de75afcf7668eee9f206b620c4c85cc5f35a23fb707828eb9d2d82241783f24b

General

Target

0a2b01b67a4a45da6bc934058c5e5751.exe
Size

21KB
MD5

0a2b01b67a4a45da6bc934058c5e5751
SHA1

aa08cee0593a35a7225969863e15efea8e516f27
SHA256

de75afcf7668eee9f206b620c4c85cc5f35a23fb707828eb9d2d82241783f24b
SHA512

9e8f2a0dd2906525c7640f19110ed4d0b726a97a05a64d4e463362c3319eae0946ec4cfcef444d4b4b8f17b2c21847d99ea206369bdba4904b9c09ef298401e9
SSDEEP

384:6VI3+EdgavvxVcxjusw/v3wnOzgcZXxmfnds8US/zkw91AEfHdb:66+a7vxGgswH3wiBXWsLozkUAEfHd

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2908	explorer.exe

Loads dropped DLL 1 IoCs

pid	Process
3032	regsvr32.exe

Installs/modifies Browser Helper Object 2 TTPs 5 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{0CF76A8C-B122-49DA-8E37-642E97A5D85C}	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\g.dll	0a2b01b67a4a45da6bc934058c5e5751.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2924 set thread context of 2908	2924	0a2b01b67a4a45da6bc934058c5e5751.exe	29

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\vars-normal\MyCLSID = 8c6af70c22b1da498e37642e97a5d85c	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\vars-normal\LastConfigDownload = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\vars-normal	0a2b01b67a4a45da6bc934058c5e5751.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	0a2b01b67a4a45da6bc934058c5e5751.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\ConfigUpdate = 687474703a2f2f36392e35302e3137332e3136342f6164762f3239332f73702f6765745f636f6e662e706870	0a2b01b67a4a45da6bc934058c5e5751.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\vars-normal	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\vars-normal\BinaryCache	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\vars-normal\ConfigUpdate = 687474703a2f2f36392e35302e3137332e3136342f6164762f3239332f73702f6765745f636f6e662e7068706500	regsvr32.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0CF76A8C-B122-49DA-8E37-642E97A5D85C}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0CF76A8C-B122-49DA-8E37-642E97A5D85C}\InprocServer32\ = "C:\\Windows\\SysWow64\\g.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0CF76A8C-B122-49DA-8E37-642E97A5D85C}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0CF76A8C-B122-49DA-8E37-642E97A5D85C}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0CF76A8C-B122-49DA-8E37-642E97A5D85C}\	regsvr32.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 3032	2924	0a2b01b67a4a45da6bc934058c5e5751.exe	28
PID 2924 wrote to memory of 3032	2924	0a2b01b67a4a45da6bc934058c5e5751.exe	28
PID 2924 wrote to memory of 3032	2924	0a2b01b67a4a45da6bc934058c5e5751.exe	28
PID 2924 wrote to memory of 3032	2924	0a2b01b67a4a45da6bc934058c5e5751.exe	28
PID 2924 wrote to memory of 3032	2924	0a2b01b67a4a45da6bc934058c5e5751.exe	28
PID 2924 wrote to memory of 3032	2924	0a2b01b67a4a45da6bc934058c5e5751.exe	28
PID 2924 wrote to memory of 3032	2924	0a2b01b67a4a45da6bc934058c5e5751.exe	28
PID 2924 wrote to memory of 2908	2924	0a2b01b67a4a45da6bc934058c5e5751.exe	29
PID 2924 wrote to memory of 2908	2924	0a2b01b67a4a45da6bc934058c5e5751.exe	29
PID 2924 wrote to memory of 2908	2924	0a2b01b67a4a45da6bc934058c5e5751.exe	29
PID 2924 wrote to memory of 2908	2924	0a2b01b67a4a45da6bc934058c5e5751.exe	29
PID 2924 wrote to memory of 2908	2924	0a2b01b67a4a45da6bc934058c5e5751.exe	29

C:\Users\Admin\AppData\Local\Temp\0a2b01b67a4a45da6bc934058c5e5751.exe
"C:\Users\Admin\AppData\Local\Temp\0a2b01b67a4a45da6bc934058c5e5751.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32.exe /s C:\Windows\system32\g.dll
  2⤵
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:3032
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  - Deletes itself
  PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\g.dll

Filesize
14KB

MD5
5d4645be5ca0c5f7551322de73fe14c3

SHA1
4c8f94944f77d9befcc7440ab124af1eb1f94593

SHA256
f381a2d43c722e53eb376e69e65624ef41c8ab89dd30359e97d50a706a11d0dc

SHA512
e0853a4d416552b3e03dd5406f71570571c04e41c69e75af558b8f2844655cd65f1034077f4994a27581d4d09784c3e7c7c7dc45b6b29ad92ed6a5baed02c1b5

Download Submit
memory/3032-3-0x0000000010000000-0x0000000010009000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads