e606d4733adf353c8a7bf7d021e43c3920a304538bef46d857df5fd5b64e3dc1

General

Target

3c2d81eaee0204ac08594ca6872f1b77.exe
Size

431KB
MD5

3c2d81eaee0204ac08594ca6872f1b77
SHA1

4882168c92b3c1f91e21289436c5f482025b3522
SHA256

e606d4733adf353c8a7bf7d021e43c3920a304538bef46d857df5fd5b64e3dc1
SHA512

2195fdab9a36b177fe8c4518b2e6f0212e546a70ad105f276e826ec5a5db4e2d48a5d1551e0738354444bcc5e23af921b004a4788d57349fcc8d125657c50434
SSDEEP

12288:sQ412eBEXfiDanUdpqjyzyQlPKEEQsd+xB:ZNeBIqoY7plPKhNd+7

Score

8^/10

adware evasion stealer upx

Malware Config

Signatures

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
5300	attrib.exe

Executes dropped EXE 3 IoCs

pid	Process
3056	taskngr.exe
4480	wddmgr.exe
4428	cmss.exe

Loads dropped DLL 2 IoCs

pid	Process
4480	wddmgr.exe
6128	regsvr32.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3056-7-0x0000000000400000-0x0000000000571000-memory.dmp	upx
behavioral2/memory/3056-28-0x0000000000400000-0x0000000000571000-memory.dmp	upx
behavioral2/memory/3056-30-0x0000000000400000-0x0000000000571000-memory.dmp	upx

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D032570A-5F63-4812-A094-87D007C23012}\	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{D032570A-5F63-4812-A094-87D007C23012}	regsvr32.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\taskngr.exe	3c2d81eaee0204ac08594ca6872f1b77.exe
File created	C:\Windows\SysWOW64\WinIo.dll	taskngr.exe
File created	C:\Windows\SysWOW64\WinIo.sys	taskngr.exe
File created	C:\Windows\SysWOW64\TEBHO.dll	taskngr.exe
File created	C:\Windows\SysWOW64\wddmgr.exe	taskngr.exe
File created	C:\Windows\SysWOW64\cmss.exe	taskngr.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
3688	taskkill.exe

Modifies registry class 11 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D032570A-5F63-4812-A094-87D007C23012}\InprocServer32\ = "C:\\Windows\\SysWow64\\TEBHO.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D032570A-5F63-4812-A094-87D007C23012}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TEBHO.TIEAdvBHO	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TEBHO.TIEAdvBHO\Clsid\ = "{D032570A-5F63-4812-A094-87D007C23012}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D032570A-5F63-4812-A094-87D007C23012}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D032570A-5F63-4812-A094-87D007C23012}\ProgID\ = "TEBHO.TIEAdvBHO"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D032570A-5F63-4812-A094-87D007C23012}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D032570A-5F63-4812-A094-87D007C23012}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TEBHO.TIEAdvBHO\Clsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D032570A-5F63-4812-A094-87D007C23012}\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TEBHO.TIEAdvBHO\	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3056	taskngr.exe
3056	taskngr.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
656	Process not Found

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 3056	2908	3c2d81eaee0204ac08594ca6872f1b77.exe	18
PID 2908 wrote to memory of 3056	2908	3c2d81eaee0204ac08594ca6872f1b77.exe	18
PID 2908 wrote to memory of 3056	2908	3c2d81eaee0204ac08594ca6872f1b77.exe	18
PID 3056 wrote to memory of 3656	3056	taskngr.exe	31
PID 3056 wrote to memory of 3656	3056	taskngr.exe	31
PID 3056 wrote to memory of 3656	3056	taskngr.exe	31
PID 3056 wrote to memory of 2644	3056	taskngr.exe	30
PID 3056 wrote to memory of 2644	3056	taskngr.exe	30
PID 3056 wrote to memory of 2644	3056	taskngr.exe	30
PID 3056 wrote to memory of 4480	3056	taskngr.exe	29
PID 3056 wrote to memory of 4480	3056	taskngr.exe	29
PID 3056 wrote to memory of 4480	3056	taskngr.exe	29
PID 3656 wrote to memory of 5300	3656	cmd.exe	27
PID 3656 wrote to memory of 5300	3656	cmd.exe	27
PID 3656 wrote to memory of 5300	3656	cmd.exe	27
PID 3056 wrote to memory of 4428	3056	taskngr.exe	28
PID 3056 wrote to memory of 4428	3056	taskngr.exe	28
PID 3056 wrote to memory of 4428	3056	taskngr.exe	28
PID 2644 wrote to memory of 6128	2644	cmd.exe	21
PID 2644 wrote to memory of 6128	2644	cmd.exe	21
PID 2644 wrote to memory of 6128	2644	cmd.exe	21
PID 3056 wrote to memory of 4448	3056	taskngr.exe	112
PID 3056 wrote to memory of 4448	3056	taskngr.exe	112
PID 3056 wrote to memory of 4448	3056	taskngr.exe	112
PID 4448 wrote to memory of 3688	4448	cmd.exe	111
PID 4448 wrote to memory of 3688	4448	cmd.exe	111
PID 4448 wrote to memory of 3688	4448	cmd.exe	111

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
5300	attrib.exe

C:\Users\Admin\AppData\Local\Temp\3c2d81eaee0204ac08594ca6872f1b77.exe
"C:\Users\Admin\AppData\Local\Temp\3c2d81eaee0204ac08594ca6872f1b77.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\SysWOW64\taskngr.exe
  C:\Windows\system32\taskngr.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Windows\SysWOW64\cmss.exe
    C:\Windows\system32\cmss.exe
    3⤵
    - Executes dropped EXE
    PID:4428
- - C:\Windows\SysWOW64\wddmgr.exe
    C:\Windows\system32\wddmgr.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4480
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c regsvr32 /s TEBHO.dll
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2644
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +s +h c:/file.txt
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3656
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /im wddmgr.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4448

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s TEBHO.dll
1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:6128

C:\Windows\SysWOW64\attrib.exe
attrib +s +h c:/file.txt
1⤵
- Sets file to hidden
- Views/modifies file attributes
PID:5300

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /im wddmgr.exe
1⤵
- Kills process with taskkill
PID:3688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Hide Artifacts

2

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2908-0-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download
memory/2908-18-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download
memory/2908-2-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download
memory/2908-1-0x00000000006B0000-0x00000000006B1000-memory.dmp

Filesize
4KB

Download
memory/3056-7-0x0000000000400000-0x0000000000571000-memory.dmp

Filesize
1.4MB

Download
memory/3056-8-0x00000000023E0000-0x00000000023E1000-memory.dmp

Filesize
4KB

Download
memory/3056-28-0x0000000000400000-0x0000000000571000-memory.dmp

Filesize
1.4MB

Download
memory/3056-30-0x0000000000400000-0x0000000000571000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads