b8e80b78c82888231dc9c122812a5f22222436fc85a82eaccbcd0f71cd3a9035

General

Target

b8e80b78c82888231dc9c122812a5f22222436fc85a82eaccbcd0f71cd3a9035.dll
Size

339KB
MD5

3bab6cb7494d1c98864367633d770131
SHA1

2cc98d3711ec72ac8b89c4ead3534115b8f57e50
SHA256

b8e80b78c82888231dc9c122812a5f22222436fc85a82eaccbcd0f71cd3a9035
SHA512

e3d13a6403ecc10946fadcd5cecf50e40ff1217422843a45b6e35b7ee0b6851ec85f9039e64baa9057ceb70d563fbe2dd18a672dcd4b2b34bd0b8671c852bb71
SSDEEP

6144:xJ7D5RtYutKWXfsMWxbsFMTk8YnpjAycXdBkz:PbtYapX0yrXz

Score

8^/10

adware persistence stealer

Malware Config

Signatures

Modifies Shared Task Scheduler registry keys 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\SharedTaskScheduler\{EDB98642-0ECA-B975-CA97-6420FDBA9753}	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler	rundll32.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{975320EC-A864-531F-6531-0ECA976431FD}	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{975320EC-A864-531F-6531-0ECA976431FD}\	rundll32.exe

Drops file in System32 directory 4 IoCs

Processes:

rundll32.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\L.dll	rundll32.exe
File created	C:\Windows\SysWOW64\Q.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\Q.dll	rundll32.exe
File created	C:\Windows\SysWOW64\L.dll	rundll32.exe

Modifies registry class 10 IoCs

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EDB98642-0ECA-B975-CA97-6420FDBA9753}\	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EDB98642-0ECA-B975-CA97-6420FDBA9753}\InprocServer32	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EDB98642-0ECA-B975-CA97-6420FDBA9753}\InprocServer32\ThreadingModel = "Apartment"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{975320EC-A864-531F-6531-0ECA976431FD}\InprocServer32\ = "C:\\Windows\\SysWow64\\L.dll"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{975320EC-A864-531F-6531-0ECA976431FD}\InprocServer32\ThreadingModel = "Apartment"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EDB98642-0ECA-B975-CA97-6420FDBA9753}	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EDB98642-0ECA-B975-CA97-6420FDBA9753}\InprocServer32\ = "C:\\Windows\\SysWow64\\Q.dll"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{975320EC-A864-531F-6531-0ECA976431FD}	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{975320EC-A864-531F-6531-0ECA976431FD}\	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{975320EC-A864-531F-6531-0ECA976431FD}\InprocServer32	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2700 wrote to memory of 2228	2700	rundll32.exe	rundll32.exe
PID 2700 wrote to memory of 2228	2700	rundll32.exe	rundll32.exe
PID 2700 wrote to memory of 2228	2700	rundll32.exe	rundll32.exe
PID 2700 wrote to memory of 2228	2700	rundll32.exe	rundll32.exe
PID 2700 wrote to memory of 2228	2700	rundll32.exe	rundll32.exe
PID 2700 wrote to memory of 2228	2700	rundll32.exe	rundll32.exe
PID 2700 wrote to memory of 2228	2700	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b8e80b78c82888231dc9c122812a5f22222436fc85a82eaccbcd0f71cd3a9035.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2700

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b8e80b78c82888231dc9c122812a5f22222436fc85a82eaccbcd0f71cd3a9035.dll,#1
2⤵
- Modifies Shared Task Scheduler registry keys
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
PID:2228

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Browser Extensions

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\L.dll
Filesize
339KB

MD5
cea9c31d02c86ce0ccc8b22642b51254

SHA1
decdbb28fa2f756757b6d22821189222279d3fc5

SHA256
1e2cff20bc0a5f94ed7c3594a777c1d7cc16a526b16d6bf09fbdabf96a659eb9

SHA512
8c003b9f8d8d14f21b015fda66f34954b5a07732fb140c98a09e59aafea609e3a408950a139a1bf79b26b4aba3a4bdfd47e873e5f9c81f630bafb99b0d8b0efb

Download Submit
memory/2228-17-0x00000000006F0000-0x000000000074C000-memory.dmp

Filesize
368KB

Download
memory/2228-16-0x00000000006F0000-0x000000000074C000-memory.dmp

Filesize
368KB

Download
memory/2228-12-0x00000000006F0000-0x000000000074C000-memory.dmp

Filesize
368KB

Download
memory/2228-13-0x00000000006F0000-0x000000000074C000-memory.dmp

Filesize
368KB

Download
memory/2228-18-0x00000000006F0000-0x000000000074C000-memory.dmp

Filesize
368KB

Download
memory/2228-15-0x00000000006F0000-0x000000000074C000-memory.dmp

Filesize
368KB

Download
memory/2228-1-0x00000000774B0000-0x00000000774B1000-memory.dmp

Filesize
4KB

Download
memory/2228-0-0x00000000006F0000-0x000000000074C000-memory.dmp

Filesize
368KB

Download
memory/2228-14-0x00000000006F0000-0x000000000074C000-memory.dmp

Filesize
368KB

Download
memory/2228-19-0x00000000006F0000-0x000000000074C000-memory.dmp

Filesize
368KB

Download
memory/2228-20-0x00000000006F0000-0x000000000074C000-memory.dmp

Filesize
368KB

Download
memory/2228-21-0x00000000006F0000-0x000000000074C000-memory.dmp

Filesize
368KB

Download
memory/2228-22-0x00000000006F0000-0x000000000074C000-memory.dmp

Filesize
368KB

Download
memory/2228-23-0x00000000006F0000-0x000000000074C000-memory.dmp

Filesize
368KB

Download
memory/2228-24-0x00000000006F0000-0x000000000074C000-memory.dmp

Filesize
368KB

Download
memory/2228-25-0x00000000006F0000-0x000000000074C000-memory.dmp

Filesize
368KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads