22481b57460a84c75bee66652ece7a69afc946f29ab252f58bedbe021f47288a

General

Target

22481b57460a84c75bee66652ece7a69afc946f29ab252f58bedbe021f47288a.exe
Size

2.5MB
MD5

10c2eaa27b20c9f6dd0f3add518cb789
SHA1

34874c9556dd9c9eb9466b6974fdd409e47a1cb7
SHA256

22481b57460a84c75bee66652ece7a69afc946f29ab252f58bedbe021f47288a
SHA512

a3dc22d9e10f3ff19e1d17e6eb145bc860acdf0550cbb55531f4f8bcb0c21168fb045901b8ea150ce7ec26a5d84cffda2b01ba97218cbd466334de86c5a82a4b
SSDEEP

49152:2v2GmLW0XNsRpN9TYjizKyVqHxM2qil+j5j8wB/jhT:aCW0GRf9uizKy065j8srh

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1492	EXPLEROR.EXE

Loads dropped DLL 2 IoCs

pid	Process
320	22481b57460a84c75bee66652ece7a69afc946f29ab252f58bedbe021f47288a.exe
320	22481b57460a84c75bee66652ece7a69afc946f29ab252f58bedbe021f47288a.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\SYSTEM\EXPLEROR.EXE	22481b57460a84c75bee66652ece7a69afc946f29ab252f58bedbe021f47288a.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main	EXPLEROR.EXE
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DOMStorage\yy.com	EXPLEROR.EXE
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DOMStorage	EXPLEROR.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DOMStorage\yy.com\NumberOfSubdomains = "1"	EXPLEROR.EXE

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	EXPLEROR.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	EXPLEROR.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
320	22481b57460a84c75bee66652ece7a69afc946f29ab252f58bedbe021f47288a.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
320	22481b57460a84c75bee66652ece7a69afc946f29ab252f58bedbe021f47288a.exe
320	22481b57460a84c75bee66652ece7a69afc946f29ab252f58bedbe021f47288a.exe
1492	EXPLEROR.EXE
1492	EXPLEROR.EXE
1492	EXPLEROR.EXE
1492	EXPLEROR.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 320 wrote to memory of 1492	320	22481b57460a84c75bee66652ece7a69afc946f29ab252f58bedbe021f47288a.exe	27
PID 320 wrote to memory of 1492	320	22481b57460a84c75bee66652ece7a69afc946f29ab252f58bedbe021f47288a.exe	27
PID 320 wrote to memory of 1492	320	22481b57460a84c75bee66652ece7a69afc946f29ab252f58bedbe021f47288a.exe	27
PID 320 wrote to memory of 1492	320	22481b57460a84c75bee66652ece7a69afc946f29ab252f58bedbe021f47288a.exe	27

C:\Users\Admin\AppData\Local\Temp\22481b57460a84c75bee66652ece7a69afc946f29ab252f58bedbe021f47288a.exe
"C:\Users\Admin\AppData\Local\Temp\22481b57460a84c75bee66652ece7a69afc946f29ab252f58bedbe021f47288a.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:320
- C:\WINDOWS\SYSTEM\EXPLEROR.EXE
  C:\WINDOWS\SYSTEM\EXPLEROR.EXE
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Modifies system certificate store
  - Suspicious use of SetWindowsHookEx
  PID:1492

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\SYSTEM\EXPLEROR.EXE

Filesize
612KB

MD5
d4d07d767615db6757bd842161121a15

SHA1
5813e4dcc9656c874ae06a91e23f6ef4a024e090

SHA256
aa5d23db3c2496acba298a0fdf0d79a5630720ee83c6af05bc2d02370ad2296a

SHA512
575ccf52a496f484661b534716f878cd10ed73cca5a4f235d707a928a1bf7a419994e6b3e3d06d08ec9fd2d571a527d15a265c484520bf2a3b4247a2d20ad4e2

Download Submit
C:\Windows\system\EXPLEROR.EXE

Filesize
612KB

MD5
d4d07d767615db6757bd842161121a15

SHA1
5813e4dcc9656c874ae06a91e23f6ef4a024e090

SHA256
aa5d23db3c2496acba298a0fdf0d79a5630720ee83c6af05bc2d02370ad2296a

SHA512
575ccf52a496f484661b534716f878cd10ed73cca5a4f235d707a928a1bf7a419994e6b3e3d06d08ec9fd2d571a527d15a265c484520bf2a3b4247a2d20ad4e2

Download Submit
\Windows\system\EXPLEROR.EXE

Filesize
612KB

MD5
d4d07d767615db6757bd842161121a15

SHA1
5813e4dcc9656c874ae06a91e23f6ef4a024e090

SHA256
aa5d23db3c2496acba298a0fdf0d79a5630720ee83c6af05bc2d02370ad2296a

SHA512
575ccf52a496f484661b534716f878cd10ed73cca5a4f235d707a928a1bf7a419994e6b3e3d06d08ec9fd2d571a527d15a265c484520bf2a3b4247a2d20ad4e2

Download Submit
\Windows\system\EXPLEROR.EXE

Filesize
612KB

MD5
d4d07d767615db6757bd842161121a15

SHA1
5813e4dcc9656c874ae06a91e23f6ef4a024e090

SHA256
aa5d23db3c2496acba298a0fdf0d79a5630720ee83c6af05bc2d02370ad2296a

SHA512
575ccf52a496f484661b534716f878cd10ed73cca5a4f235d707a928a1bf7a419994e6b3e3d06d08ec9fd2d571a527d15a265c484520bf2a3b4247a2d20ad4e2

Download Submit
memory/320-54-0x0000000076201000-0x0000000076203000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads