Analysis
-
max time kernel
112s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 06:31
Static task
static1
Behavioral task
behavioral1
Sample
855b65baf504592a4f3a84a1821cdff0ceff94e4ef1448d4d45af846090cbf19.dll
Resource
win7-20220901-en
windows7-x64
4 signatures
150 seconds
General
-
Target
855b65baf504592a4f3a84a1821cdff0ceff94e4ef1448d4d45af846090cbf19.dll
-
Size
517KB
-
MD5
c1bcf1aaa281e993afda2f13883abf2c
-
SHA1
45a0f4fb5bcb020a4d136f0230eb23df6042fbed
-
SHA256
855b65baf504592a4f3a84a1821cdff0ceff94e4ef1448d4d45af846090cbf19
-
SHA512
2d72cac8bb7f48e472d768925e8fd9f76c79a6baff2b205464841164ab763136330869d0d4782d45e47882d6f02e9fdbd48ed5311cd702d151a8e34158d4f8e7
-
SSDEEP
12288:NOFSu/suN+mMFTh/x9StsS5DY6P83/lL+RTg9vfB:NOFSox8fGsyOZkaHB
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0DBB4430-2805-4FF2-AC7D-43985BC678B8} regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0DBB4430-2805-4FF2-AC7D-43985BC678B8} regsvr32.exe -
Processes:
regsvr32.exedescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow\*.bradesco.com.br regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\New Windows\Allow regsvr32.exe -
Modifies registry class 11 IoCs
Processes:
regsvr32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0DBB4430-2805-4FF2-AC7D-43985BC678B8}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\855b65baf504592a4f3a84a1821cdff0ceff94e4ef1448d4d45af846090cbf19.Alx2000_19\Clsid\ = "{0DBB4430-2805-4FF2-AC7D-43985BC678B8}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0DBB4430-2805-4FF2-AC7D-43985BC678B8}\ProgID\ = "855b65baf504592a4f3a84a1821cdff0ceff94e4ef1448d4d45af846090cbf19.Alx2000_19" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0DBB4430-2805-4FF2-AC7D-43985BC678B8} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0DBB4430-2805-4FF2-AC7D-43985BC678B8}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\855b65baf504592a4f3a84a1821cdff0ceff94e4ef1448d4d45af846090cbf19.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\855b65baf504592a4f3a84a1821cdff0ceff94e4ef1448d4d45af846090cbf19.Alx2000_19 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\855b65baf504592a4f3a84a1821cdff0ceff94e4ef1448d4d45af846090cbf19.Alx2000_19\ = "Alx2000" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\855b65baf504592a4f3a84a1821cdff0ceff94e4ef1448d4d45af846090cbf19.Alx2000_19\Clsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0DBB4430-2805-4FF2-AC7D-43985BC678B8}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0DBB4430-2805-4FF2-AC7D-43985BC678B8}\ = "Alx2000" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0DBB4430-2805-4FF2-AC7D-43985BC678B8}\InprocServer32 regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
regsvr32.exedescription pid process target process PID 3008 wrote to memory of 2324 3008 regsvr32.exe regsvr32.exe PID 3008 wrote to memory of 2324 3008 regsvr32.exe regsvr32.exe PID 3008 wrote to memory of 2324 3008 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\855b65baf504592a4f3a84a1821cdff0ceff94e4ef1448d4d45af846090cbf19.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\855b65baf504592a4f3a84a1821cdff0ceff94e4ef1448d4d45af846090cbf19.dll2⤵
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2324-132-0x0000000000000000-mapping.dmp
-
memory/2324-133-0x0000000000830000-0x000000000098D000-memory.dmpFilesize
1.4MB
-
memory/2324-134-0x0000000000830000-0x000000000098D000-memory.dmpFilesize
1.4MB
-
memory/2324-135-0x0000000000830000-0x000000000098D000-memory.dmpFilesize
1.4MB
-
memory/2324-136-0x0000000000830000-0x000000000098D000-memory.dmpFilesize
1.4MB