e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6

Analysis

max time kernel
168s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 12:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Size

176KB
MD5

2ecf4a0cb843ef19bbf52adf1e8cff6c
SHA1

7e4b734860db8516b8c3c246a371ee8aab420cea
SHA256

e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6
SHA512

9ec62b125cc3b96f6f154734d97193077a38a6921687857c4d9b571b608e1610d6a5e0f08de4a50540955ee70be3d5928ec8f1df7424bb27206eb258504c4cb2
SSDEEP

3072:y8SBjlnc5OevGSXhuULpKwg2H+a63U57dbiLCNN1dR3:y/B5c5MSXhuU9KwG3UWLCNndZ

Score

7^/10

adware discovery stealer

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3792	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{32324134-3465-4325-6543-325435274523}	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\altcmd\altcmd.inf	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
File opened for modification	C:\Program Files (x86)\altcmd\altcmd.inf	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
File created	C:\Program Files (x86)\altcmd\uninstall.bat	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
File opened for modification	C:\Program Files (x86)\altcmd\uninstall.bat	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
File created	C:\Program Files (x86)\altcmd\altcmd32.dll	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
File opened for modification	C:\Program Files (x86)\altcmd\altcmd32.dll	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe

Modifies registry class 60 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32324134-3465-4325-6543-325435274523}\ProgID	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A5432564-1E04-32A3-A23E-324EDC324CD6}\1.0\HELPDIR	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\TypeLib	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\TypeLib\ = "{A5432564-1E04-32A3-A23E-324EDC324CD6}"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MsVCL1.BhoApp.1\CLSID	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\ProxyStubClsid32	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MsVCL1.BhoApp\CLSID	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MsVCL1.BhoApp\CurVer	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32324134-3465-4325-6543-325435274523}\TypeLib	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A5432564-1E04-32A3-A23E-324EDC324CD6}\1.0	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\ = "_IBhoAppEvents"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\TypeLib\ = "{A5432564-1E04-32A3-A23E-324EDC324CD6}"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\TypeLib	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MsVCL1.BhoApp.1\ = "BhoApp Class"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A5432564-1E04-32A3-A23E-324EDC324CD6}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\altcmd\\"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ = "IBhoApp"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MsVCL1.BhoApp\CurVer\ = "MsVCL1.BhoApp.1"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ = "IBhoApp"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32324134-3465-4325-6543-325435274523}\InprocServer32	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32324134-3465-4325-6543-325435274523}\InprocServer32\ThreadingModel = "Apartment"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\ProxyStubClsid32	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\TypeLib	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\TypeLib\Version = "1.0"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32324134-3465-4325-6543-325435274523}\InprocServer32\ = "C:\\Program Files (x86)\\altcmd\\altcmd32.dll"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A5432564-1E04-32A3-A23E-324EDC324CD6}\1.0\FLAGS\ = "0"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\TypeLib\ = "{A5432564-1E04-32A3-A23E-324EDC324CD6}"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\TypeLib	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\TypeLib\ = "{A5432564-1E04-32A3-A23E-324EDC324CD6}"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MsVCL1.BhoApp.1\CLSID\ = "{32324134-3465-4325-6543-325435274523}"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32324134-3465-4325-6543-325435274523}\VersionIndependentProgID\ = "MsVCL1.BhoApp"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MsVCL1.BhoApp.1	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A5432564-1E04-32A3-A23E-324EDC324CD6}\1.0\ = "MsVCL1 1.0 Type Library"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A5432564-1E04-32A3-A23E-324EDC324CD6}\1.0\FLAGS	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ProxyStubClsid32	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MsVCL1.BhoApp\CLSID\ = "{32324134-3465-4325-6543-325435274523}"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32324134-3465-4325-6543-325435274523}	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A5432564-1E04-32A3-A23E-324EDC324CD6}\1.0\0	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\TypeLib\Version = "1.0"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\TypeLib\Version = "1.0"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\TypeLib\Version = "1.0"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32324134-3465-4325-6543-325435274523}\ = "BhoApp Class"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32324134-3465-4325-6543-325435274523}\TypeLib\ = "{A5432564-1E04-32A3-A23E-324EDC324CD6}"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MsVCL1.BhoApp\ = "BhoApp Class"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32324134-3465-4325-6543-325435274523}\ProgID\ = "MsVCL1.BhoApp.1"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A5432564-1E04-32A3-A23E-324EDC324CD6}	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ProxyStubClsid32	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MsVCL1.BhoApp	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A5432564-1E04-32A3-A23E-324EDC324CD6}\1.0\0\win32	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A5432564-1E04-32A3-A23E-324EDC324CD6}\1.0\0\win32\ = "C:\\Program Files (x86)\\altcmd\\altcmd32.dll"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\ = "_IBhoAppEvents"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32324134-3465-4325-6543-325435274523}\VersionIndependentProgID	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32324134-3465-4325-6543-325435274523}\Programmable	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3792	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3792 wrote to memory of 4684	3792	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe	81
PID 3792 wrote to memory of 4684	3792	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe	81
PID 3792 wrote to memory of 4684	3792	e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe	81

C:\Users\Admin\AppData\Local\Temp\e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
"C:\Users\Admin\AppData\Local\Temp\e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe"
1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\CEBE.bat
  2⤵
  PID:4684

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\altcmd\altcmd32.dll

Filesize
160KB

MD5
968158bf7662cea9e0f5c89b97a81a12

SHA1
5eb4903d8cf6448b97c5f5f25e9e89351b53919f

SHA256
c3131cdc0d4f9adf633b2e58b05730924f284fc8e51a7bf90151a7a075dc750f

SHA512
3962378f0f76b1f4a1846bd957a1eaa10a3222bd8d26e44705845c5f395d2284e7af9045bf379ad23019e4a24a5313a31e5b1f139f80ff20d767dd9febe45744

Download Submit
C:\Users\Admin\AppData\Local\Temp\CEBE.bat

Filesize
295B

MD5
5dcec37527dcca591c79a2fcce0cc177

SHA1
bd4c7b16c0b5969ad0b7591fd1c2198352c5c29d

SHA256
a53cb6297c7c7b9c3727ff17e9742148f8ac6cd7c9abc16e2311b2e084df0169

SHA512
98b44bddc3e78e761e85cc1a1da0007d4aa1c5a139ff2da552014948a338ca912522bb418618201d561d7aa6036dfa395d24ed6dcffb3ac94f2ca8fffd3ca27a

Download Submit