Overview
overview
7Static
static
3dc02961c31...0d.exe
windows7-x64
7dc02961c31...0d.exe
windows10-2004-x64
7$PLUGINSDIR/Math.dll
windows7-x64
3$PLUGINSDIR/Math.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$R1.dll
windows7-x64
6$R1.dll
windows10-2004-x64
6Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
21-03-2024 15:49
Static task
static1
Behavioral task
behavioral1
Sample
dc02961c3109e7369f377da2913ba80d.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
dc02961c3109e7369f377da2913ba80d.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/Math.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/Math.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
$R1.dll
Resource
win7-20240319-en
General
-
Target
$R1.dll
-
Size
1.2MB
-
MD5
104be7b21b09b5863ea03eb7c6c1298a
-
SHA1
f87600bca12beef0396f19650f34587c2c80cdee
-
SHA256
afe8c52bf5d96ad9b890477e1608e2f56f332a4e7bae449f68f6d47e4592b54b
-
SHA512
339beaba14c9ee8b7277eba97d1d1af1ebb50bf59be4c3dc0f0aa02655c2ea0661738007b4c21642fb76b8c61edf6599208d4cc53b15b6a21eec6656f55eb5a1
-
SSDEEP
24576:km1RvurA+BUOEbCdvB1Nb/StgBq/Nzd3nBkcTZT:SBTE/t5nBkcTF
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e2bbf3f5-c6c0-6876-ffd6-4732c5250dbf} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e2bbf3f5-c6c0-6876-ffd6-4732c5250dbf}\NoExplorer = "\"\"" regsvr32.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e2bbf3f5-c6c0-6876-ffd6-4732c5250dbf} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e2bbf3f5-c6c0-6876-ffd6-4732c5250dbf}\ = "adtimes" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e2bbf3f5-c6c0-6876-ffd6-4732c5250dbf}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e2bbf3f5-c6c0-6876-ffd6-4732c5250dbf}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$R1.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e2bbf3f5-c6c0-6876-ffd6-4732c5250dbf}\InProcServer32\ThreadingModel = "Apartment" regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2720 wrote to memory of 312 2720 regsvr32.exe 90 PID 2720 wrote to memory of 312 2720 regsvr32.exe 90 PID 2720 wrote to memory of 312 2720 regsvr32.exe 90
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\$R1.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\$R1.dll2⤵
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:312
-