b4f9b5a18d6bceee3201546a6da3ad6c181a68cae0bebf395e0de3516031e945

Analysis

max time kernel
185s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 16:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4f9b5a18d6bceee3201546a6da3ad6c181a68cae0bebf395e0de3516031e945.dll
Size

60KB
MD5

681b22d9a930a5f192d89499086319c2
SHA1

a1a87e63652e97a7bece1bac083a7d06d8c51ab1
SHA256

b4f9b5a18d6bceee3201546a6da3ad6c181a68cae0bebf395e0de3516031e945
SHA512

e4c4556f2e75b15fb0132748dfcb75b11dece5d23d8c505f14fdce6cc53231703ee0fc052512236c483a8221950379fb1713db61094fd2cea4094bf74e6bce80
SSDEEP

1536:p24TeK15n1xpkO6drZ689C9a6lfzshje:p2ODerYa0a6l7

Score

6^/10

adware stealer

Malware Config

Signatures

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{67C55A8D-E808-4caa-9EA7-F77102DE0BB6}	rundll32.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{67C55A8D-E808-4caa-9EA7-F77102DE0BB6}	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{67C55A8D-E808-4caa-9EA7-F77102DE0BB6}\InprocServer32	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{67C55A8D-E808-4caa-9EA7-F77102DE0BB6}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b4f9b5a18d6bceee3201546a6da3ad6c181a68cae0bebf395e0de3516031e945.dll"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{67C55A8D-E808-4caa-9EA7-F77102DE0BB6}\InprocServer32\ThreadingModel = "Both"	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4036 wrote to memory of 316	4036	rundll32.exe	82
PID 4036 wrote to memory of 316	4036	rundll32.exe	82
PID 4036 wrote to memory of 316	4036	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4f9b5a18d6bceee3201546a6da3ad6c181a68cae0bebf395e0de3516031e945.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4f9b5a18d6bceee3201546a6da3ad6c181a68cae0bebf395e0de3516031e945.dll,#1
  2⤵
  - Installs/modifies Browser Helper Object
  - Modifies registry class
  PID:316

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/316-133-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download