155f8a2dc27a48902040150b784987d235d004a3df621e769fdf9f054212d0d2

Analysis

max time kernel
138s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/03/2024, 02:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dd0687aae5dbb44562cd0646c8090a17.exe
Size 72KB
Sample240325-c195psdg88
SHA256 155f8a2dc27a48902040150b784987d235d004a3df621e769fdf9f054212d0d2
MD5 dd0687aae5dbb44562cd0646c8090a17
SHA1 08f0657741257f8f5452aa93a027b74afac29a66
SHA512 478403c788bb81632c65050214dd6a2937206c5d30a78454ea733882708e4533cb7765395ab4ff3e3e53d0d425436df98d15f07c30f49882c8fae60d599a1d66
SSDEEP 1536:o5YvbQqAXcuSJv5RK2DowuGzT7hGU+yVFgOHAKXF8/P:MILAMZvTv+GLUUHVFXgKXFi
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware stealer

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
5080	rundll32.exe

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1F6581D5-AA53-4b73-A6F9-41420C6B61F1}	rundll32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dd0687aae5dbb44562cd0646c8090a17.dll	dd0687aae5dbb44562cd0646c8090a17.exe

Modifies registry class 4 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1F6581D5-AA53-4b73-A6F9-41420C6B61F1}\InprocServer32\ThreadingModel = "Both"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1F6581D5-AA53-4b73-A6F9-41420C6B61F1}	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1F6581D5-AA53-4b73-A6F9-41420C6B61F1}\InprocServer32	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1F6581D5-AA53-4b73-A6F9-41420C6B61F1}\InprocServer32\ = "C:\\Windows\\SysWow64\\dd0687aae5dbb44562cd0646c8090a17.dll"	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 5080	1700	dd0687aae5dbb44562cd0646c8090a17.exe	90
PID 1700 wrote to memory of 5080	1700	dd0687aae5dbb44562cd0646c8090a17.exe	90
PID 1700 wrote to memory of 5080	1700	dd0687aae5dbb44562cd0646c8090a17.exe	90

C:\Users\Admin\AppData\Local\Temp\dd0687aae5dbb44562cd0646c8090a17.exe
"C:\Users\Admin\AppData\Local\Temp\dd0687aae5dbb44562cd0646c8090a17.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Windows\system32\dd0687aae5dbb44562cd0646c8090a17.dll",inject
  2⤵
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - Modifies registry class
  PID:5080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dd0687aae5dbb44562cd0646c8090a17.dll

Path C:\Windows\SysWOW64\dd0687aae5dbb44562cd0646c8090a17.dll
Size 58KB
SHA256 53c7e8c2a7371bcb1f26d7743a7c01f35478e963b03c455970a84306fc42afc8
MD5 d0424edb5ccb0c2b1b18c2778bdf9719
SHA1 dd9ef16846b6b16846412e58a31db4f559d17274
SHA512 6be1772e390c49c3420b1aa223ec5bcbb3c832dabbf8f96d6e10779d8f4e3ec134d267010cd1d53bdb9ae373f5ce8fce1ecf35f64f7b5f17378d257fe8404976
SSDEEP 1536:oMlDWjUGvFvqD4jp9LyvuMs2N0YPlgUTnCSba:NWjJID4iPl1Cwa
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1700-0-0x0000000000400000-0x0000000000429CC9-memory.dmp

Download

memory/1700-2-0x0000000000400000-0x0000000000429CC9-memory.dmp

Download

memory/5080-5-0x0000000010000000-0x0000000010032000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads