161ef3d1d2e02b2988b0d53e6848e408dde1531046feaf1b4d6f9abae5055c85

Analysis

max time kernel
156s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2024, 02:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e08646a753c47662c0e6a626562b7a85.dll
Size 360KB
Sample240327-cl65haab67
SHA256 161ef3d1d2e02b2988b0d53e6848e408dde1531046feaf1b4d6f9abae5055c85
MD5 e08646a753c47662c0e6a626562b7a85
SHA1 5fc7472a53b926515f595cfd1e184bc8c39836e9
SHA512 c7f36ab27e0cf04c2253ff08619f2d582b7e7f663df09d30c64bbeb32c9a7b7e9b109f05c6fc1645d3f5277a306373e5322204e3f709cbab6549f2472520f67e
SSDEEP 6144:8g7JtSN2ORoPuYDQiwC6DXeP5lmMAzez2nLeNoTdUJ30p8VH2sRkv:8svSN2nPRQiwjDXqoz3KoTI3dVCv
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

adware stealer

Malware Config

Signatures

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A78860C8-EE1A-46DF-A97F-E3E6D433E80B}	regsvr32.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A78860C8-EE1A-46DF-A97F-E3E6D433E80B}\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A78860C8-EE1A-46DF-A97F-E3E6D433E80B}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A78860C8-EE1A-46DF-A97F-E3E6D433E80B}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e08646a753c47662c0e6a626562b7a85.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A78860C8-EE1A-46DF-A97F-E3E6D433E80B}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A78860C8-EE1A-46DF-A97F-E3E6D433E80B}	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 1816	2168	regsvr32.exe	86
PID 2168 wrote to memory of 1816	2168	regsvr32.exe	86
PID 2168 wrote to memory of 1816	2168	regsvr32.exe	86

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e08646a753c47662c0e6a626562b7a85.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\e08646a753c47662c0e6a626562b7a85.dll
  2⤵
  - Installs/modifies Browser Helper Object
  - Modifies registry class
  PID:1816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1816-0-0x0000000000550000-0x00000000005AC000-memory.dmp

Download