Analysis Overview
SHA256
2321f245a5e01b903075619bcca1aebfc554a9237924ad6c5120370f287e0d5a
Threat Level: Shows suspicious behavior
The file 9000b78b0179d9d66d117afed1e45f18 was found to be: Shows suspicious behavior.
Malicious Activity Summary
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
Checks installed software on the system
Drops Chrome extension
Installs/modifies Browser Helper Object
Unsigned PE
Modifies Internet Explorer settings
Suspicious use of WriteProcessMemory
System policy modification
Modifies registry class
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-02-04 19:47
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-02-04 19:47
Reported
2024-02-04 19:50
Platform
win7-20231215-en
Max time kernel
122s
Max time network
130s
Command Line
Signatures
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\9000b78b0179d9d66d117afed1e45f18.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
Reads user/profile data of web browsers
Checks installed software on the system
Drops Chrome extension
| Description | Indicator | Process | Target |
| File created | C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ioejhbbloegdmkljhkeadkglapijgklc\1.6\manifest.json | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
Installs/modifies Browser Helper Object
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF} | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\ = "DoiWnlooad keeper" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\NoExplorer = "1" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key deleted | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF} | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF} | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key deleted | \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF} | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key deleted | \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\keeoper.1.6\CLSID\ = "{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key deleted | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\ProgID | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0 | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\DoiWnlooad keeper" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Download | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\keeoper.Download | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\keeoper\CLSID | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\ProgID | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key deleted | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF} | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0 | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32 | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32 | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\InprocServer32\ = "C:\\ProgramData\\DoiWnlooad keeper\\QUr4L.dll" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\keeoper\CLSID\ = "{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\keeoper\CurVer\ = "Download keeoper.1.6" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F} | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\VersionIndependentProgID\ = "Download keeoper" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F} | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\keeoper.1.6\ = "DoiWnlooad keeper" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\ProgID\ = "Download keeoper.1.6" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key deleted | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\VersionIndependentProgID | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\DoiWnlooad keeper\\QUr4L.tlb" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\keeoper | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\keeoper\ = "DoiWnlooad keeper" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\keeoper\CurVer | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\ = "DoiWnlooad keeper" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\InprocServer32 | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755} | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32 | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\Programmable | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32 | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\VersionIndependentProgID | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key deleted | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\InprocServer32 | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32 | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\keeoper.1.6 | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF} | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\keeoper.1.6\CLSID | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\InprocServer32\ThreadingModel = "Apartment" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key deleted | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\Programmable | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F} | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
Suspicious use of WriteProcessMemory
System policy modification
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF} = "1" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\9000b78b0179d9d66d117afed1e45f18.exe
"C:\Users\Admin\AppData\Local\Temp\9000b78b0179d9d66d117afed1e45f18.exe"
C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe
"C:\Users\Admin\AppData\Local\Temp/00294823/NEOEM0.exe"
Network
Files
\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe
| MD5 | 8300c91b40229b42301aebc6d8859907 |
| SHA1 | 0b55e56a6add6b4dd4ceff475a0018a203d02a5a |
| SHA256 | f54a6814ac06c70ef5b738eca4855e49039783d96b70ba1ae461bd90877e53b5 |
| SHA512 | 0863750da143e1707513f4a2efe1ad6cf81f5a819c7d5496d1629745afffcf72338aa9de90479d5e0936e848f9b260c434fd369027c56be175814086cafd4d8f |
C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.dat
| MD5 | db47b3f375db127ab32c38236294524f |
| SHA1 | 3f647b0a0e80bf98be0a68a4e5ee3bbbc3288632 |
| SHA256 | f40a213f5236b2d76d2f0c03ca2a1ac18a00f210e64792e4de7ae563c3d002c3 |
| SHA512 | eeb31c9472c709da9df5a292264c3c61873f8d831d0559359819326d898c38c38d88c2fbe9aacb33b09cc5d5c460f8766699b0bdb9eb6b353cbc8420117dc997 |
C:\Users\Admin\AppData\Local\Temp\00294823\ioejhbbloegdmkljhkeadkglapijgklc\background.html
| MD5 | c1a9f2ef1f0b8d61aa775a82322c88a7 |
| SHA1 | 6b51be0cb87cf0b797a8578ee260de89f94f1cc4 |
| SHA256 | 4be01deb1871aa1cf615f89e81a8d7a3495284af4b3b27d8b46ad5a6f2dccd2c |
| SHA512 | 6e93e2266b5fbeb86e844953171f1c097cf8a3a8207833cb5b156066f6ae26fdab71b9968164c8d20a67985dadc1c0d5e14c565d89413c20a7c24a52da18faea |
C:\Users\Admin\AppData\Local\Temp\00294823\ioejhbbloegdmkljhkeadkglapijgklc\content.js
| MD5 | 5f9891607f65f433b0690bae7088b2c1 |
| SHA1 | b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de |
| SHA256 | fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b |
| SHA512 | 76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c |
C:\Users\Admin\AppData\Local\Temp\00294823\ioejhbbloegdmkljhkeadkglapijgklc\lsdb.js
| MD5 | 209b7ae0b6d8c3f9687c979d03b08089 |
| SHA1 | 6449f8bff917115eef4e7488fae61942a869200f |
| SHA256 | e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704 |
| SHA512 | 1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25 |
C:\Users\Admin\AppData\Local\Temp\00294823\ioejhbbloegdmkljhkeadkglapijgklc\manifest.json
| MD5 | 31084dff5cb37bc3cbbe4ddeacc8f7f1 |
| SHA1 | f2fb1ee7152c398900132ca50df903029823c477 |
| SHA256 | 39edb1085519fe935c00733c6770037fd84b8da0f4ec46406163c8459325c515 |
| SHA512 | 61b3cda7684524eceff0ee7a9e0a7df6dd51da61a78322619e2bbaa686437d56cfaa650269a6cbc3cd1de3e34f302baa6ae7e38d1cf25239aae7038bf53e186d |
C:\Users\Admin\AppData\Local\Temp\00294823\ioejhbbloegdmkljhkeadkglapijgklc\Pky4Sm.js
| MD5 | caa80d49e977878a43ad08a10e39814a |
| SHA1 | 64b62e8b529bc3012305cb7436c575143a4f0448 |
| SHA256 | aa77efa87427ea25dbd083e56e79420381e0cf814d12cbd0208480cbbb7dc44d |
| SHA512 | ec60954d9402ce140bd101ccb817fdc0f2a3f90ad2cd4c5b30dd1c9c5611c8cfae6c9e109678b1d7624704b996fa5445f236f1608a4b8c244643c3df63ea4d1f |
C:\Users\Admin\AppData\Local\Temp\00294823\ioejhbbloegdmkljhkeadkglapijgklc\sqlite.js
| MD5 | e71cd2cdc37a7d0897a7fa3f505f319e |
| SHA1 | 4481fd87b6ca7d15b15d7e08862585fbbbef528e |
| SHA256 | 8b0277f2c65a357006c741812a988554989b62d64df60103d74f8283829ed2af |
| SHA512 | 5cbedceee5d8c70caa81aed31644433124760c6b43ea565bd372a79e95d8d194b291cb78758da5ae385548c0b151f8400756fab028d6affc5b30b0ed814354ff |
C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\chrome.manifest
| MD5 | 7f067990fd33cb046a2bf0a1d4c99bd8 |
| SHA1 | 2e4750dd26bf1234d53adf75ad391b4128cce751 |
| SHA256 | a0c96ba1eec1259667813b862754174442f4e03502563e7188b2765d8924365c |
| SHA512 | a09786be891cb5c92e94b10cb8dd7ec254a44f180b9b042970730abad880faf1ca57647b7d424340a7c4713027e03f9684ead35e0e676208454bb49d3511e2a2 |
C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\bootstrap.js
| MD5 | 1b53c596cfb1aa2209446ff64c17dabd |
| SHA1 | 2542da14728dcdbe1763f1ee39fe9ceae38ad414 |
| SHA256 | a7dfea4bf7e1d46a8b8e64ccfb2cf35017e3a5b350eead26d6671254d2b3c46f |
| SHA512 | be54481675c38ef6a41697cf8cd3ab5a0b126922b192732a9c587dd8905b74b66c79eb0c849f62bbe8934979a894be63734b0ad59ffae295f5797cbfaa327030 |
C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\content\bg.js
| MD5 | ec1c4ac8ed1ff32e6ce6012d81cbf714 |
| SHA1 | e793a39eedbce0c8af7f54af814f4b358a996419 |
| SHA256 | 6f5c2ae7610dc0455ef651e8730491d4c93c2e9b839abd5f3b21abb73f2b5eec |
| SHA512 | 5ce1bf98138516f21fff09c9b6020136e2f72c3410c7e63f9952a931732978cf3924553c544d8f71d1ce594944d9d4dc32bc6f923214bc3749bed76dff8382c6 |
C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\install.rdf
| MD5 | 6600e9fd5a4d577495e3b245f0277255 |
| SHA1 | dd4ee36811800e0c610708043caa6aeb4288d089 |
| SHA256 | 262e3d642e9e5afb3d700f52dfa174d7efc25d6578efc4709b67da5369fedb1e |
| SHA512 | d0286e7e40deb028d1c837ec16b2afe1140fb487fe9a632c48a8748e00609ecc0474b9736f299a0e455c4e502e8d133f78e8390fcf9f63190676c774df2dd6fb |
C:\Users\Admin\AppData\Local\Temp\00294823\QUr4L.dll
| MD5 | e9b27306a18f18b88945cdf066de2fc9 |
| SHA1 | 4d18490fbb336e261301a967047065dd561cc2f2 |
| SHA256 | a9880b90d24af3786886306aefe5c79ff3cb2fb7b36ee5fb7bf2af85f240d63c |
| SHA512 | f255e8bfb13cfa070b31f47b12a4aacf9ab75a6a8191b6b83740d02c3f007b6d5255a5c2c12bc7b599996742973d2faccb5463d96d16c7aba40e34776823c706 |
C:\Users\Admin\AppData\Local\Temp\00294823\QUr4L.tlb
| MD5 | 39d776f73d1d3f771aaa8c3561367c3a |
| SHA1 | eef842aa02927bd7fbe7d569c5446ef1a2ea065f |
| SHA256 | c2156787eeb818e587529572599fa124773c71330fb93e1c79f4cb9141090941 |
| SHA512 | 3174095accbf422730e60f61523dec01a9a4519cb4642a641c5f547d530ad41f5386d383b90f7daf34f1f36635775929e99d7fe0030aa24cee30f4de8376eeb3 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-02-04 19:47
Reported
2024-02-04 19:50
Platform
win10v2004-20231215-en
Max time kernel
93s
Max time network
116s
Command Line
Signatures
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
Reads user/profile data of web browsers
Checks installed software on the system
Drops Chrome extension
| Description | Indicator | Process | Target |
| File created | C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ioejhbbloegdmkljhkeadkglapijgklc\1.6\manifest.json | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
Installs/modifies Browser Helper Object
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\ = "DoiWnlooad keeper" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\NoExplorer = "1" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key deleted | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF} | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF} | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF} | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key deleted | \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVEDEXTENSIONSMIGRATION\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF} | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key deleted | \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\ProgID\ = "Download keeoper.1.6" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\keeoper\CLSID | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\ = "DoiWnlooad keeper" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key deleted | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\VersionIndependentProgID | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\DoiWnlooad keeper\\QUr4L.tlb" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F} | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32 | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\InprocServer32\ = "C:\\ProgramData\\DoiWnlooad keeper\\QUr4L.dll" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\InprocServer32\ThreadingModel = "Apartment" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0 | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\DoiWnlooad keeper" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Download | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755} | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key deleted | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\ProgID | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32 | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32 | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\keeoper.1.6 | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32 | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\keeoper\CurVer | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\VersionIndependentProgID | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF} | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F} | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\VersionIndependentProgID\ = "Download keeoper" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\keeoper.1.6\CLSID | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\keeoper | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F} | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\keeoper\CLSID\ = "{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\Programmable | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key deleted | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\InprocServer32 | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F} | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key deleted | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF} | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0 | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key deleted | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\Programmable | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\keeoper.1.6\CLSID\ = "{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\ProgID | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32 | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\keeoper.Download | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\keeoper.1.6\ = "DoiWnlooad keeper" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\InprocServer32 | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\keeoper\ = "DoiWnlooad keeper" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2188 wrote to memory of 4772 | N/A | C:\Users\Admin\AppData\Local\Temp\9000b78b0179d9d66d117afed1e45f18.exe | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe |
| PID 2188 wrote to memory of 4772 | N/A | C:\Users\Admin\AppData\Local\Temp\9000b78b0179d9d66d117afed1e45f18.exe | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe |
| PID 2188 wrote to memory of 4772 | N/A | C:\Users\Admin\AppData\Local\Temp\9000b78b0179d9d66d117afed1e45f18.exe | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe |
System policy modification
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF} = "1" | C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\9000b78b0179d9d66d117afed1e45f18.exe
"C:\Users\Admin\AppData\Local\Temp\9000b78b0179d9d66d117afed1e45f18.exe"
C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe
"C:\Users\Admin\AppData\Local\Temp/00294823/NEOEM0.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 203.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 20.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.165.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 16.234.44.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 81.171.91.138.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 140.71.91.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 207.178.17.96.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe
| MD5 | 8300c91b40229b42301aebc6d8859907 |
| SHA1 | 0b55e56a6add6b4dd4ceff475a0018a203d02a5a |
| SHA256 | f54a6814ac06c70ef5b738eca4855e49039783d96b70ba1ae461bd90877e53b5 |
| SHA512 | 0863750da143e1707513f4a2efe1ad6cf81f5a819c7d5496d1629745afffcf72338aa9de90479d5e0936e848f9b260c434fd369027c56be175814086cafd4d8f |
C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.dat
| MD5 | db47b3f375db127ab32c38236294524f |
| SHA1 | 3f647b0a0e80bf98be0a68a4e5ee3bbbc3288632 |
| SHA256 | f40a213f5236b2d76d2f0c03ca2a1ac18a00f210e64792e4de7ae563c3d002c3 |
| SHA512 | eeb31c9472c709da9df5a292264c3c61873f8d831d0559359819326d898c38c38d88c2fbe9aacb33b09cc5d5c460f8766699b0bdb9eb6b353cbc8420117dc997 |
C:\Users\Admin\AppData\Local\Temp\00294823\ioejhbbloegdmkljhkeadkglapijgklc\sqlite.js
| MD5 | e71cd2cdc37a7d0897a7fa3f505f319e |
| SHA1 | 4481fd87b6ca7d15b15d7e08862585fbbbef528e |
| SHA256 | 8b0277f2c65a357006c741812a988554989b62d64df60103d74f8283829ed2af |
| SHA512 | 5cbedceee5d8c70caa81aed31644433124760c6b43ea565bd372a79e95d8d194b291cb78758da5ae385548c0b151f8400756fab028d6affc5b30b0ed814354ff |
C:\Users\Admin\AppData\Local\Temp\00294823\ioejhbbloegdmkljhkeadkglapijgklc\lsdb.js
| MD5 | 209b7ae0b6d8c3f9687c979d03b08089 |
| SHA1 | 6449f8bff917115eef4e7488fae61942a869200f |
| SHA256 | e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704 |
| SHA512 | 1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25 |
C:\Users\Admin\AppData\Local\Temp\00294823\ioejhbbloegdmkljhkeadkglapijgklc\Pky4Sm.js
| MD5 | caa80d49e977878a43ad08a10e39814a |
| SHA1 | 64b62e8b529bc3012305cb7436c575143a4f0448 |
| SHA256 | aa77efa87427ea25dbd083e56e79420381e0cf814d12cbd0208480cbbb7dc44d |
| SHA512 | ec60954d9402ce140bd101ccb817fdc0f2a3f90ad2cd4c5b30dd1c9c5611c8cfae6c9e109678b1d7624704b996fa5445f236f1608a4b8c244643c3df63ea4d1f |
C:\Users\Admin\AppData\Local\Temp\00294823\ioejhbbloegdmkljhkeadkglapijgklc\manifest.json
| MD5 | 31084dff5cb37bc3cbbe4ddeacc8f7f1 |
| SHA1 | f2fb1ee7152c398900132ca50df903029823c477 |
| SHA256 | 39edb1085519fe935c00733c6770037fd84b8da0f4ec46406163c8459325c515 |
| SHA512 | 61b3cda7684524eceff0ee7a9e0a7df6dd51da61a78322619e2bbaa686437d56cfaa650269a6cbc3cd1de3e34f302baa6ae7e38d1cf25239aae7038bf53e186d |
C:\Users\Admin\AppData\Local\Temp\00294823\ioejhbbloegdmkljhkeadkglapijgklc\content.js
| MD5 | 5f9891607f65f433b0690bae7088b2c1 |
| SHA1 | b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de |
| SHA256 | fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b |
| SHA512 | 76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c |
C:\Users\Admin\AppData\Local\Temp\00294823\ioejhbbloegdmkljhkeadkglapijgklc\background.html
| MD5 | c1a9f2ef1f0b8d61aa775a82322c88a7 |
| SHA1 | 6b51be0cb87cf0b797a8578ee260de89f94f1cc4 |
| SHA256 | 4be01deb1871aa1cf615f89e81a8d7a3495284af4b3b27d8b46ad5a6f2dccd2c |
| SHA512 | 6e93e2266b5fbeb86e844953171f1c097cf8a3a8207833cb5b156066f6ae26fdab71b9968164c8d20a67985dadc1c0d5e14c565d89413c20a7c24a52da18faea |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dtar83su.Admin\extensions\staged\[email protected]\install.rdf
| MD5 | 6600e9fd5a4d577495e3b245f0277255 |
| SHA1 | dd4ee36811800e0c610708043caa6aeb4288d089 |
| SHA256 | 262e3d642e9e5afb3d700f52dfa174d7efc25d6578efc4709b67da5369fedb1e |
| SHA512 | d0286e7e40deb028d1c837ec16b2afe1140fb487fe9a632c48a8748e00609ecc0474b9736f299a0e455c4e502e8d133f78e8390fcf9f63190676c774df2dd6fb |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dtar83su.Admin\extensions\staged\[email protected]\bootstrap.js
| MD5 | 1b53c596cfb1aa2209446ff64c17dabd |
| SHA1 | 2542da14728dcdbe1763f1ee39fe9ceae38ad414 |
| SHA256 | a7dfea4bf7e1d46a8b8e64ccfb2cf35017e3a5b350eead26d6671254d2b3c46f |
| SHA512 | be54481675c38ef6a41697cf8cd3ab5a0b126922b192732a9c587dd8905b74b66c79eb0c849f62bbe8934979a894be63734b0ad59ffae295f5797cbfaa327030 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g5azq69j.default-release\extensions\staged\[email protected]\content\bg.js
| MD5 | ec1c4ac8ed1ff32e6ce6012d81cbf714 |
| SHA1 | e793a39eedbce0c8af7f54af814f4b358a996419 |
| SHA256 | 6f5c2ae7610dc0455ef651e8730491d4c93c2e9b839abd5f3b21abb73f2b5eec |
| SHA512 | 5ce1bf98138516f21fff09c9b6020136e2f72c3410c7e63f9952a931732978cf3924553c544d8f71d1ce594944d9d4dc32bc6f923214bc3749bed76dff8382c6 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dtar83su.Admin\extensions\staged\[email protected]\chrome.manifest
| MD5 | 7f067990fd33cb046a2bf0a1d4c99bd8 |
| SHA1 | 2e4750dd26bf1234d53adf75ad391b4128cce751 |
| SHA256 | a0c96ba1eec1259667813b862754174442f4e03502563e7188b2765d8924365c |
| SHA512 | a09786be891cb5c92e94b10cb8dd7ec254a44f180b9b042970730abad880faf1ca57647b7d424340a7c4713027e03f9684ead35e0e676208454bb49d3511e2a2 |
C:\ProgramData\DoiWnlooad keeper\QUr4L.dll
| MD5 | e9b27306a18f18b88945cdf066de2fc9 |
| SHA1 | 4d18490fbb336e261301a967047065dd561cc2f2 |
| SHA256 | a9880b90d24af3786886306aefe5c79ff3cb2fb7b36ee5fb7bf2af85f240d63c |
| SHA512 | f255e8bfb13cfa070b31f47b12a4aacf9ab75a6a8191b6b83740d02c3f007b6d5255a5c2c12bc7b599996742973d2faccb5463d96d16c7aba40e34776823c706 |
C:\Users\Admin\AppData\Local\Temp\00294823\QUr4L.tlb
| MD5 | 39d776f73d1d3f771aaa8c3561367c3a |
| SHA1 | eef842aa02927bd7fbe7d569c5446ef1a2ea065f |
| SHA256 | c2156787eeb818e587529572599fa124773c71330fb93e1c79f4cb9141090941 |
| SHA512 | 3174095accbf422730e60f61523dec01a9a4519cb4642a641c5f547d530ad41f5386d383b90f7daf34f1f36635775929e99d7fe0030aa24cee30f4de8376eeb3 |