1185e8a0a1170699b12cdb02fdaa08debd61958c7cc4dc89d1001d05e0a0ed1c

General

Target

157665b8a0cdd43987783b3478a4cbe3.exe
Size

259KB
MD5

157665b8a0cdd43987783b3478a4cbe3
SHA1

47aa15bd5ee39f6f28107c5c097da825f0a0f7f4
SHA256

1185e8a0a1170699b12cdb02fdaa08debd61958c7cc4dc89d1001d05e0a0ed1c
SHA512

d036d8adb1a0e7f2fb2df65c7fdd7885e9ad335098383608fcafd4eac96963ade543113628511935e7bbddedaa165f7787d2c60735a9d89178db85cd4a6abb0c
SSDEEP

6144:+G95BfOnPVfetbv8brONHVMmrYwi80BSZvm0Hq4DM:+G95NOnPVfepEbM1z7uBSZNq4DM

Score

7^/10

adware aspackv2 stealer

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x00080000000224fc-6.dat	aspack_v212_v242

Loads dropped DLL 1 IoCs

pid	Process
1076	Regsvr32.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{92AF48F0-3DD6-41BE-90AF-4F80BCB6A486}	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{92AF48F0-3DD6-41BE-90AF-4F80BCB6A486}\	Regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Info.dll	157665b8a0cdd43987783b3478a4cbe3.exe

Modifies registry class 11 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{92AF48F0-3DD6-41BE-90AF-4F80BCB6A486}\InprocServer32\ThreadingModel = "Apartment"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Info.Info Class	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Info.Info Class\ = "Info Class"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Info.Info Class\Clsid	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{92AF48F0-3DD6-41BE-90AF-4F80BCB6A486}\ProgID\ = "Info.Info Class"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{92AF48F0-3DD6-41BE-90AF-4F80BCB6A486}	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{92AF48F0-3DD6-41BE-90AF-4F80BCB6A486}\InprocServer32	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Info.Info Class\Clsid\ = "{92AF48F0-3DD6-41BE-90AF-4F80BCB6A486}"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{92AF48F0-3DD6-41BE-90AF-4F80BCB6A486}\ProgID	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{92AF48F0-3DD6-41BE-90AF-4F80BCB6A486}\ = "Info Class"	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{92AF48F0-3DD6-41BE-90AF-4F80BCB6A486}\InprocServer32\ = "C:\\Windows\\SysWow64\\Info.dll"	Regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 1076	1616	157665b8a0cdd43987783b3478a4cbe3.exe	88
PID 1616 wrote to memory of 1076	1616	157665b8a0cdd43987783b3478a4cbe3.exe	88
PID 1616 wrote to memory of 1076	1616	157665b8a0cdd43987783b3478a4cbe3.exe	88
PID 1616 wrote to memory of 3624	1616	157665b8a0cdd43987783b3478a4cbe3.exe	92
PID 1616 wrote to memory of 3624	1616	157665b8a0cdd43987783b3478a4cbe3.exe	92
PID 1616 wrote to memory of 3624	1616	157665b8a0cdd43987783b3478a4cbe3.exe	92

C:\Users\Admin\AppData\Local\Temp\157665b8a0cdd43987783b3478a4cbe3.exe
"C:\Users\Admin\AppData\Local\Temp\157665b8a0cdd43987783b3478a4cbe3.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Windows\SysWOW64\Regsvr32.exe
  Regsvr32 /s "C:\Windows\system32\Info.dll"
  2⤵
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - Modifies registry class
  PID:1076
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c .\UnInstall.bat
  2⤵
  PID:3624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\UnInstall.bat

Filesize
178B

MD5
d8c5bfe31aa4280a647508995b51c042

SHA1
f033977f0b46ecefad273e0f6b57de00f6aeaa1d

SHA256
154de7577a6a46bbfd08c55ae6bca3557c15239842be83087f03398095472f57

SHA512
a5e4a37436aefe99454ee2d0a0c1a0b3db0f7bb50675e989424b1bd382f3fe1485a6a6aa44f245111c0505f839eb7f27bf65df0e00278d2752fa1b811fc031bb

Download Submit
C:\Windows\SysWOW64\Info.dll

Filesize
88KB

MD5
8af51e9ed739bf43e9c2d9870be5233f

SHA1
23b35a1b0c5e3c0439312fd501bf83a2277b337c

SHA256
f705bfb9013e373a513f94304e6b659141d52675bcc1d11e23bed7c48c87ecba

SHA512
07fd3f6f196a425411327cb91932da10b624b49beeabf31373d10bcca0a92531df0a245294d65fa883e228d1155b6a1b7ac2092b46e4e510103530724864460a

Download Submit
memory/1076-8-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1076-9-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1076-10-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1616-0-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/1616-1-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/1616-2-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/1616-3-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/1616-5-0x0000000000960000-0x0000000000961000-memory.dmp

Filesize
4KB

Download
memory/1616-13-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download

Analysis

Sharing