34d6031fa8405293fe209acef4dc6e0e92c2f708dbc9feef1a9d84e1705962ec

General

Target

de736bf66966bd4a64e50ec94afe686e.dll
Size

236KB
MD5

de736bf66966bd4a64e50ec94afe686e
SHA1

cd56df652c8aef80ce5c5c4ea951019478571bf1
SHA256

34d6031fa8405293fe209acef4dc6e0e92c2f708dbc9feef1a9d84e1705962ec
SHA512

aaf25022ec578f7985c00e056121bc47a87456748dad03e2cb97a536cf21170dba4ce0ce1c8546f87bbd776c6ea854b675ab1fc4b2a4072856b5ef2ab41176be
SSDEEP

3072:ART+V0SFseNgnBRVP05ksNPw6TrsAkZ9oJcJadaPgZAk1NVvtRATk:Ad+VdFse6RVPEkMwMTcMbZAk1NtGk

Score

7^/10

adware persistence stealer

Malware Config

Signatures

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\WOW6432Node\CLSID\{975670D0-7EFB-4fa8-90FA-3AE575B9FB77}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\WOW6432Node\CLSID\{975670D0-7EFB-4fa8-90FA-3AE575B9FB77}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\de736bf66966bd4a64e50ec94afe686e.dll"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\WOW6432Node\CLSID\{975670D0-7EFB-4fa8-90FA-3AE575B9FB77}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe

Installs/modifies Browser Helper Object 2 TTPs 5 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{975670D0-7EFB-4fa8-90FA-3AE575B9FB77}\NoExplorer = "1"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{975670D0-7EFB-4fa8-90FA-3AE575B9FB77}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{975670D0-7EFB-4fa8-90FA-3AE575B9FB77}	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{975670D0-7EFB-4fa8-90FA-3AE575B9FB77}\ = "Adobe PDF Reader Link Helper"	regsvr32.exe

Modifies registry class 23 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\linkrdr.AIEbho.1\ = "Adobe PDF Reader Link Helper"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\linkrdr.AIEbho\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\linkrdr.AIEbho\CLSID\ = "{975670D0-7EFB-4fa8-90FA-3AE575B9FB77}"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\linkrdr.AIEbho.1\CLSID\ = "{975670D0-7EFB-4fa8-90FA-3AE575B9FB77}"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\WOW6432Node\CLSID\{975670D0-7EFB-4fa8-90FA-3AE575B9FB77}\AppID = "{74DB2CD7-094B-4d60-9656-ADC2F8830D29}"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\WOW6432Node\CLSID\{975670D0-7EFB-4fa8-90FA-3AE575B9FB77}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\de736bf66966bd4a64e50ec94afe686e.dll"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\WOW6432Node\CLSID\{975670D0-7EFB-4fa8-90FA-3AE575B9FB77}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\linkrdr.AIEbho\ = "Adobe PDF Reader Link Helper"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\WOW6432Node\CLSID\{975670D0-7EFB-4fa8-90FA-3AE575B9FB77}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\WOW6432Node\CLSID\{975670D0-7EFB-4fa8-90FA-3AE575B9FB77}\VersionIndependentProgID\ = "linkrdr.AIEbho"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\WOW6432Node\CLSID\{975670D0-7EFB-4fa8-90FA-3AE575B9FB77}\ProgID\ = "linkrdr.AIEbho.1"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\linkrdr.AIEbho.1	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\linkrdr.AIEbho\CurVer	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\WOW6432Node\CLSID\{975670D0-7EFB-4fa8-90FA-3AE575B9FB77}	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\WOW6432Node\CLSID\{975670D0-7EFB-4fa8-90FA-3AE575B9FB77}\ = "Adobe PDF Reader Link Helper"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\WOW6432Node\CLSID\{975670D0-7EFB-4fa8-90FA-3AE575B9FB77}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\linkrdr.AIEbho	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\linkrdr.AIEbho\CurVer\ = "linkrdr.AIEbho.1"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\WOW6432Node\CLSID\{975670D0-7EFB-4fa8-90FA-3AE575B9FB77}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\WOW6432Node\CLSID\{975670D0-7EFB-4fa8-90FA-3AE575B9FB77}\TypeLib\ = "{2B63B21A-4075-4298-A569-D8113F1D7045}"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\linkrdr.AIEbho.1\CLSID	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\WOW6432Node\CLSID\{975670D0-7EFB-4fa8-90FA-3AE575B9FB77}\ProgID	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\WOW6432Node\CLSID\{975670D0-7EFB-4fa8-90FA-3AE575B9FB77}\InprocServer32	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3628 wrote to memory of 5048	3628	regsvr32.exe	87
PID 3628 wrote to memory of 5048	3628	regsvr32.exe	87
PID 3628 wrote to memory of 5048	3628	regsvr32.exe	87

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\de736bf66966bd4a64e50ec94afe686e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\de736bf66966bd4a64e50ec94afe686e.dll
  2⤵
  - Registers COM server for autorun
  - Installs/modifies Browser Helper Object
  - Modifies registry class
  PID:5048