dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5

General

Target

dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
Size

328KB
MD5

2699986e741ba577ae2217661e60b0ba
SHA1

66da102297cf31f2622341e2a178df6219c0e76c
SHA256

dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5
SHA512

74e4f842c688638dde64a3963de326a0f6e7f29d3b4e62a6081fc293dbeccd9a37b9b208eee67680f12f8475ac2a2b3b0ae136275f59fb6bff51ba3ad45af48b
SSDEEP

6144:byWOeLm+tkxoGQvT+W4+HMc+MEGRQ6saHSMf3z0AzbLUG50Tpm+MmvbWdlL0d5aU:bCemx0vN3HKGi6sYjJLUGGtedud5tr7

Score

8^/10

adware persistence stealer

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe

description ioc process

File created C:\Windows\SysWOW64\drivers\662da4ed.sys dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe

description	ioc	process
File created	C:\Windows\SysWOW64\drivers\662da4ed.sys	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\662da4ed\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\662da4ed.sys"	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe

Maps connected drives based on registry 3 TTPs 3 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe

description	ioc	process
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe

Modifies registry class 4 IoCs

Processes:

dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\SYS_DLL	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\SYS_DLL\name = "GJGayeYq.dll"	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\HOOK_ID	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\HOOK_ID\name = "dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe"	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe

pid	process
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe

Suspicious behavior: LoadsDriver 2 IoCs

Processes:

dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe

pid process

664
2000 dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe

description pid process

Token: SeDebugPrivilege 2000 dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe

pid	process
664
2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe

description	pid	process
Token: SeDebugPrivilege	2000	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe

C:\Users\Admin\AppData\Local\Temp\dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
"C:\Users\Admin\AppData\Local\Temp\dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe"
1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Installs/modifies Browser Helper Object
- Maps connected drives based on registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2000

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2000-132-0x0000000001000000-0x000000000116A000-memory.dmp

Filesize
1.4MB

Download
memory/2000-133-0x0000000000540000-0x0000000000560000-memory.dmp

Filesize
128KB

Download
memory/2000-134-0x0000000000540000-0x0000000000560000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads