ddedc47ecd77027664b156df6ac097869b5334c352dac66b199174c8ceb61743

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2024, 03:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NateFinder.dll
Size 479KB
Sample240322-dwnxcaab2t
SHA256 418883ed4d4f640c763c73ee182a573bf9d6492026ff73c4de55a289aa0b8fc4
MD5 bab17fcd8d3f38166a1422cb32364d7f
SHA1 f2beed01515d0f574e912589f5f29c0a6d4c4886
SHA512 3085c8d7ad6a43422ec68c825698a425247ffa4d7f61c46d3d725d98c7fb314d24f7cc01e5ac7186416c4a852e3e147304ce9ffaf4e5b67ad3fc76a23d80bfd2
SSDEEP 6144:UkOX2bkv2JfaA00n7LAf9upYyK/OJBYvPR5nSki/ypgjWd6BuxgFYDlQ2bXkfKCh:7Ofv0CA00nnAlhtOjKOFM6uXkBBdGE
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

adware stealer

Malware Config

Signatures

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{47E25839-A01C-4997-95DD-E6CE941D4958}	regsvr32.exe

Modifies Internet Explorer settings 1 TTPs 10 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9531303E-7C46-4D34-98DA-026E8891B6E2}\AppPath = "C:\\Program Files (x86)\\NateFinder"	regsvr32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\ntefnd\WarnOnOpen = "0"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9531303E-7C46-4D34-98DA-026E8891B6E2}\AppName = "NateFinderApp.exe"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\ntefnd	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9531303E-7C46-4D34-98DA-026E8891B6E2}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9531303E-7C46-4D34-98DA-026E8891B6E2}	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9531303E-7C46-4D34-98DA-026E8891B6E2}\AppName = "NateFinderUpt.exe"	regsvr32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9531303E-7C46-4D34-98DA-026E8891B6E2}\Policy = "3"	regsvr32.exe

Modifies registry class 15 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{47E25839-A01C-4997-95DD-E6CE941D4958}\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{47E25839-A01C-4997-95DD-E6CE941D4958}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ntefnd\Source Filter	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ntefnd\URL Protocol	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ntefnd\shell\open\command\ = "C:\\Program Files (x86)\\NateFinder\\NateFinderUpt.exe"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ntefnd\shell\open\command	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{47E25839-A01C-4997-95DD-E6CE941D4958}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NateFinder.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{47E25839-A01C-4997-95DD-E6CE941D4958}\ = "NateFinder"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\ntefnd\EditFlags = "2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ntefnd\shell	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ntefnd\shell\open	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{47E25839-A01C-4997-95DD-E6CE941D4958}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{47E25839-A01C-4997-95DD-E6CE941D4958}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ntefnd	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ntefnd\ = "URL:ntefnd (NateFinder)"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 4292	2852	regsvr32.exe	88
PID 2852 wrote to memory of 4292	2852	regsvr32.exe	88
PID 2852 wrote to memory of 4292	2852	regsvr32.exe	88

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\NateFinder.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\NateFinder.dll
  2⤵
  - Installs/modifies Browser Helper Object
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:4292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads