Malware Analysis Report

2025-08-05 16:44

Sample ID 240204-yhxybabedm
Target 9000b78b0179d9d66d117afed1e45f18
SHA256 2321f245a5e01b903075619bcca1aebfc554a9237924ad6c5120370f287e0d5a
Tags
adware discovery spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

2321f245a5e01b903075619bcca1aebfc554a9237924ad6c5120370f287e0d5a

Threat Level: Shows suspicious behavior

The file 9000b78b0179d9d66d117afed1e45f18 was found to be: Shows suspicious behavior.

Malicious Activity Summary

adware discovery spyware stealer

Loads dropped DLL

Reads user/profile data of web browsers

Executes dropped EXE

Checks installed software on the system

Drops Chrome extension

Installs/modifies Browser Helper Object

Unsigned PE

Modifies Internet Explorer settings

Suspicious use of WriteProcessMemory

System policy modification

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-02-04 19:47

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-04 19:47

Reported

2024-02-04 19:50

Platform

win7-20231215-en

Max time kernel

122s

Max time network

130s

Command Line

"C:\Users\Admin\AppData\Local\Temp\9000b78b0179d9d66d117afed1e45f18.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A

Reads user/profile data of web browsers

spyware stealer

Checks installed software on the system

discovery

Drops Chrome extension

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ioejhbbloegdmkljhkeadkglapijgklc\1.6\manifest.json C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A

Installs/modifies Browser Helper Object

stealer adware
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF} C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\ = "DoiWnlooad keeper" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\NoExplorer = "1" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF} C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF} C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key deleted \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF} C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key deleted \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\keeoper.1.6\CLSID\ = "{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\ProgID C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0 C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\DoiWnlooad keeper" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Download C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\keeoper.Download C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\keeoper\CLSID C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\ProgID C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF} C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0 C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32 C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32 C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\InprocServer32\ = "C:\\ProgramData\\DoiWnlooad keeper\\QUr4L.dll" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\keeoper\CLSID\ = "{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\keeoper\CurVer\ = "Download keeoper.1.6" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F} C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\VersionIndependentProgID\ = "Download keeoper" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F} C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\keeoper.1.6\ = "DoiWnlooad keeper" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\ProgID\ = "Download keeoper.1.6" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\VersionIndependentProgID C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\DoiWnlooad keeper\\QUr4L.tlb" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\keeoper C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\keeoper\ = "DoiWnlooad keeper" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\keeoper\CurVer C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\ = "DoiWnlooad keeper" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\InprocServer32 C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755} C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32 C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\Programmable C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32 C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\VersionIndependentProgID C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\InprocServer32 C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32 C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\keeoper.1.6 C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF} C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\keeoper.1.6\CLSID C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\InprocServer32\ThreadingModel = "Apartment" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\Programmable C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F} C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A

System policy modification

evasion
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF} = "1" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\9000b78b0179d9d66d117afed1e45f18.exe

"C:\Users\Admin\AppData\Local\Temp\9000b78b0179d9d66d117afed1e45f18.exe"

C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe

"C:\Users\Admin\AppData\Local\Temp/00294823/NEOEM0.exe"

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe

MD5 8300c91b40229b42301aebc6d8859907
SHA1 0b55e56a6add6b4dd4ceff475a0018a203d02a5a
SHA256 f54a6814ac06c70ef5b738eca4855e49039783d96b70ba1ae461bd90877e53b5
SHA512 0863750da143e1707513f4a2efe1ad6cf81f5a819c7d5496d1629745afffcf72338aa9de90479d5e0936e848f9b260c434fd369027c56be175814086cafd4d8f

C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.dat

MD5 db47b3f375db127ab32c38236294524f
SHA1 3f647b0a0e80bf98be0a68a4e5ee3bbbc3288632
SHA256 f40a213f5236b2d76d2f0c03ca2a1ac18a00f210e64792e4de7ae563c3d002c3
SHA512 eeb31c9472c709da9df5a292264c3c61873f8d831d0559359819326d898c38c38d88c2fbe9aacb33b09cc5d5c460f8766699b0bdb9eb6b353cbc8420117dc997

C:\Users\Admin\AppData\Local\Temp\00294823\ioejhbbloegdmkljhkeadkglapijgklc\background.html

MD5 c1a9f2ef1f0b8d61aa775a82322c88a7
SHA1 6b51be0cb87cf0b797a8578ee260de89f94f1cc4
SHA256 4be01deb1871aa1cf615f89e81a8d7a3495284af4b3b27d8b46ad5a6f2dccd2c
SHA512 6e93e2266b5fbeb86e844953171f1c097cf8a3a8207833cb5b156066f6ae26fdab71b9968164c8d20a67985dadc1c0d5e14c565d89413c20a7c24a52da18faea

C:\Users\Admin\AppData\Local\Temp\00294823\ioejhbbloegdmkljhkeadkglapijgklc\content.js

MD5 5f9891607f65f433b0690bae7088b2c1
SHA1 b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de
SHA256 fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b
SHA512 76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c

C:\Users\Admin\AppData\Local\Temp\00294823\ioejhbbloegdmkljhkeadkglapijgklc\lsdb.js

MD5 209b7ae0b6d8c3f9687c979d03b08089
SHA1 6449f8bff917115eef4e7488fae61942a869200f
SHA256 e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704
SHA512 1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25

C:\Users\Admin\AppData\Local\Temp\00294823\ioejhbbloegdmkljhkeadkglapijgklc\manifest.json

MD5 31084dff5cb37bc3cbbe4ddeacc8f7f1
SHA1 f2fb1ee7152c398900132ca50df903029823c477
SHA256 39edb1085519fe935c00733c6770037fd84b8da0f4ec46406163c8459325c515
SHA512 61b3cda7684524eceff0ee7a9e0a7df6dd51da61a78322619e2bbaa686437d56cfaa650269a6cbc3cd1de3e34f302baa6ae7e38d1cf25239aae7038bf53e186d

C:\Users\Admin\AppData\Local\Temp\00294823\ioejhbbloegdmkljhkeadkglapijgklc\Pky4Sm.js

MD5 caa80d49e977878a43ad08a10e39814a
SHA1 64b62e8b529bc3012305cb7436c575143a4f0448
SHA256 aa77efa87427ea25dbd083e56e79420381e0cf814d12cbd0208480cbbb7dc44d
SHA512 ec60954d9402ce140bd101ccb817fdc0f2a3f90ad2cd4c5b30dd1c9c5611c8cfae6c9e109678b1d7624704b996fa5445f236f1608a4b8c244643c3df63ea4d1f

C:\Users\Admin\AppData\Local\Temp\00294823\ioejhbbloegdmkljhkeadkglapijgklc\sqlite.js

MD5 e71cd2cdc37a7d0897a7fa3f505f319e
SHA1 4481fd87b6ca7d15b15d7e08862585fbbbef528e
SHA256 8b0277f2c65a357006c741812a988554989b62d64df60103d74f8283829ed2af
SHA512 5cbedceee5d8c70caa81aed31644433124760c6b43ea565bd372a79e95d8d194b291cb78758da5ae385548c0b151f8400756fab028d6affc5b30b0ed814354ff

C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\chrome.manifest

MD5 7f067990fd33cb046a2bf0a1d4c99bd8
SHA1 2e4750dd26bf1234d53adf75ad391b4128cce751
SHA256 a0c96ba1eec1259667813b862754174442f4e03502563e7188b2765d8924365c
SHA512 a09786be891cb5c92e94b10cb8dd7ec254a44f180b9b042970730abad880faf1ca57647b7d424340a7c4713027e03f9684ead35e0e676208454bb49d3511e2a2

C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\bootstrap.js

MD5 1b53c596cfb1aa2209446ff64c17dabd
SHA1 2542da14728dcdbe1763f1ee39fe9ceae38ad414
SHA256 a7dfea4bf7e1d46a8b8e64ccfb2cf35017e3a5b350eead26d6671254d2b3c46f
SHA512 be54481675c38ef6a41697cf8cd3ab5a0b126922b192732a9c587dd8905b74b66c79eb0c849f62bbe8934979a894be63734b0ad59ffae295f5797cbfaa327030

C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\content\bg.js

MD5 ec1c4ac8ed1ff32e6ce6012d81cbf714
SHA1 e793a39eedbce0c8af7f54af814f4b358a996419
SHA256 6f5c2ae7610dc0455ef651e8730491d4c93c2e9b839abd5f3b21abb73f2b5eec
SHA512 5ce1bf98138516f21fff09c9b6020136e2f72c3410c7e63f9952a931732978cf3924553c544d8f71d1ce594944d9d4dc32bc6f923214bc3749bed76dff8382c6

C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\install.rdf

MD5 6600e9fd5a4d577495e3b245f0277255
SHA1 dd4ee36811800e0c610708043caa6aeb4288d089
SHA256 262e3d642e9e5afb3d700f52dfa174d7efc25d6578efc4709b67da5369fedb1e
SHA512 d0286e7e40deb028d1c837ec16b2afe1140fb487fe9a632c48a8748e00609ecc0474b9736f299a0e455c4e502e8d133f78e8390fcf9f63190676c774df2dd6fb

C:\Users\Admin\AppData\Local\Temp\00294823\QUr4L.dll

MD5 e9b27306a18f18b88945cdf066de2fc9
SHA1 4d18490fbb336e261301a967047065dd561cc2f2
SHA256 a9880b90d24af3786886306aefe5c79ff3cb2fb7b36ee5fb7bf2af85f240d63c
SHA512 f255e8bfb13cfa070b31f47b12a4aacf9ab75a6a8191b6b83740d02c3f007b6d5255a5c2c12bc7b599996742973d2faccb5463d96d16c7aba40e34776823c706

C:\Users\Admin\AppData\Local\Temp\00294823\QUr4L.tlb

MD5 39d776f73d1d3f771aaa8c3561367c3a
SHA1 eef842aa02927bd7fbe7d569c5446ef1a2ea065f
SHA256 c2156787eeb818e587529572599fa124773c71330fb93e1c79f4cb9141090941
SHA512 3174095accbf422730e60f61523dec01a9a4519cb4642a641c5f547d530ad41f5386d383b90f7daf34f1f36635775929e99d7fe0030aa24cee30f4de8376eeb3

Analysis: behavioral2

Detonation Overview

Submitted

2024-02-04 19:47

Reported

2024-02-04 19:50

Platform

win10v2004-20231215-en

Max time kernel

93s

Max time network

116s

Command Line

"C:\Users\Admin\AppData\Local\Temp\9000b78b0179d9d66d117afed1e45f18.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A

Reads user/profile data of web browsers

spyware stealer

Checks installed software on the system

discovery

Drops Chrome extension

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ioejhbbloegdmkljhkeadkglapijgklc\1.6\manifest.json C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A

Installs/modifies Browser Helper Object

stealer adware
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\ = "DoiWnlooad keeper" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\NoExplorer = "1" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF} C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF} C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF} C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key deleted \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVEDEXTENSIONSMIGRATION\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF} C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key deleted \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\ProgID\ = "Download keeoper.1.6" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\keeoper\CLSID C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\ = "DoiWnlooad keeper" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\VersionIndependentProgID C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\DoiWnlooad keeper\\QUr4L.tlb" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F} C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32 C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\InprocServer32\ = "C:\\ProgramData\\DoiWnlooad keeper\\QUr4L.dll" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\InprocServer32\ThreadingModel = "Apartment" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0 C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\DoiWnlooad keeper" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Download C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755} C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\ProgID C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32 C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32 C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\keeoper.1.6 C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32 C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\keeoper\CurVer C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\VersionIndependentProgID C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF} C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F} C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\VersionIndependentProgID\ = "Download keeoper" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\keeoper.1.6\CLSID C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\keeoper C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F} C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\keeoper\CLSID\ = "{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\Programmable C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\InprocServer32 C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F} C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF} C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0 C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\Programmable C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\keeoper.1.6\CLSID\ = "{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\ProgID C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32 C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\keeoper.Download C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\keeoper.1.6\ = "DoiWnlooad keeper" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF}\InprocServer32 C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\keeoper\ = "DoiWnlooad keeper" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A

System policy modification

evasion
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{EE1A9F67-D170-6CD2-9DD4-25D4BE97A8EF} = "1" C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\9000b78b0179d9d66d117afed1e45f18.exe

"C:\Users\Admin\AppData\Local\Temp\9000b78b0179d9d66d117afed1e45f18.exe"

C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe

"C:\Users\Admin\AppData\Local\Temp/00294823/NEOEM0.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 203.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 16.234.44.23.in-addr.arpa udp
US 8.8.8.8:53 81.171.91.138.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 140.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 172.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 207.178.17.96.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe

MD5 8300c91b40229b42301aebc6d8859907
SHA1 0b55e56a6add6b4dd4ceff475a0018a203d02a5a
SHA256 f54a6814ac06c70ef5b738eca4855e49039783d96b70ba1ae461bd90877e53b5
SHA512 0863750da143e1707513f4a2efe1ad6cf81f5a819c7d5496d1629745afffcf72338aa9de90479d5e0936e848f9b260c434fd369027c56be175814086cafd4d8f

C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.dat

MD5 db47b3f375db127ab32c38236294524f
SHA1 3f647b0a0e80bf98be0a68a4e5ee3bbbc3288632
SHA256 f40a213f5236b2d76d2f0c03ca2a1ac18a00f210e64792e4de7ae563c3d002c3
SHA512 eeb31c9472c709da9df5a292264c3c61873f8d831d0559359819326d898c38c38d88c2fbe9aacb33b09cc5d5c460f8766699b0bdb9eb6b353cbc8420117dc997

C:\Users\Admin\AppData\Local\Temp\00294823\ioejhbbloegdmkljhkeadkglapijgklc\sqlite.js

MD5 e71cd2cdc37a7d0897a7fa3f505f319e
SHA1 4481fd87b6ca7d15b15d7e08862585fbbbef528e
SHA256 8b0277f2c65a357006c741812a988554989b62d64df60103d74f8283829ed2af
SHA512 5cbedceee5d8c70caa81aed31644433124760c6b43ea565bd372a79e95d8d194b291cb78758da5ae385548c0b151f8400756fab028d6affc5b30b0ed814354ff

C:\Users\Admin\AppData\Local\Temp\00294823\ioejhbbloegdmkljhkeadkglapijgklc\lsdb.js

MD5 209b7ae0b6d8c3f9687c979d03b08089
SHA1 6449f8bff917115eef4e7488fae61942a869200f
SHA256 e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704
SHA512 1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25

C:\Users\Admin\AppData\Local\Temp\00294823\ioejhbbloegdmkljhkeadkglapijgklc\Pky4Sm.js

MD5 caa80d49e977878a43ad08a10e39814a
SHA1 64b62e8b529bc3012305cb7436c575143a4f0448
SHA256 aa77efa87427ea25dbd083e56e79420381e0cf814d12cbd0208480cbbb7dc44d
SHA512 ec60954d9402ce140bd101ccb817fdc0f2a3f90ad2cd4c5b30dd1c9c5611c8cfae6c9e109678b1d7624704b996fa5445f236f1608a4b8c244643c3df63ea4d1f

C:\Users\Admin\AppData\Local\Temp\00294823\ioejhbbloegdmkljhkeadkglapijgklc\manifest.json

MD5 31084dff5cb37bc3cbbe4ddeacc8f7f1
SHA1 f2fb1ee7152c398900132ca50df903029823c477
SHA256 39edb1085519fe935c00733c6770037fd84b8da0f4ec46406163c8459325c515
SHA512 61b3cda7684524eceff0ee7a9e0a7df6dd51da61a78322619e2bbaa686437d56cfaa650269a6cbc3cd1de3e34f302baa6ae7e38d1cf25239aae7038bf53e186d

C:\Users\Admin\AppData\Local\Temp\00294823\ioejhbbloegdmkljhkeadkglapijgklc\content.js

MD5 5f9891607f65f433b0690bae7088b2c1
SHA1 b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de
SHA256 fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b
SHA512 76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c

C:\Users\Admin\AppData\Local\Temp\00294823\ioejhbbloegdmkljhkeadkglapijgklc\background.html

MD5 c1a9f2ef1f0b8d61aa775a82322c88a7
SHA1 6b51be0cb87cf0b797a8578ee260de89f94f1cc4
SHA256 4be01deb1871aa1cf615f89e81a8d7a3495284af4b3b27d8b46ad5a6f2dccd2c
SHA512 6e93e2266b5fbeb86e844953171f1c097cf8a3a8207833cb5b156066f6ae26fdab71b9968164c8d20a67985dadc1c0d5e14c565d89413c20a7c24a52da18faea

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dtar83su.Admin\extensions\staged\[email protected]\install.rdf

MD5 6600e9fd5a4d577495e3b245f0277255
SHA1 dd4ee36811800e0c610708043caa6aeb4288d089
SHA256 262e3d642e9e5afb3d700f52dfa174d7efc25d6578efc4709b67da5369fedb1e
SHA512 d0286e7e40deb028d1c837ec16b2afe1140fb487fe9a632c48a8748e00609ecc0474b9736f299a0e455c4e502e8d133f78e8390fcf9f63190676c774df2dd6fb

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dtar83su.Admin\extensions\staged\[email protected]\bootstrap.js

MD5 1b53c596cfb1aa2209446ff64c17dabd
SHA1 2542da14728dcdbe1763f1ee39fe9ceae38ad414
SHA256 a7dfea4bf7e1d46a8b8e64ccfb2cf35017e3a5b350eead26d6671254d2b3c46f
SHA512 be54481675c38ef6a41697cf8cd3ab5a0b126922b192732a9c587dd8905b74b66c79eb0c849f62bbe8934979a894be63734b0ad59ffae295f5797cbfaa327030

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g5azq69j.default-release\extensions\staged\[email protected]\content\bg.js

MD5 ec1c4ac8ed1ff32e6ce6012d81cbf714
SHA1 e793a39eedbce0c8af7f54af814f4b358a996419
SHA256 6f5c2ae7610dc0455ef651e8730491d4c93c2e9b839abd5f3b21abb73f2b5eec
SHA512 5ce1bf98138516f21fff09c9b6020136e2f72c3410c7e63f9952a931732978cf3924553c544d8f71d1ce594944d9d4dc32bc6f923214bc3749bed76dff8382c6

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dtar83su.Admin\extensions\staged\[email protected]\chrome.manifest

MD5 7f067990fd33cb046a2bf0a1d4c99bd8
SHA1 2e4750dd26bf1234d53adf75ad391b4128cce751
SHA256 a0c96ba1eec1259667813b862754174442f4e03502563e7188b2765d8924365c
SHA512 a09786be891cb5c92e94b10cb8dd7ec254a44f180b9b042970730abad880faf1ca57647b7d424340a7c4713027e03f9684ead35e0e676208454bb49d3511e2a2

C:\ProgramData\DoiWnlooad keeper\QUr4L.dll

MD5 e9b27306a18f18b88945cdf066de2fc9
SHA1 4d18490fbb336e261301a967047065dd561cc2f2
SHA256 a9880b90d24af3786886306aefe5c79ff3cb2fb7b36ee5fb7bf2af85f240d63c
SHA512 f255e8bfb13cfa070b31f47b12a4aacf9ab75a6a8191b6b83740d02c3f007b6d5255a5c2c12bc7b599996742973d2faccb5463d96d16c7aba40e34776823c706

C:\Users\Admin\AppData\Local\Temp\00294823\QUr4L.tlb

MD5 39d776f73d1d3f771aaa8c3561367c3a
SHA1 eef842aa02927bd7fbe7d569c5446ef1a2ea065f
SHA256 c2156787eeb818e587529572599fa124773c71330fb93e1c79f4cb9141090941
SHA512 3174095accbf422730e60f61523dec01a9a4519cb4642a641c5f547d530ad41f5386d383b90f7daf34f1f36635775929e99d7fe0030aa24cee30f4de8376eeb3