16be22997addc7a32e4949fd5f2cc83de24c35ee4518e825366406150c26c021

Analysis

max time kernel
143s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 19:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
16be22997addc7a32e4949fd5f2cc83de24c35ee4518e825366406150c26c021.exe
Size 504KB
Sample240503-xqbvdadd2v
SHA256 16be22997addc7a32e4949fd5f2cc83de24c35ee4518e825366406150c26c021
MD5 595344f32f01ec9f40c803e7ee04cf4a
SHA1 9268db02ae083701df5dc6acaa8cd991f9d21f71
SHA512 271dadc615e052147ddc2d19f273919775b60651b36aa581e57be3e75fe523bc20086b75f5a00da088d27497cacad62197b3e9298d7c57c3ece3dbce5ece7894
SSDEEP 12288:tPmTkT0+nXTv1d5Jo/H4a6ZeUOHFVS9Qg:Vmo4IXhd81rS
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

adware stealer upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 9 IoCs

resource	yara_rule
behavioral2/memory/1312-0-0x0000000000400000-0x000000000049C000-memory.dmp	UPX
behavioral2/memory/1312-3-0x0000000000400000-0x000000000049C000-memory.dmp	UPX
behavioral2/memory/1312-4-0x0000000000400000-0x000000000049C000-memory.dmp	UPX
behavioral2/memory/1312-15-0x0000000000400000-0x000000000049C000-memory.dmp	UPX
behavioral2/files/0x000a000000022976-19.dat	UPX
behavioral2/memory/4088-21-0x0000000000400000-0x000000000049C000-memory.dmp	UPX
behavioral2/memory/4088-27-0x0000000000400000-0x000000000049C000-memory.dmp	UPX
behavioral2/memory/4088-33-0x0000000000400000-0x000000000049C000-memory.dmp	UPX
behavioral2/memory/4088-39-0x0000000000400000-0x000000000049C000-memory.dmp	UPX

Executes dropped EXE 3 IoCs

pid	Process
4088	Explorrer.exe
2228	Explorrer.exe
3032	Explorrer.exe

Loads dropped DLL 2 IoCs

pid	Process
3020	regsvr32.exe
3112	regsvr32.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1312-0-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral2/memory/1312-3-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral2/memory/1312-4-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral2/memory/1312-15-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral2/files/0x000a000000022976-19.dat	upx
behavioral2/memory/4088-21-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral2/memory/4088-27-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral2/memory/4088-33-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral2/memory/4088-39-0x0000000000400000-0x000000000049C000-memory.dmp	upx

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DE274C2C-2133-4B4B-93B3-8F21486DABC0}	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DE274C2C-2133-4B4B-93B3-8F21486DABC0}\NoExplorer = "1"	regsvr32.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1312 set thread context of 1732	1312	16be22997addc7a32e4949fd5f2cc83de24c35ee4518e825366406150c26c021.exe	88
PID 4088 set thread context of 2228	4088	Explorrer.exe	93
PID 4088 set thread context of 3032	4088	Explorrer.exe	94

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2920	2900	WerFault.exe	95

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2900	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\Approved Extensions\{3543619C-D563-43f7-95EA-4DA7E1CC396A} = 51667a6c4c1d3b1b003ad2d87fc9ac0780c431c2a3933e7f	Explorrer.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Software\Microsoft\Internet Explorer\Approved Extensions	Explorrer.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DE274C2C-2133-4B4B-93B3-8F21486DABC0}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DE274C2C-2133-4B4B-93B3-8F21486DABC0}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DE274C2C-2133-4B4B-93B3-8F21486DABC0}\ = "IE MANAGER"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DE274C2C-2133-4B4B-93B3-8F21486DABC0}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DE274C2C-2133-4B4B-93B3-8F21486DABC0}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\IE\\bho.dll"	regsvr32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1312	16be22997addc7a32e4949fd5f2cc83de24c35ee4518e825366406150c26c021.exe
1732	16be22997addc7a32e4949fd5f2cc83de24c35ee4518e825366406150c26c021.exe
4088	Explorrer.exe
2228	Explorrer.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 1732	1312	16be22997addc7a32e4949fd5f2cc83de24c35ee4518e825366406150c26c021.exe	88
PID 1312 wrote to memory of 1732	1312	16be22997addc7a32e4949fd5f2cc83de24c35ee4518e825366406150c26c021.exe	88
PID 1312 wrote to memory of 1732	1312	16be22997addc7a32e4949fd5f2cc83de24c35ee4518e825366406150c26c021.exe	88
PID 1312 wrote to memory of 1732	1312	16be22997addc7a32e4949fd5f2cc83de24c35ee4518e825366406150c26c021.exe	88
PID 1312 wrote to memory of 1732	1312	16be22997addc7a32e4949fd5f2cc83de24c35ee4518e825366406150c26c021.exe	88
PID 1312 wrote to memory of 1732	1312	16be22997addc7a32e4949fd5f2cc83de24c35ee4518e825366406150c26c021.exe	88
PID 1312 wrote to memory of 1732	1312	16be22997addc7a32e4949fd5f2cc83de24c35ee4518e825366406150c26c021.exe	88
PID 1312 wrote to memory of 1732	1312	16be22997addc7a32e4949fd5f2cc83de24c35ee4518e825366406150c26c021.exe	88
PID 1732 wrote to memory of 4088	1732	16be22997addc7a32e4949fd5f2cc83de24c35ee4518e825366406150c26c021.exe	89
PID 1732 wrote to memory of 4088	1732	16be22997addc7a32e4949fd5f2cc83de24c35ee4518e825366406150c26c021.exe	89
PID 1732 wrote to memory of 4088	1732	16be22997addc7a32e4949fd5f2cc83de24c35ee4518e825366406150c26c021.exe	89
PID 4088 wrote to memory of 2228	4088	Explorrer.exe	93
PID 4088 wrote to memory of 2228	4088	Explorrer.exe	93
PID 4088 wrote to memory of 2228	4088	Explorrer.exe	93
PID 4088 wrote to memory of 2228	4088	Explorrer.exe	93
PID 4088 wrote to memory of 2228	4088	Explorrer.exe	93
PID 4088 wrote to memory of 2228	4088	Explorrer.exe	93
PID 4088 wrote to memory of 2228	4088	Explorrer.exe	93
PID 4088 wrote to memory of 2228	4088	Explorrer.exe	93
PID 4088 wrote to memory of 3032	4088	Explorrer.exe	94
PID 4088 wrote to memory of 3032	4088	Explorrer.exe	94
PID 4088 wrote to memory of 3032	4088	Explorrer.exe	94
PID 4088 wrote to memory of 3032	4088	Explorrer.exe	94
PID 4088 wrote to memory of 3032	4088	Explorrer.exe	94
PID 4088 wrote to memory of 3032	4088	Explorrer.exe	94
PID 4088 wrote to memory of 3032	4088	Explorrer.exe	94
PID 4088 wrote to memory of 3032	4088	Explorrer.exe	94
PID 4088 wrote to memory of 3032	4088	Explorrer.exe	94
PID 4088 wrote to memory of 3032	4088	Explorrer.exe	94
PID 4088 wrote to memory of 3032	4088	Explorrer.exe	94
PID 4088 wrote to memory of 3032	4088	Explorrer.exe	94
PID 4088 wrote to memory of 3032	4088	Explorrer.exe	94
PID 2228 wrote to memory of 2900	2228	Explorrer.exe	95
PID 2228 wrote to memory of 2900	2228	Explorrer.exe	95
PID 2228 wrote to memory of 2900	2228	Explorrer.exe	95
PID 2228 wrote to memory of 2900	2228	Explorrer.exe	95
PID 2228 wrote to memory of 2900	2228	Explorrer.exe	95
PID 3032 wrote to memory of 3020	3032	Explorrer.exe	100
PID 3032 wrote to memory of 3020	3032	Explorrer.exe	100
PID 3032 wrote to memory of 3020	3032	Explorrer.exe	100
PID 3032 wrote to memory of 3112	3032	Explorrer.exe	101
PID 3032 wrote to memory of 3112	3032	Explorrer.exe	101
PID 3032 wrote to memory of 3112	3032	Explorrer.exe	101

C:\Users\Admin\AppData\Local\Temp\16be22997addc7a32e4949fd5f2cc83de24c35ee4518e825366406150c26c021.exe
"C:\Users\Admin\AppData\Local\Temp\16be22997addc7a32e4949fd5f2cc83de24c35ee4518e825366406150c26c021.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Users\Admin\AppData\Local\Temp\16be22997addc7a32e4949fd5f2cc83de24c35ee4518e825366406150c26c021.exe
  "C:\Users\Admin\AppData\Local\Temp\16be22997addc7a32e4949fd5f2cc83de24c35ee4518e825366406150c26c021.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1732
- - C:\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe
    C:\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe -notray
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4088
  - - C:\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe
      "C:\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2228
    - - C:\Windows\SysWOW64\ipconfig.exe
        
        "C:\Windows\system32\ipconfig.exe"
        5⤵
        Gathers network information
        
        PID:2900
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 272
        6⤵
        Program crash
        
        PID:2920
  - - C:\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe
      "C:\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe"
      4⤵
      Executes dropped EXE
      Modifies Internet Explorer settings
      Suspicious use of WriteProcessMemory
      PID:3032
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /u /s "C:\Users\Admin\AppData\Roaming\IE\bho.dll"
        5⤵
        Loads dropped DLL
        
        PID:3020
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s "C:\Users\Admin\AppData\Roaming\IE\bho.dll"
        5⤵
        Loads dropped DLL
        Installs/modifies Browser Helper Object
        Modifies registry class
        
        PID:3112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2900 -ip 2900
1⤵
PID:4052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Explorrer.exe

Path C:\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe
Size 504KB
SHA256 1fe01c2cd3377f5290e1eff3d0a764ced91e609992a6a7704615e76c7c097f4f
MD5 770db4eda9e67fef368fbaec125e01e0
SHA1 d068e21e5333d3830e6edb7337097bd01c84954c
SHA512 59a469195fa88697c4e4dde44be7b4191d9431654eef4b2da247841b950bb20f5ee117c2a81df4f437ff5ce546b65dc9b8e0d61bb69cade377a819e0c9eb7a73
SSDEEP 12288:tPmTkT0+nXTv1d5Jo/H4a6ZeUOHFVS9Qg:Vmo4IXhd81rS
MD5 SHA1 SHA512 SSDEEP

Submit Download

bho.dll

Path C:\Users\Admin\AppData\Roaming\IE\bho.dll
Size 87KB
SHA256 976540cf1b4d04d80be1f1af8ea0f050c3f03a0a8c4e339589b7bb9180fc07f5
MD5 49a92a33d1775b45b3bd45f8bec24585
SHA1 ea404af50bbdad5cbc9f95f4068bdc30c9fceff6
SHA512 7d5c4ea5c6f950a41bff386289df88b3f6d78444d7eeaa8a426569ce7698c2dfa916ae02d321af2be839c20e53b2ba9b3bb6a1573cad3b578733b082f0dc292f
SSDEEP 1536:ETw4mDklLqIaqhQ2MQXDn0Nzy8XTgUYV6uSXyV29fS1SWeITo:EmCLHaqWQXDn0NzutNtV29fS1HeITo
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1312-3-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/1312-4-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/1312-8-0x00000000056B0000-0x00000000056B1000-memory.dmp

Download

memory/1312-7-0x00000000056A0000-0x00000000056A1000-memory.dmp

Download

memory/1312-6-0x0000000004330000-0x0000000004331000-memory.dmp

Download

memory/1312-5-0x0000000002160000-0x0000000002161000-memory.dmp

Download

memory/1312-0-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/1312-15-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/1732-11-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/1732-24-0x0000000000410000-0x00000000004D9000-memory.dmp

Download

memory/1732-26-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/1732-9-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/2228-168-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/2228-50-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/3032-96-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3032-91-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3032-47-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3032-46-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3032-45-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3032-44-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3032-43-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3032-42-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3032-85-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3032-78-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3032-75-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3032-63-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3032-61-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3032-41-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3032-40-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3032-171-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3032-37-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3032-36-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3032-34-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3032-53-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3032-97-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3032-60-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3032-95-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3032-93-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3032-94-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3032-89-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3032-92-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3032-51-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3032-90-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3032-88-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3032-87-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3032-86-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3032-84-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3032-83-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3032-82-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3032-81-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3032-80-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3032-79-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3032-77-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3032-76-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3032-74-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3032-73-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3032-72-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3032-71-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3032-70-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3032-69-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3032-68-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3032-67-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3032-66-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3032-65-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3032-62-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3032-64-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4088-21-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/4088-27-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/4088-33-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/4088-39-0x0000000000400000-0x000000000049C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads