b0cd73895d1b7abd9afde556464733feb46e5da3eaf5bc0b105b4fc15b726712

General

Target

b0cd73895d1b7abd9afde556464733feb46e5da3eaf5bc0b105b4fc15b726712.exe
Size

263KB
MD5

3c24e8c069a63db138fe582142baf01b
SHA1

bc9a2f3542fe9fef211fe86973e227c3c98bd26b
SHA256

b0cd73895d1b7abd9afde556464733feb46e5da3eaf5bc0b105b4fc15b726712
SHA512

79f740b56ff4f252ede5226e34657c9ad81caf3fde1dde1ad904bea291b82660cc986b76fd15d6035316c2b714df46d3c692ae98a987f0a7041b11c6d6c8aa16
SSDEEP

6144:FZuuObR8sVImcyYmDuDOJTv5PWo89GPTT7UuZt9FxhZwp:6V+mzjUOJb5PSyXUuDHqp

Score

7^/10

adware persistence stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

b0cd73895d1b7abd9afde556464733feb46e5da3eaf5bc0b105b4fc15b726712.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	b0cd73895d1b7abd9afde556464733feb46e5da3eaf5bc0b105b4fc15b726712.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

regedit.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegStart = "C:\\WINDOWS\\system32\\evins.exe"	regedit.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

regedit.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	regedit.exe

Drops file in System32 directory 9 IoCs

Processes:

b0cd73895d1b7abd9afde556464733feb46e5da3eaf5bc0b105b4fc15b726712.exe

description	ioc	process
File created	C:\WINDOWS\SysWOW64\remove.reg	b0cd73895d1b7abd9afde556464733feb46e5da3eaf5bc0b105b4fc15b726712.exe
File opened for modification	C:\WINDOWS\SysWOW64\remove.reg	b0cd73895d1b7abd9afde556464733feb46e5da3eaf5bc0b105b4fc15b726712.exe
File opened for modification	C:\WINDOWS\SysWOW64\rs.bat	b0cd73895d1b7abd9afde556464733feb46e5da3eaf5bc0b105b4fc15b726712.exe
File opened for modification	C:\WINDOWS\SysWOW64\rs.REG	b0cd73895d1b7abd9afde556464733feb46e5da3eaf5bc0b105b4fc15b726712.exe
File created	C:\WINDOWS\SysWOW64\evins.exe	b0cd73895d1b7abd9afde556464733feb46e5da3eaf5bc0b105b4fc15b726712.exe
File opened for modification	C:\WINDOWS\SysWOW64\evins.exe	b0cd73895d1b7abd9afde556464733feb46e5da3eaf5bc0b105b4fc15b726712.exe
File created	C:\WINDOWS\SysWOW64\__tmp_rar_sfx_access_check_240542468	b0cd73895d1b7abd9afde556464733feb46e5da3eaf5bc0b105b4fc15b726712.exe
File created	C:\WINDOWS\SysWOW64\rs.REG	b0cd73895d1b7abd9afde556464733feb46e5da3eaf5bc0b105b4fc15b726712.exe
File created	C:\WINDOWS\SysWOW64\rs.bat	b0cd73895d1b7abd9afde556464733feb46e5da3eaf5bc0b105b4fc15b726712.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

regedit.exe

description	ioc	process
Key deleted	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser	regedit.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Toolbar	regedit.exe

Runs .reg file with regedit 1 IoCs

Processes:

regedit.exe

pid process

1160 regedit.exe

pid	process
1160	regedit.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

b0cd73895d1b7abd9afde556464733feb46e5da3eaf5bc0b105b4fc15b726712.execmd.exe

description	pid	process	target process
PID 4548 wrote to memory of 3552	4548	b0cd73895d1b7abd9afde556464733feb46e5da3eaf5bc0b105b4fc15b726712.exe	cmd.exe
PID 4548 wrote to memory of 3552	4548	b0cd73895d1b7abd9afde556464733feb46e5da3eaf5bc0b105b4fc15b726712.exe	cmd.exe
PID 4548 wrote to memory of 3552	4548	b0cd73895d1b7abd9afde556464733feb46e5da3eaf5bc0b105b4fc15b726712.exe	cmd.exe
PID 3552 wrote to memory of 1160	3552	cmd.exe	regedit.exe
PID 3552 wrote to memory of 1160	3552	cmd.exe	regedit.exe
PID 3552 wrote to memory of 1160	3552	cmd.exe	regedit.exe

C:\Users\Admin\AppData\Local\Temp\b0cd73895d1b7abd9afde556464733feb46e5da3eaf5bc0b105b4fc15b726712.exe
"C:\Users\Admin\AppData\Local\Temp\b0cd73895d1b7abd9afde556464733feb46e5da3eaf5bc0b105b4fc15b726712.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4548

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\WINDOWS\system32\rs.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:3552

C:\WINDOWS\SysWOW64\regedit.exe
regedit /s "C:\WINDOWS\system32\rs.Reg"
3⤵
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Runs .reg file with regedit
PID:1160

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\SysWOW64\rs.bat
Filesize
113B

MD5
bef89ec5606e83c7025b77b32743726c

SHA1
5f124a50ae8b3a9e4847a79f774fa09452427cbf

SHA256
570b9830189c4c8523dccb502d8b4d305b178b823a064160d4f4e0de27433769

SHA512
f14e25198b5ba55a609cdbe041fb0c849e06b0ac290957dcc16a6bd189a83e08f19f4ee4bffa46f7d38e759073a7296fe9aeeb73c3747282997da4737b5aad98

Download Submit
C:\Windows\SysWOW64\rs.REG
Filesize
980B

MD5
3598a9065070e99d2429926062a7b436

SHA1
72ee8c6448c1daf1c0f7a09d5190c97689aeea1b

SHA256
26f3b584dad3bbb2f3bce6f7b292fc74d5a644881a936ec985ad1da6d7aa5c0d

SHA512
2caf6d16534c9ce6348dde9f803704a0d5fa80ac296d002d7e3a7afaa2e8cc471e02084c50c360e10f06b96216af59544babd2eea09433a03152db0aacd65c41

Download Submit
memory/4548-145-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads