e36ed63bc2762758a303d3faa4590c6cc3776d75c8020a6fedb154145fa9c6d3

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 07:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2d45d4fd73232a6eb99221ecafeaaaaa.exe
Size

206KB
MD5

2d45d4fd73232a6eb99221ecafeaaaaa
SHA1

c9e3a1058f81e592a41510dfd108ce9191885cf7
SHA256

e36ed63bc2762758a303d3faa4590c6cc3776d75c8020a6fedb154145fa9c6d3
SHA512

f3ab8b8c0f783312dd6e13db3222104ad225438f179b748993571ee701fe404900e6ffa3e364bab4a018d7b0bcbd4ced9abe11158d314d51abc834d96b37d46b
SSDEEP

3072:ckScXtUe6vuQJ4aZ1cfRqESP/ib11tF02YwxIsJISxDi:XScX1FQBEJtEozFgwxIsJXDi

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
2360	2d45d4fd73232a6eb99221ecafeaaaaa.exe
2360	2d45d4fd73232a6eb99221ecafeaaaaa.exe
2360	2d45d4fd73232a6eb99221ecafeaaaaa.exe
2116	rundll32.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\BetterCareerSearch_2bEI\Installr\1.bin\NP2bEISb.dll	2d45d4fd73232a6eb99221ecafeaaaaa.exe
File created	C:\Program Files (x86)\BetterCareerSearch_2bEI\Installr\1.bin\2bEZSETP.dl_	2d45d4fd73232a6eb99221ecafeaaaaa.exe
File created	C:\Program Files (x86)\BetterCareerSearch_2bEI\Installr\1.bin\2bEZSETP.dll	2d45d4fd73232a6eb99221ecafeaaaaa.exe
File created	C:\Program Files (x86)\BetterCareerSearch_2bEI\Installr\1.bin\2bEIPlug.dll	2d45d4fd73232a6eb99221ecafeaaaaa.exe
File opened for modification	C:\Program Files (x86)\BetterCareerSearch_2bEI\Installr\1.bin\2bEZSETP.dll	2d45d4fd73232a6eb99221ecafeaaaaa.exe
File opened for modification	C:\Program Files (x86)\BetterCareerSearch_2bEI\Installr\1.bin\NP2bEISb.dl_	2d45d4fd73232a6eb99221ecafeaaaaa.exe
File created	C:\Program Files (x86)\BetterCareerSearch_2bEI\Installr\1.bin\NP2bEISb.dl_	2d45d4fd73232a6eb99221ecafeaaaaa.exe
File created	C:\Program Files (x86)\BetterCareerSearch_2bEI\Installr\1.bin\NP2bEISb.dll	2d45d4fd73232a6eb99221ecafeaaaaa.exe
File opened for modification	C:\Program Files (x86)\BetterCareerSearch_2bEI\Installr\1.bin\2bEIPlug.dll	2d45d4fd73232a6eb99221ecafeaaaaa.exe
File opened for modification	C:\Program Files (x86)\BetterCareerSearch_2bEI\Installr\1.bin\2bEIPlug.dl_	2d45d4fd73232a6eb99221ecafeaaaaa.exe
File created	C:\Program Files (x86)\BetterCareerSearch_2bEI\Installr\1.bin\2bEIPlug.dl_	2d45d4fd73232a6eb99221ecafeaaaaa.exe
File opened for modification	C:\Program Files (x86)\BetterCareerSearch_2bEI\Installr\1.bin\2bEZSETP.dl_	2d45d4fd73232a6eb99221ecafeaaaaa.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C6CA3EF6-CB8C-461D-9ABE-A8A75D241166}\TypeLib\ = "{92DA7491-D31A-41CF-8674-E0D00397176F}"	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C6CA3EF6-CB8C-461D-9ABE-A8A75D241166}\ = "It8InstallerStart"	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7D2D8E65-83BC-4C25-80B2-380F903627F8}	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7D2D8E65-83BC-4C25-80B2-380F903627F8}\ = "_It8InstallerStartEvents"	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7e965289-72d5-4116-8094-ca3e30c1ff4f}\ProgID	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C6CA3EF6-CB8C-461D-9ABE-A8A75D241166}\ProxyStubClsid32	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C6CA3EF6-CB8C-461D-9ABE-A8A75D241166}\TypeLib\ = "{92DA7491-D31A-41CF-8674-E0D00397176F}"	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7D2D8E65-83BC-4C25-80B2-380F903627F8}\TypeLib\ = "{92DA7491-D31A-41CF-8674-E0D00397176F}"	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BetterCareerSearch_2bInstaller.Start.1\	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C6CA3EF6-CB8C-461D-9ABE-A8A75D241166}\TypeLib	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C6CA3EF6-CB8C-461D-9ABE-A8A75D241166}\ProxyStubClsid32	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7D2D8E65-83BC-4C25-80B2-380F903627F8}\TypeLib	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BetterCareerSearch_2bInstaller.Start	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7e965289-72d5-4116-8094-ca3e30c1ff4f}\VersionIndependentProgID	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{92DA7491-D31A-41CF-8674-E0D00397176F}\1.0\0\win32	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7D2D8E65-83BC-4C25-80B2-380F903627F8}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{92DA7491-D31A-41CF-8674-E0D00397176F}\1.0\ = "Installer 1.0 Type Library"	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C6CA3EF6-CB8C-461D-9ABE-A8A75D241166}\TypeLib\Version = "1.0"	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BetterCareerSearch_2bInstaller.Start\CLSID	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7e965289-72d5-4116-8094-ca3e30c1ff4f}\InprocServer32\ = "C:\\Program Files (x86)\\BetterCareerSearch_2bEI\\Installr\\1.bin\\2bEZSETP.dll"	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{92DA7491-D31A-41CF-8674-E0D00397176F}	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{92DA7491-D31A-41CF-8674-E0D00397176F}\1.0\FLAGS\ = "0"	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C6CA3EF6-CB8C-461D-9ABE-A8A75D241166}\TypeLib	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7D2D8E65-83BC-4C25-80B2-380F903627F8}	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7D2D8E65-83BC-4C25-80B2-380F903627F8}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BetterCareerSearch_2bInstaller.Start.1\CLSID\ = "{7e965289-72d5-4116-8094-ca3e30c1ff4f}"	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7e965289-72d5-4116-8094-ca3e30c1ff4f}\Version	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C6CA3EF6-CB8C-461D-9ABE-A8A75D241166}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BetterCareerSearch_2bInstaller.Start\CLSID\ = "{7e965289-72d5-4116-8094-ca3e30c1ff4f}"	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{92DA7491-D31A-41CF-8674-E0D00397176F}\1.0	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C6CA3EF6-CB8C-461D-9ABE-A8A75D241166}	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7e965289-72d5-4116-8094-ca3e30c1ff4f}\Programmable	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{92DA7491-D31A-41CF-8674-E0D00397176F}\1.0\0\win32\ = "C:\\Program Files (x86)\\BetterCareerSearch_2bEI\\Installr\\1.bin\\2bEZSETP.dll\\1"	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7e965289-72d5-4116-8094-ca3e30c1ff4f}\VersionIndependentProgID\ = "BetterCareerSearch_2bInstaller.Start"	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7e965289-72d5-4116-8094-ca3e30c1ff4f}\Control	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{92DA7491-D31A-41CF-8674-E0D00397176F}\1.0\FLAGS	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7e965289-72d5-4116-8094-ca3e30c1ff4f}	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7e965289-72d5-4116-8094-ca3e30c1ff4f}\ProgID\ = "BetterCareerSearch_2bInstaller.Start.1"	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7e965289-72d5-4116-8094-ca3e30c1ff4f}\TypeLib\ = "{92da7491-d31a-41cf-8674-e0d00397176f}"	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{92DA7491-D31A-41CF-8674-E0D00397176F}\1.0\HELPDIR	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7D2D8E65-83BC-4C25-80B2-380F903627F8}\TypeLib\Version = "1.0"	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BetterCareerSearch_2bInstaller.Start.1	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7e965289-72d5-4116-8094-ca3e30c1ff4f}\MiscStatus\ = "0"	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7e965289-72d5-4116-8094-ca3e30c1ff4f}\TypeLib	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7e965289-72d5-4116-8094-ca3e30c1ff4f}\Version\ = "1.0"	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C6CA3EF6-CB8C-461D-9ABE-A8A75D241166}\TypeLib\Version = "1.0"	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7e965289-72d5-4116-8094-ca3e30c1ff4f}\	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7e965289-72d5-4116-8094-ca3e30c1ff4f}\MiscStatus\1\ = "131473"	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7e965289-72d5-4116-8094-ca3e30c1ff4f}\MiscStatus	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{92DA7491-D31A-41CF-8674-E0D00397176F}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\BetterCareerSearch_2bEI\\Installr\\1.bin\\2bEZSETP.dll\\"	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C6CA3EF6-CB8C-461D-9ABE-A8A75D241166}\ = "It8InstallerStart"	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7D2D8E65-83BC-4C25-80B2-380F903627F8}\TypeLib\Version = "1.0"	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7D2D8E65-83BC-4C25-80B2-380F903627F8}\TypeLib	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BetterCareerSearch_2bInstaller.Start\	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7e965289-72d5-4116-8094-ca3e30c1ff4f}\InprocServer32\ThreadingModel = "Apartment"	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{92DA7491-D31A-41CF-8674-E0D00397176F}\1.0\0	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7D2D8E65-83BC-4C25-80B2-380F903627F8}\ProxyStubClsid32	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C6CA3EF6-CB8C-461D-9ABE-A8A75D241166}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7D2D8E65-83BC-4C25-80B2-380F903627F8}\ = "_It8InstallerStartEvents"	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BetterCareerSearch_2bInstaller.Start\CurVer	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BetterCareerSearch_2bInstaller.Start\CurVer\ = "BetterCareerSearch_2bInstaller.Start.1"	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7e965289-72d5-4116-8094-ca3e30c1ff4f}\MiscStatus\1	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C6CA3EF6-CB8C-461D-9ABE-A8A75D241166}	2d45d4fd73232a6eb99221ecafeaaaaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7D2D8E65-83BC-4C25-80B2-380F903627F8}\ProxyStubClsid32	2d45d4fd73232a6eb99221ecafeaaaaa.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2116	2360	2d45d4fd73232a6eb99221ecafeaaaaa.exe	17
PID 2360 wrote to memory of 2116	2360	2d45d4fd73232a6eb99221ecafeaaaaa.exe	17
PID 2360 wrote to memory of 2116	2360	2d45d4fd73232a6eb99221ecafeaaaaa.exe	17

C:\Users\Admin\AppData\Local\Temp\2d45d4fd73232a6eb99221ecafeaaaaa.exe
"C:\Users\Admin\AppData\Local\Temp\2d45d4fd73232a6eb99221ecafeaaaaa.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SysWOW64\rundll32.exe
  rundll32 C:\PROGRA~2\BETTER~1\Installr\1.bin\2bEZSETP.dll,Update
  2⤵
  - Loads dropped DLL
  PID:2116

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads