bc555887bac3e40e5ad3ac9dafe0bcde2b8ed296b026d214543701aecedd4a94

General

Target

bc555887bac3e40e5ad3ac9dafe0bcde2b8ed296b026d214543701aecedd4a94.exe
Size

86KB
MD5

312ec29cefab4b8d0f118e7ad6943fd2
SHA1

83fcba61b17e101f51e0b6c9f9301308a3a29e5b
SHA256

bc555887bac3e40e5ad3ac9dafe0bcde2b8ed296b026d214543701aecedd4a94
SHA512

2f610f1e073657ff9b25ca8c73036a2fbf2630778638949e2f85b21408ec3168f3318ff9fbb094d187ea71c4855251e014dc95898cf0619d1af08a823def64cb
SSDEEP

1536:8KVMKBC9cS4NZoGvefpKcbN0DNM1vtNcTR5G0Vpxr8D43Q:jVMKIR0ZbvwvxGM1rcV5hVK2

Score

8^/10

adware stealer upx

Malware Config

Signatures

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/900-54-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/900-56-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/files/0x00140000000054ab-58.dat	upx
behavioral1/files/0x00140000000054ab-59.dat	upx
behavioral1/files/0x00140000000054ab-62.dat	upx
behavioral1/files/0x00140000000054ab-61.dat	upx
behavioral1/files/0x00140000000054ab-60.dat	upx
behavioral1/memory/1984-63-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Loads dropped DLL 4 IoCs

pid	Process
1984	rundll32.exe
1984	rundll32.exe
1984	rundll32.exe
1984	rundll32.exe

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C6039E6C-BDE9-4de5-BB40-768CAA584FDC}	rundll32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\bc555887bac3e40e5ad3ac9dafe0bcde2b8ed296b026d214543701aecedd4a94.dll	bc555887bac3e40e5ad3ac9dafe0bcde2b8ed296b026d214543701aecedd4a94.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C6039E6C-BDE9-4de5-BB40-768CAA584FDC}	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C6039E6C-BDE9-4de5-BB40-768CAA584FDC}\InprocServer32	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C6039E6C-BDE9-4de5-BB40-768CAA584FDC}\InprocServer32\ = "C:\\Windows\\SysWow64\\bc555887bac3e40e5ad3ac9dafe0bcde2b8ed296b026d214543701aecedd4a94.dll"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C6039E6C-BDE9-4de5-BB40-768CAA584FDC}\InprocServer32\ThreadingModel = "Both"	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 1984	900	bc555887bac3e40e5ad3ac9dafe0bcde2b8ed296b026d214543701aecedd4a94.exe	27
PID 900 wrote to memory of 1984	900	bc555887bac3e40e5ad3ac9dafe0bcde2b8ed296b026d214543701aecedd4a94.exe	27
PID 900 wrote to memory of 1984	900	bc555887bac3e40e5ad3ac9dafe0bcde2b8ed296b026d214543701aecedd4a94.exe	27
PID 900 wrote to memory of 1984	900	bc555887bac3e40e5ad3ac9dafe0bcde2b8ed296b026d214543701aecedd4a94.exe	27
PID 900 wrote to memory of 1984	900	bc555887bac3e40e5ad3ac9dafe0bcde2b8ed296b026d214543701aecedd4a94.exe	27
PID 900 wrote to memory of 1984	900	bc555887bac3e40e5ad3ac9dafe0bcde2b8ed296b026d214543701aecedd4a94.exe	27
PID 900 wrote to memory of 1984	900	bc555887bac3e40e5ad3ac9dafe0bcde2b8ed296b026d214543701aecedd4a94.exe	27

C:\Users\Admin\AppData\Local\Temp\bc555887bac3e40e5ad3ac9dafe0bcde2b8ed296b026d214543701aecedd4a94.exe
"C:\Users\Admin\AppData\Local\Temp\bc555887bac3e40e5ad3ac9dafe0bcde2b8ed296b026d214543701aecedd4a94.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Windows\system32\bc555887bac3e40e5ad3ac9dafe0bcde2b8ed296b026d214543701aecedd4a94.dll",dll_inject
  2⤵
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - Modifies registry class
  PID:1984

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\bc555887bac3e40e5ad3ac9dafe0bcde2b8ed296b026d214543701aecedd4a94.dll

Filesize
69KB

MD5
722e2973ae6c0401c95294e6a44e2fcf

SHA1
6184af79414a489624187ca887c4e0bb552ffd30

SHA256
464684f65b7e7b601f395f7cfa1faaf5aa5636a32bd7571b5e861d358a5d0fce

SHA512
238578daa6c9eb7a20b9355408f1f9347ffce104ad1fb53de8419d74ff249e4800a678ce74dbfd0895519efc51990b353ed45f54f09e729dacc3e4fcbd2110a7

Download Submit
\Windows\SysWOW64\bc555887bac3e40e5ad3ac9dafe0bcde2b8ed296b026d214543701aecedd4a94.dll

Filesize
69KB

MD5
722e2973ae6c0401c95294e6a44e2fcf

SHA1
6184af79414a489624187ca887c4e0bb552ffd30

SHA256
464684f65b7e7b601f395f7cfa1faaf5aa5636a32bd7571b5e861d358a5d0fce

SHA512
238578daa6c9eb7a20b9355408f1f9347ffce104ad1fb53de8419d74ff249e4800a678ce74dbfd0895519efc51990b353ed45f54f09e729dacc3e4fcbd2110a7

Download Submit
\Windows\SysWOW64\bc555887bac3e40e5ad3ac9dafe0bcde2b8ed296b026d214543701aecedd4a94.dll

Filesize
69KB

MD5
722e2973ae6c0401c95294e6a44e2fcf

SHA1
6184af79414a489624187ca887c4e0bb552ffd30

SHA256
464684f65b7e7b601f395f7cfa1faaf5aa5636a32bd7571b5e861d358a5d0fce

SHA512
238578daa6c9eb7a20b9355408f1f9347ffce104ad1fb53de8419d74ff249e4800a678ce74dbfd0895519efc51990b353ed45f54f09e729dacc3e4fcbd2110a7

Download Submit
\Windows\SysWOW64\bc555887bac3e40e5ad3ac9dafe0bcde2b8ed296b026d214543701aecedd4a94.dll

Filesize
69KB

MD5
722e2973ae6c0401c95294e6a44e2fcf

SHA1
6184af79414a489624187ca887c4e0bb552ffd30

SHA256
464684f65b7e7b601f395f7cfa1faaf5aa5636a32bd7571b5e861d358a5d0fce

SHA512
238578daa6c9eb7a20b9355408f1f9347ffce104ad1fb53de8419d74ff249e4800a678ce74dbfd0895519efc51990b353ed45f54f09e729dacc3e4fcbd2110a7

Download Submit
\Windows\SysWOW64\bc555887bac3e40e5ad3ac9dafe0bcde2b8ed296b026d214543701aecedd4a94.dll

Filesize
69KB

MD5
722e2973ae6c0401c95294e6a44e2fcf

SHA1
6184af79414a489624187ca887c4e0bb552ffd30

SHA256
464684f65b7e7b601f395f7cfa1faaf5aa5636a32bd7571b5e861d358a5d0fce

SHA512
238578daa6c9eb7a20b9355408f1f9347ffce104ad1fb53de8419d74ff249e4800a678ce74dbfd0895519efc51990b353ed45f54f09e729dacc3e4fcbd2110a7

Download Submit
memory/900-54-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/900-56-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1984-57-0x0000000075571000-0x0000000075573000-memory.dmp

Filesize
8KB

Download
memory/1984-63-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download

Analysis

Sharing