de441cce874689044624c30a142efe5e5318db367577ab70797420e3b56b22dc

General

Target
9086fd2f5778d1e07100d46e7d6c6830.dll
Size 15KB
Sample240205-ag438seca9
SHA256 de441cce874689044624c30a142efe5e5318db367577ab70797420e3b56b22dc
MD5 9086fd2f5778d1e07100d46e7d6c6830
SHA1 aaf08c43d60eea0f0290e526d94e2f0eebe4eb8b
SHA512 6593d9670e9d0a1662f261aba288fede0b4241de36143bf7a12017fdd4f24faccd507c43bccda600ba1bbd8f503ea9f685b84e2032af4edff7aa551e4b1cf220
SSDEEP 384:4K0QmUQwS18PiEPlwFZ1IpjHRc8uswaQtApNk3ke:8UplhGsunyc3ke
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

adware persistence stealer

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\msindeo.dll = "{7ACB5731-5839-13AB-EABC-124791194525}"	rundll32.exe

Deletes itself 1 IoCs

pid	Process
2836	rundll32.exe

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7ACB5731-5839-13AB-EABC-124791194525}	rundll32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msindeo.dll	rundll32.exe

Modifies registry class 17 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7ACB5731-5839-13AB-EABC-124791194525}\InprocServer32\ = "C:\\Windows\\SysWow64\\msindeo.dll"	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7ACB5731-5839-13AB-EABC-124791194525}\gecs0002 = 8112031456ada06d4df66f28c66574fbda5b120d8b7ab9d847e583c25fefb6b4bb6f379f3c7943f1bf89	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7ACB5731-5839-13AB-EABC-124791194525}\grxa0002 = 8112031456ada06d4df66f28c66574fbda5b120d8b7ab9d847e583c25fefb6b4bb6f779fcc73b1e1bfb471	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7ACB5731-5839-13AB-EABC-124791194525}\dswz0001 = 8112031456ada0fdadf63f90fedd6c92a233cab583b2f32edfbf12eaef4017e38b2415bf8b8511	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7ACB5731-5839-13AB-EABC-124791194525}\htsc0002 = 8112031456ada06d4df66f28c66574fbda5b120d8b7ab9d847e583c25fefb6b4bb6f7f47241bb1e1bfb479	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7ACB5731-5839-13AB-EABC-124791194525}\grxa0001 = 8112031456ada0fdadf63f90fedd6c92a233cab583b2f32edfbf12eaef4037e38bc415bf8b8531	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7ACB5731-5839-13AB-EABC-124791194525}\dswz0002 = 8112031456ada06d4df66f28c66574fbda5b120d8b7ab9d847e583c25fefb6b4bb6f579fcc93b1e1bfb451	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7ACB5731-5839-13AB-EABC-124791194525}	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7ACB5731-5839-13AB-EABC-124791194525}\feal = 505f90f1c757da01	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7ACB5731-5839-13AB-EABC-124791194525}\ntdx0002 = 8112031456ada06d4df66f28c66574fbda5b120d8b7ab9d847e583c25fefb6b4bb6f77af6493b1e1bfb471	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7ACB5731-5839-13AB-EABC-124791194525}\ntdx0001 = 8112031456ada0fdadf63f90fedd6c92a233cab583b2f32edfbf12eaef4037d3232415bf8b8531	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7ACB5731-5839-13AB-EABC-124791194525}\InprocServer32	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7ACB5731-5839-13AB-EABC-124791194525}\InprocServer32\ThreadingModel = "Apartment"	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7ACB5731-5839-13AB-EABC-124791194525}\gecs0001 = 8112031456ada0fdadf63f90fedd6c92a233cab583b2f32edfbf12eaef4077e37bcae7af8bc0	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7ACB5731-5839-13AB-EABC-124791194525}\notify = 8112031456ada0fdadf63f90fedd6c92a233cab583b2f32edfbf12eaef4077d3bbcae7af8bc0	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7ACB5731-5839-13AB-EABC-124791194525}\htsc0001 = 8112031456ada0fdadf63f90fedd6c92a233cab583b2f32edfbf12eaef403f3b63ac15bf8b8539	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7ACB5731-5839-13AB-EABC-124791194525}\rtex0001 = 8112031456ada0652d3e3fb87e05fcf332c3cac5abecb1a07f4d82813d9005dc79	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 2836	4892	rundll32.exe	59
PID 4892 wrote to memory of 2836	4892	rundll32.exe	59
PID 4892 wrote to memory of 2836	4892	rundll32.exe	59

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9086fd2f5778d1e07100d46e7d6c6830.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9086fd2f5778d1e07100d46e7d6c6830.dll,#1
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Deletes itself
  - Installs/modifies Browser Helper Object
  - Drops file in System32 directory
  - Modifies registry class
  PID:2836