c2f23d1a225350f7ca130772331f8eabc054f727a480fff92507e3ce88853ced

General

Target

c2f23d1a225350f7ca130772331f8eabc054f727a480fff92507e3ce88853ced.dll
Size

128KB
MD5

2f259e090a3161d1c21b38be732c3885
SHA1

61a9f28f5b99a248d8a74e7a47f3868eb85fda04
SHA256

c2f23d1a225350f7ca130772331f8eabc054f727a480fff92507e3ce88853ced
SHA512

e8d0d51ba787ec700aa90922e157adbe62c0a6f4ed08eaff934d3f0fc2a15bcd6008ada52137712d1299d7b78793746b1ac7d30b7b0b2c7ed0e32302dad52b08
SSDEEP

3072:eNJH83yeup+FbGfcRcYUccsgwyFGma+lskHlf5:elr+RcYUagwyFpa+l5h

Score

8^/10

adware persistence stealer upx

Malware Config

Signatures

Modifies Shared Task Scheduler registry keys 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\SharedTaskScheduler\{FA62EA61-0B84-B73F-D840-61EA62E951D9}	rundll32.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2004-56-0x0000000000690000-0x00000000006F7000-memory.dmp	upx
behavioral1/memory/2004-57-0x0000000000690000-0x00000000006F7000-memory.dmp	upx

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{940C840C-A62E-61D9-72EA-0C840C83FB73}	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{940C840C-A62E-61D9-72EA-0C840C83FB73}\	rundll32.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\NSIYOE.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\NSIYOE.dll	rundll32.exe
File created	C:\Windows\SysWOW64\HMCSIY.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\HMCSIY.dll	rundll32.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\New Windows\Allow	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\New Windows\Allow\www.google.cn	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\New Windows\Allow\www.baidu.com	rundll32.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FA62EA61-0B84-B73F-D840-61EA62E951D9}	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{940C840C-A62E-61D9-72EA-0C840C83FB73}	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{940C840C-A62E-61D9-72EA-0C840C83FB73}\	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{940C840C-A62E-61D9-72EA-0C840C83FB73}\InprocServer32	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{940C840C-A62E-61D9-72EA-0C840C83FB73}\InprocServer32\ = "C:\\Windows\\SysWow64\\HMCSIY.dll"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{940C840C-A62E-61D9-72EA-0C840C83FB73}\InprocServer32\ThreadingModel = "Apartment"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FA62EA61-0B84-B73F-D840-61EA62E951D9}\	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FA62EA61-0B84-B73F-D840-61EA62E951D9}\InprocServer32	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FA62EA61-0B84-B73F-D840-61EA62E951D9}\InprocServer32\ = "C:\\Windows\\SysWow64\\NSIYOE.dll"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FA62EA61-0B84-B73F-D840-61EA62E951D9}\InprocServer32\ThreadingModel = "Apartment"	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 2004	1956	rundll32.exe	28
PID 1956 wrote to memory of 2004	1956	rundll32.exe	28
PID 1956 wrote to memory of 2004	1956	rundll32.exe	28
PID 1956 wrote to memory of 2004	1956	rundll32.exe	28
PID 1956 wrote to memory of 2004	1956	rundll32.exe	28
PID 1956 wrote to memory of 2004	1956	rundll32.exe	28
PID 1956 wrote to memory of 2004	1956	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c2f23d1a225350f7ca130772331f8eabc054f727a480fff92507e3ce88853ced.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c2f23d1a225350f7ca130772331f8eabc054f727a480fff92507e3ce88853ced.dll,#1
  2⤵
  - Modifies Shared Task Scheduler registry keys
  - Installs/modifies Browser Helper Object
  - Drops file in System32 directory
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:2004

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2004-55-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download
memory/2004-56-0x0000000000690000-0x00000000006F7000-memory.dmp

Filesize
412KB

Download
memory/2004-57-0x0000000000690000-0x00000000006F7000-memory.dmp

Filesize
412KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads