a0c143423dc26ee96f73d6c34dc4c225aab159a54c93d0dd332188742d24599e

Analysis

max time kernel
143s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 04:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a0c143423dc26ee96f73d6c34dc4c225aab159a54c93d0dd332188742d24599e.exe
Size

173KB
MD5

de347802219283b6c75b6a653c3b4576
SHA1

60a10f3a894e3f5f5ba3f5d0275161694157c3e5
SHA256

a0c143423dc26ee96f73d6c34dc4c225aab159a54c93d0dd332188742d24599e
SHA512

8dee26ee2591aafac325f8bac16dd7f4cb61e709895a2c60c9a98f5960eea381fb9ba8189a8791ef2b3db60e02f7cdacda3d0222f91c4195ef285f6b74050ca7
SSDEEP

3072:IGxypDKhqiTT2VL631Vt4ow/w9vAtKfQNFtjHn7nED7mGbBfThukTnmi4J:F0NAHkQGo8MkLtjnEmGdwk77

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
4624	rundll32.exe
484	IEXPLORE.EXE
484	IEXPLORE.EXE

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dadol = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Roaming\\dadol.dll\",PszAllocW"	rundll32.exe

Modifies Internet Explorer settings 1 TTPs 42 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30999687"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30999687"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff720000001a000000f80400007f020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2545133541"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2787633656"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff5800000000000000de04000065020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30999687"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2709979183"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2555914950"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2633259178"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376555783"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30999687"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30999687"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{C31F3264-707A-11ED-A0EE-CA180515AB83} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2545133541"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30999687"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1284	iexplore.exe
1284	iexplore.exe
1284	iexplore.exe
1284	iexplore.exe

Suspicious use of SetWindowsHookEx 20 IoCs

pid	Process
1284	iexplore.exe
1284	iexplore.exe
1688	IEXPLORE.EXE
1688	IEXPLORE.EXE
4624	rundll32.exe
1284	iexplore.exe
1284	iexplore.exe
4532	IEXPLORE.EXE
4532	IEXPLORE.EXE
4624	rundll32.exe
1284	iexplore.exe
1284	iexplore.exe
372	IEXPLORE.EXE
372	IEXPLORE.EXE
4624	rundll32.exe
1284	iexplore.exe
1284	iexplore.exe
484	IEXPLORE.EXE
484	IEXPLORE.EXE
4624	rundll32.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 4624	3368	a0c143423dc26ee96f73d6c34dc4c225aab159a54c93d0dd332188742d24599e.exe	76
PID 3368 wrote to memory of 4624	3368	a0c143423dc26ee96f73d6c34dc4c225aab159a54c93d0dd332188742d24599e.exe	76
PID 3368 wrote to memory of 4624	3368	a0c143423dc26ee96f73d6c34dc4c225aab159a54c93d0dd332188742d24599e.exe	76
PID 1284 wrote to memory of 1688	1284	iexplore.exe	81
PID 1284 wrote to memory of 1688	1284	iexplore.exe	81
PID 1284 wrote to memory of 1688	1284	iexplore.exe	81
PID 1284 wrote to memory of 4532	1284	iexplore.exe	86
PID 1284 wrote to memory of 4532	1284	iexplore.exe	86
PID 1284 wrote to memory of 4532	1284	iexplore.exe	86
PID 1284 wrote to memory of 372	1284	iexplore.exe	91
PID 1284 wrote to memory of 372	1284	iexplore.exe	91
PID 1284 wrote to memory of 372	1284	iexplore.exe	91
PID 1284 wrote to memory of 484	1284	iexplore.exe	92
PID 1284 wrote to memory of 484	1284	iexplore.exe	92
PID 1284 wrote to memory of 484	1284	iexplore.exe	92

C:\Users\Admin\AppData\Local\Temp\a0c143423dc26ee96f73d6c34dc4c225aab159a54c93d0dd332188742d24599e.exe
"C:\Users\Admin\AppData\Local\Temp\a0c143423dc26ee96f73d6c34dc4c225aab159a54c93d0dd332188742d24599e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Roaming\dadol.dll",PszAllocW
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of SetWindowsHookEx
  PID:4624

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
PID:652

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1284 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1688
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1284 CREDAT:82948 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:4532
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1284 CREDAT:82952 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:372
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1284 CREDAT:82956 /prefetch:2
  2⤵
  - Loads dropped DLL
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:484

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
bd4f3cb3175ff83bbc2c827705950a60

SHA1
9d940539de8317a8a6444559d9fc9f190dd9f80b

SHA256
ff821119d7d2bf9d795503ed63996c81611b84cdcdacac943da9a9ae2d0d2384

SHA512
02b99cb5a7e2cf6004fd010c5718f85830aca7b6f43b5ed929d2df8ca4209a29cfd9e54280a35392b2617ab58e578c097834ce24e9baa8b226c6181c64c0d377

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
434B

MD5
efca872665ec2755752f4abb9f8076a5

SHA1
fbb69fa3b5910aa79280246a7167f1ed30916e29

SHA256
c5cc684d84c39800a85102052aca386f1d570f7edc203f03507fd43cb6aeae78

SHA512
be2c0d4ffb2534bc86e7aa65c1e3984d17ba17126e9697873bd80f70277745f22514fc097903b440b740f2f7d1dd6631989c7b4166845341904e9ce61122fab6

Download Submit
C:\Users\Admin\AppData\Roaming\dadol.dll

Filesize
173KB

MD5
0fb75fe3e440401d4b6d4645ce0b0b7d

SHA1
5481ba0dc67a5286a5f1a4b6e1b9fdc55150b3e7

SHA256
2b8fce2c30d5b888b470a0484fd82b53ab2b63c63d006af3c4835549282f5f51

SHA512
4937194e6c75b3d1d4cbbd4635bdc6483b18edd543bbb8fc2f07e1b3f992517062f456e4339ec11a67c890af76242ca9556c2eba2839139ddb956d48259c8b1c

Download Submit
C:\Users\Admin\AppData\Roaming\dadol.dll

Filesize
173KB

MD5
0fb75fe3e440401d4b6d4645ce0b0b7d

SHA1
5481ba0dc67a5286a5f1a4b6e1b9fdc55150b3e7

SHA256
2b8fce2c30d5b888b470a0484fd82b53ab2b63c63d006af3c4835549282f5f51

SHA512
4937194e6c75b3d1d4cbbd4635bdc6483b18edd543bbb8fc2f07e1b3f992517062f456e4339ec11a67c890af76242ca9556c2eba2839139ddb956d48259c8b1c

Download Submit
C:\Users\Admin\AppData\Roaming\dadol.dll

Filesize
173KB

MD5
0fb75fe3e440401d4b6d4645ce0b0b7d

SHA1
5481ba0dc67a5286a5f1a4b6e1b9fdc55150b3e7

SHA256
2b8fce2c30d5b888b470a0484fd82b53ab2b63c63d006af3c4835549282f5f51

SHA512
4937194e6c75b3d1d4cbbd4635bdc6483b18edd543bbb8fc2f07e1b3f992517062f456e4339ec11a67c890af76242ca9556c2eba2839139ddb956d48259c8b1c

Download Submit
C:\Users\Admin\AppData\Roaming\dadol.dll

Filesize
173KB

MD5
0fb75fe3e440401d4b6d4645ce0b0b7d

SHA1
5481ba0dc67a5286a5f1a4b6e1b9fdc55150b3e7

SHA256
2b8fce2c30d5b888b470a0484fd82b53ab2b63c63d006af3c4835549282f5f51

SHA512
4937194e6c75b3d1d4cbbd4635bdc6483b18edd543bbb8fc2f07e1b3f992517062f456e4339ec11a67c890af76242ca9556c2eba2839139ddb956d48259c8b1c

Download Submit
memory/3368-133-0x0000000002160000-0x000000000218E000-memory.dmp

Filesize
184KB

Download
memory/3368-137-0x0000000010000000-0x000000001002E000-memory.dmp

Filesize
184KB

Download
memory/3368-132-0x0000000002140000-0x0000000002154000-memory.dmp

Filesize
80KB

Download
memory/3368-147-0x0000000002140000-0x0000000002154000-memory.dmp

Filesize
80KB

Download
memory/4624-142-0x0000000000E10000-0x0000000000E3E000-memory.dmp

Filesize
184KB

Download
memory/4624-148-0x0000000000DF0000-0x0000000000E04000-memory.dmp

Filesize
80KB

Download
memory/4624-146-0x0000000010000000-0x000000001002E000-memory.dmp

Filesize
184KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads