-D131-2CEC-B9CA-1A7DDBEF154D}\InProcServer32\ = "C:\\Windows\\SysWow64\\vleumrqevovx.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D2647D08-D131-2CEC-B9CA-1A7DDBEF154D}	aspnetstate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D2647D08-D131-2CEC-B9CA-1A7DDBEF154D}\InProcServer32	aspnetstate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D2647D08-D131-2CEC-B9CA-1A7DDBEF154D}\ = "revenuestreaming browser enhancer"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ee0703a2-f718-b183-ce84-ca617a466abc}	dllhosts.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\\{b33ee05e-0e9f-5672-5ac7-4fedac3dbf5c}	dllhosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D2647D08-D131-2CEC-B9CA-1A7DDBEF154D}\ = "revenuestreaming browser enhancer"	aspnetstate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D2647D08-D131-2CEC-B9CA-1A7DDBEF154D}\InProcServer32\ThreadingModel = "Apartment"	aspnetstate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D2647D08-D131-2CEC-B9CA-1A7DDBEF154D}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nst68B5.tmp.dll"	aspnetstate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ee0703a2-f718-b183-ce84-ca617a466abc}\ = "yourprofitclub"	dllhosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ee0703a2-f718-b183-ce84-ca617a466abc}\InProcServer32\ = "C:\\Windows\\SysWow64\\3afeb524.dll"	dllhosts.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D2647D08-D131-2CEC-B9CA-1A7DDBEF154D}\InProcServer32	regsvr32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1156	setup.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1400	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1400	iexplore.exe
1400	iexplore.exe
364	IEXPLORE.EXE
364	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 2016	1684	3cc16476c3a2aac538254a1f1cf58e8d82be587f6b3d0d934642ce4bdc09afde.exe	28
PID 1684 wrote to memory of 2016	1684	3cc16476c3a2aac538254a1f1cf58e8d82be587f6b3d0d934642ce4bdc09afde.exe	28
PID 1684 wrote to memory of 2016	1684	3cc16476c3a2aac538254a1f1cf58e8d82be587f6b3d0d934642ce4bdc09afde.exe	28
PID 1684 wrote to memory of 2016	1684	3cc16476c3a2aac538254a1f1cf58e8d82be587f6b3d0d934642ce4bdc09afde.exe	28
PID 1684 wrote to memory of 772	1684	3cc16476c3a2aac538254a1f1cf58e8d82be587f6b3d0d934642ce4bdc09afde.exe	29
PID 1684 wrote to memory of 772	1684	3cc16476c3a2aac538254a1f1cf58e8d82be587f6b3d0d934642ce4bdc09afde.exe	29
PID 1684 wrote to memory of 772	1684	3cc16476c3a2aac538254a1f1cf58e8d82be587f6b3d0d934642ce4bdc09afde.exe	29
PID 1684 wrote to memory of 772	1684	3cc16476c3a2aac538254a1f1cf58e8d82be587f6b3d0d934642ce4bdc09afde.exe	29
PID 1684 wrote to memory of 1156	1684	3cc16476c3a2aac538254a1f1cf58e8d82be587f6b3d0d934642ce4bdc09afde.exe	30
PID 1684 wrote to memory of 1156	1684	3cc16476c3a2aac538254a1f1cf58e8d82be587f6b3d0d934642ce4bdc09afde.exe	30
PID 1684 wrote to memory of 1156	1684	3cc16476c3a2aac538254a1f1cf58e8d82be587f6b3d0d934642ce4bdc09afde.exe	30
PID 1684 wrote to memory of 1156	1684	3cc16476c3a2aac538254a1f1cf58e8d82be587f6b3d0d934642ce4bdc09afde.exe	30
PID 1684 wrote to memory of 1156	1684	3cc16476c3a2aac538254a1f1cf58e8d82be587f6b3d0d934642ce4bdc09afde.exe	30
PID 1684 wrote to memory of 1156	1684	3cc16476c3a2aac538254a1f1cf58e8d82be587f6b3d0d934642ce4bdc09afde.exe	30
PID 1684 wrote to memory of 1156	1684	3cc16476c3a2aac538254a1f1cf58e8d82be587f6b3d0d934642ce4bdc09afde.exe	30
PID 772 wrote to memory of 528	772	aspnetstate.exe	33
PID 772 wrote to memory of 528	772	aspnetstate.exe	33
PID 772 wrote to memory of 528	772	aspnetstate.exe	33
PID 772 wrote to memory of 528	772	aspnetstate.exe	33
PID 772 wrote to memory of 528	772	aspnetstate.exe	33
PID 772 wrote to memory of 528	772	aspnetstate.exe	33
PID 772 wrote to memory of 528	772	aspnetstate.exe	33
PID 1400 wrote to memory of 364	1400	iexplore.exe	35
PID 1400 wrote to memory of 364	1400	iexplore.exe	35
PID 1400 wrote to memory of 364	1400	iexplore.exe	35
PID 1400 wrote to memory of 364	1400	iexplore.exe	35

C:\Users\Admin\AppData\Local\Temp\3cc16476c3a2aac538254a1f1cf58e8d82be587f6b3d0d934642ce4bdc09afde.exe
"C:\Users\Admin\AppData\Local\Temp\3cc16476c3a2aac538254a1f1cf58e8d82be587f6b3d0d934642ce4bdc09afde.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Users\Admin\AppData\Local\Temp\dllhosts.exe
  "C:\Users\Admin\AppData\Local\Temp\dllhosts.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - Maps connected drives based on registry
  - Drops file in System32 directory
  - Modifies Internet Explorer Protected Mode
  - Modifies Internet Explorer Protected Mode Banner
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:2016
- C:\Users\Admin\AppData\Local\Temp\aspnetstate.exe
  "C:\Users\Admin\AppData\Local\Temp\aspnetstate.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Installs/modifies Browser Helper Object
  - Maps connected drives based on registry
  - Drops file in System32 directory
  - Modifies Internet Explorer Protected Mode
  - Modifies Internet Explorer Protected Mode Banner
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:772
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\vleumrqevovx.dll"
    3⤵
    - Adds Run key to start application
    - Installs/modifies Browser Helper Object
    - Maps connected drives based on registry
    - Modifies registry class
    PID:528
- C:\Users\Admin\AppData\Local\Temp\setup.exe
  "C:\Users\Admin\AppData\Local\Temp\setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1156

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1400 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:364

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\aspnetstate.exe

Filesize
404KB

MD5
f02631a1599d143fa8dfe013df84e211

SHA1
8b97ec9f37ea07831d33d9f9dc77f1f00c8c3e89

SHA256
2dcda858882bb5d6dab14846ea8846856c124d89ac08cd1eca614b22aa9f1e70

SHA512
028a10f5be9b0a78fd407d97e76e4149128417c17c2462da30878add44aad7f0920728614a77c95130b958751cfd5dda91570881901bef34e8b5c9e4c76012bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\aspnetstate.exe

Filesize
404KB

MD5
f02631a1599d143fa8dfe013df84e211

SHA1
8b97ec9f37ea07831d33d9f9dc77f1f00c8c3e89

SHA256
2dcda858882bb5d6dab14846ea8846856c124d89ac08cd1eca614b22aa9f1e70

SHA512
028a10f5be9b0a78fd407d97e76e4149128417c17c2462da30878add44aad7f0920728614a77c95130b958751cfd5dda91570881901bef34e8b5c9e4c76012bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\dllhosts.exe

Filesize
2.2MB

MD5
ff642a552115c04cb28055bdb8f89f14

SHA1
f5f0be4f35a1dd498fba0cd7aefdc24756845d8d

SHA256
18e401c86523475e1efeb7403e29cd0773bef2e54f130dfca47c1127f09ba6d3

SHA512
dbabac3c68e8a8ecaa1c3b9c7d8a10b16c93ed490b76ec18e00821ca20ad433962fea010c0d0b07013d972f43e04ee23a089068c8558655d11ce364957f69f59

Download Submit
C:\Users\Admin\AppData\Local\Temp\dllhosts.exe

Filesize
2.2MB

MD5
ff642a552115c04cb28055bdb8f89f14

SHA1
f5f0be4f35a1dd498fba0cd7aefdc24756845d8d

SHA256
18e401c86523475e1efeb7403e29cd0773bef2e54f130dfca47c1127f09ba6d3

SHA512
dbabac3c68e8a8ecaa1c3b9c7d8a10b16c93ed490b76ec18e00821ca20ad433962fea010c0d0b07013d972f43e04ee23a089068c8558655d11ce364957f69f59

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.exe

Filesize
834KB

MD5
bcffa234109bae73d651be4754dbecb5

SHA1
93ac5f9868220843682be9fc351e74446caa4ba1

SHA256
91f764e7e17978eaf2e82837c6de8783e815e802a84d3e681ff1153602fcae82

SHA512
5022d3156b3dcd8e53a4514e59d26944c2c215ee5018b7739ee2f574995a3a63477ddaf74eba1b0a949a7a3ee9e673c1e2e5c6319b4bcf04a7b2f5ca2b80dd0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.exe

Filesize
834KB

MD5
bcffa234109bae73d651be4754dbecb5

SHA1
93ac5f9868220843682be9fc351e74446caa4ba1

SHA256
91f764e7e17978eaf2e82837c6de8783e815e802a84d3e681ff1153602fcae82

SHA512
5022d3156b3dcd8e53a4514e59d26944c2c215ee5018b7739ee2f574995a3a63477ddaf74eba1b0a949a7a3ee9e673c1e2e5c6319b4bcf04a7b2f5ca2b80dd0a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\W81OVF6H.txt

Filesize
608B

MD5
f735a0f456f9677350cbfa1986cc0818

SHA1
3961f0c865d8e11512dd280849bf5ba7e3aaeb9f

SHA256
90185e2ef157f23e8550672d9881fd4d2108599ee0cbfb5a826838cc96400052

SHA512
f83b7194ea9c4185e3bf8738b6b7a8b5490dbc6336953eff1fd20097060c51063b188481e47618f9ee50248ade7a044b1d5350b99ab3415efb0e2c305294ff35

Download Submit
C:\Windows\SysWOW64\vleumrqevovx.dll

Filesize
695KB

MD5
36caaa3d635ae5ae9612d516b4613186

SHA1
b441bf69842ed6254b48ba0db5f4b67685327eb1

SHA256
5975f1dd4d6b13d7c2409b4c43119a2df162733c420cc637c1ce74f1f1355354

SHA512
4ed4a07f3eeed0cb2e51777856b149911f8eb5b0548123df19db94ba0fcf39b2322cc7576c2de00d3b9c0230267bbefaaadb887a7d4f68bfee60f44b6b0b4b7e

Download Submit
\Users\Admin\AppData\Local\Temp\aspnetstate.exe

Filesize
404KB

MD5
f02631a1599d143fa8dfe013df84e211

SHA1
8b97ec9f37ea07831d33d9f9dc77f1f00c8c3e89

SHA256
2dcda858882bb5d6dab14846ea8846856c124d89ac08cd1eca614b22aa9f1e70

SHA512
028a10f5be9b0a78fd407d97e76e4149128417c17c2462da30878add44aad7f0920728614a77c95130b958751cfd5dda91570881901bef34e8b5c9e4c76012bb

Download Submit
\Users\Admin\AppData\Local\Temp\dllhosts.exe

Filesize
2.2MB

MD5
ff642a552115c04cb28055bdb8f89f14

SHA1
f5f0be4f35a1dd498fba0cd7aefdc24756845d8d

SHA256
18e401c86523475e1efeb7403e29cd0773bef2e54f130dfca47c1127f09ba6d3

SHA512
dbabac3c68e8a8ecaa1c3b9c7d8a10b16c93ed490b76ec18e00821ca20ad433962fea010c0d0b07013d972f43e04ee23a089068c8558655d11ce364957f69f59

Download Submit
\Users\Admin\AppData\Local\Temp\nsd59F5.tmp\Math.dll

Filesize
66KB

MD5
b140459077c7c39be4bef249c2f84535

SHA1
c56498241c2ddafb01961596da16d08d1b11cd35

SHA256
0598f7d83db44929b7170c1285457b52b4281185f63ced102e709bf065f10d67

SHA512
fbcb19a951d96a216d73b6b3e005338bbb6e11332c6cc8c3f179ccd420b4db0e5682dc4245bd120dcb67bc70960eab368e74c68c7c165a485a12a7d0d8a00328

Download Submit
\Users\Admin\AppData\Local\Temp\nsd59F5.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsd59F5.tmp\UAC.dll

Filesize
17KB

MD5
88ad3fd90fc52ac3ee0441a38400a384

SHA1
08bc9e1f5951b54126b5c3c769e3eaed42f3d10b

SHA256
e58884695378cf02715373928bb8ade270baf03144369463f505c3b3808cbc42

SHA512
359496f571e6fa2ec4c5ab5bd1d35d1330586f624228713ae55c65a69e07d8623022ef54337c22c3aab558a9b74d9977c8436f5fea4194899d9ef3ffd74e7dbb

Download Submit
\Users\Admin\AppData\Local\Temp\nsd59F5.tmp\UAC.dll

Filesize
17KB

MD5
88ad3fd90fc52ac3ee0441a38400a384

SHA1
08bc9e1f5951b54126b5c3c769e3eaed42f3d10b

SHA256
e58884695378cf02715373928bb8ade270baf03144369463f505c3b3808cbc42

SHA512
359496f571e6fa2ec4c5ab5bd1d35d1330586f624228713ae55c65a69e07d8623022ef54337c22c3aab558a9b74d9977c8436f5fea4194899d9ef3ffd74e7dbb

Download Submit
\Users\Admin\AppData\Local\Temp\nsd59F5.tmp\UAC.dll

Filesize
17KB

MD5
88ad3fd90fc52ac3ee0441a38400a384

SHA1
08bc9e1f5951b54126b5c3c769e3eaed42f3d10b

SHA256
e58884695378cf02715373928bb8ade270baf03144369463f505c3b3808cbc42

SHA512
359496f571e6fa2ec4c5ab5bd1d35d1330586f624228713ae55c65a69e07d8623022ef54337c22c3aab558a9b74d9977c8436f5fea4194899d9ef3ffd74e7dbb

Download Submit
\Users\Admin\AppData\Local\Temp\nso5B1D.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nso5B1D.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nst68B5.tmp.dll

Filesize
695KB

MD5
36caaa3d635ae5ae9612d516b4613186

SHA1
b441bf69842ed6254b48ba0db5f4b67685327eb1

SHA256
5975f1dd4d6b13d7c2409b4c43119a2df162733c420cc637c1ce74f1f1355354

SHA512
4ed4a07f3eeed0cb2e51777856b149911f8eb5b0548123df19db94ba0fcf39b2322cc7576c2de00d3b9c0230267bbefaaadb887a7d4f68bfee60f44b6b0b4b7e

Download Submit
\Users\Admin\AppData\Local\Temp\setup.exe

Filesize
834KB

MD5
bcffa234109bae73d651be4754dbecb5

SHA1
93ac5f9868220843682be9fc351e74446caa4ba1

SHA256
91f764e7e17978eaf2e82837c6de8783e815e802a84d3e681ff1153602fcae82

SHA512
5022d3156b3dcd8e53a4514e59d26944c2c215ee5018b7739ee2f574995a3a63477ddaf74eba1b0a949a7a3ee9e673c1e2e5c6319b4bcf04a7b2f5ca2b80dd0a

Download Submit
\Users\Admin\AppData\Local\Temp\setup.exe

Filesize
834KB

MD5
bcffa234109bae73d651be4754dbecb5

SHA1
93ac5f9868220843682be9fc351e74446caa4ba1

SHA256
91f764e7e17978eaf2e82837c6de8783e815e802a84d3e681ff1153602fcae82

SHA512
5022d3156b3dcd8e53a4514e59d26944c2c215ee5018b7739ee2f574995a3a63477ddaf74eba1b0a949a7a3ee9e673c1e2e5c6319b4bcf04a7b2f5ca2b80dd0a

Download Submit
\Users\Admin\AppData\Local\Temp\setup.exe

Filesize
834KB

MD5
bcffa234109bae73d651be4754dbecb5

SHA1
93ac5f9868220843682be9fc351e74446caa4ba1

SHA256
91f764e7e17978eaf2e82837c6de8783e815e802a84d3e681ff1153602fcae82

SHA512
5022d3156b3dcd8e53a4514e59d26944c2c215ee5018b7739ee2f574995a3a63477ddaf74eba1b0a949a7a3ee9e673c1e2e5c6319b4bcf04a7b2f5ca2b80dd0a

Download Submit
\Users\Admin\AppData\Local\Temp\setup.exe

Filesize
834KB

MD5
bcffa234109bae73d651be4754dbecb5

SHA1
93ac5f9868220843682be9fc351e74446caa4ba1

SHA256
91f764e7e17978eaf2e82837c6de8783e815e802a84d3e681ff1153602fcae82

SHA512
5022d3156b3dcd8e53a4514e59d26944c2c215ee5018b7739ee2f574995a3a63477ddaf74eba1b0a949a7a3ee9e673c1e2e5c6319b4bcf04a7b2f5ca2b80dd0a

Download Submit
\Windows\SysWOW64\3afeb524.dll

Filesize
2.6MB

MD5
3a8596359f3a788179aed1883f6b6dc3

SHA1
51cc1e635fceb6306536c8a7fe22d42e97fd1de5

SHA256
1e5823b5eba4d35f9175cc121ac5467b1c3ae23e5a58cd702c5f4d5adeede240

SHA512
7346e4a0f0d545109423fd15a9ee2792805413e81f4aacf43e65980e46c23b4270590ddd08ef3494e54470771afb951ca7b2118ba37b4b5158150c426dabdb35

Download Submit
memory/1684-54-0x0000000076AE1000-0x0000000076AE3000-memory.dmp

Filesize
8KB

Download
memory/2016-69-0x0000000000BC0000-0x0000000000BDA000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads