4134ef8786ea95000b13818220af5c6f5bf43483ba3595bfc5e48259fa774207

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

IEMate.dll
Size

1004KB
MD5

271ee5037a241ae79273434bfd62d7d1
SHA1

d6550f3472522f0b185a6a4771a0f1d63f2a1023
SHA256

1e227a4cd02d299642ff73fb84175d8e2880ef84ac696ed2ea4b4cb30b50c848
SHA512

4bae6d480a05c4a3aee9931c9f08d04e50d5b28ffc5cd1af71bb953ee0009f46873b84a96b6f037de9adbe35b2242dd5cb42ecdcdd899781957bc3389aaf497b
SSDEEP

12288:uIBNRZas1idIhde60KdJkHLyS5PgYNU2zVdoYLb/qkclcL/TvZVv89rAto1OnW29:7Nnv11PrdOHLyS54YK2zV4u/rZ4wGOL

Score

6^/10

adware discovery stealer

Malware Config

Signatures

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00000000-9A18-40ED-9FE2-E92979DDE094}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00000000-9A18-40ED-9FE2-E92979DDE094}\ = "IESafer"	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{5606FFF9-DA61-4B40-92AF-E622ADB4DC2C}\Codepage = "936"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{5606FFF9-DA61-4B40-92AF-E622ADB4DC2C}\DisplayName = "百度"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{5606FFF9-DA61-4B40-92AF-E622ADB4DC2C}\URL = "http://www.baidu.com/baidu?tn=iefix_dg&word={searchTerms}"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{5606FFF9-DA61-4B40-92AF-E622ADB4DC2C}"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Internet Explorer\MenuExt\页面截图... Alt+S	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\页面截图... Alt+S\ = "c:\\users\\admin\\appdata\\local\\temp\\page\\saveimage.htm"	regsvr32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\页面截图... Alt+S\contexts = "243"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Internet Explorer\SearchScopes\{5606FFF9-DA61-4B40-92AF-E622ADB4DC2C}	regsvr32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IeMate.CIEMateProtocol.1\CLSID\ = "{44C5AE91-A034-473D-9518-CC9F053D27CA}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81594BC9-4E7A-43AD-B404-2E21E01A8947}\ = "JSIEMate Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E318D91A-E3E4-4670-9382-A9F7FEFB826B}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4A5FC50D-D9D7-4ADA-ADFB-08F699D1D52F}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D1183FD5-5692-459B-BCC6-C6FD180F1C98}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D0281551-6711-496C-92D3-8B0C1BE0CCAD}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{44C5AE91-A034-473D-9518-CC9F053D27CA}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IEMate.JSIEMate\CurVer\ = "IEMate.JSIEMate.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1037046C-EE73-46E9-B8C1-1DA827C973B4}\VersionIndependentProgID\ = "IESafer.ScriptHost"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E0DA85F6-519D-4351-9C78-062EF5D850E5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{50982D5A-B16D-4E8A-97B7-60DBE84FCEFD}\ = "IDocEventHandler"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IEMate.ScriptHost\ = "ScriptHost Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E0DA85F6-519D-4351-9C78-062EF5D850E5}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-9A18-40ED-9FE2-E92979DDE094}\VersionIndependentProgID\ = "IESafer.status"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D1183FD5-5692-459B-BCC6-C6FD180F1C98}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{50AD7E22-9772-4A25-8E88-00B6CDAF71A5}\ = "Istatus"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{50982D5A-B16D-4E8A-97B7-60DBE84FCEFD}\TypeLib\ = "{B5EF1414-9E2C-4F20-95F4-7ABEF377E752}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E318D91A-E3E4-4670-9382-A9F7FEFB826B}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1037046C-EE73-46E9-B8C1-1DA827C973B4}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4A5FC50D-D9D7-4ADA-ADFB-08F699D1D52F}\ = "IScriptHost"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IEMate.ScriptHost	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{50AD7E22-9772-4A25-8E88-00B6CDAF71A5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31D49D16-9FC0-4E62-ADF9-681E7103F145}\ = "IDomExtender"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D1183FD5-5692-459B-BCC6-C6FD180F1C98}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iemate.status\CLSID\ = "{00000000-9A18-40ED-9FE2-E92979DDE094}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IEMate.JSIEMate\ = "JSIEMate Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IeMate.DomExtender\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4A5FC50D-D9D7-4ADA-ADFB-08F699D1D52F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31D49D16-9FC0-4E62-ADF9-681E7103F145}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-9A18-40ED-9FE2-E92979DDE094}\ = "IESafer"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IEMate.JSIEMate.1\CLSID\ = "{81594BC9-4E7A-43AD-B404-2E21E01A8947}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D24F2003-CAE9-45AE-99DA-B2913D33F56D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IEMate.ScriptHost.1\ = "ScriptHost Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{50AD7E22-9772-4A25-8E88-00B6CDAF71A5}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E0DA85F6-519D-4351-9C78-062EF5D850E5}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0000A11D-4F01-42B2-84CD-B26ADD453703}\ProgID\ = "IeMate.IeMateObj.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IeMate.CIEMateProtocol\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{44C5AE91-A034-473D-9518-CC9F053D27CA}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-9A18-40ED-9FE2-E92979DDE094}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{50AD7E22-9772-4A25-8E88-00B6CDAF71A5}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D0281551-6711-496C-92D3-8B0C1BE0CCAD}\ = "IJSIEMate"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0000A11D-4F01-42B2-84CD-B26ADD453703}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IEMate.JSIEMate\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81594BC9-4E7A-43AD-B404-2E21E01A8947}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81594BC9-4E7A-43AD-B404-2E21E01A8947}\TypeLib\ = "{B5EF1414-9E2C-4F20-95F4-7ABEF377E752}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{50982D5A-B16D-4E8A-97B7-60DBE84FCEFD}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D0281551-6711-496C-92D3-8B0C1BE0CCAD}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4A5FC50D-D9D7-4ADA-ADFB-08F699D1D52F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{50982D5A-B16D-4E8A-97B7-60DBE84FCEFD}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IeMate.CIEMateProtocol.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IEMate.JSIEMate\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IEMate.DocEventHandler\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IEMate.ScriptHost\CurVer\ = "IESafer.ScriptHost.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B5EF1414-9E2C-4F20-95F4-7ABEF377E752}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E0DA85F6-519D-4351-9C78-062EF5D850E5}\ = "IIeMateObj"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81594BC9-4E7A-43AD-B404-2E21E01A8947}\ProgID\ = "IEMate.JSIEMate.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81594BC9-4E7A-43AD-B404-2E21E01A8947}\AppID = "{F19926D0-05FC-4AE8-BB9C-FB7C43CEC00C}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1037046C-EE73-46E9-B8C1-1DA827C973B4}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{50AD7E22-9772-4A25-8E88-00B6CDAF71A5}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E0DA85F6-519D-4351-9C78-062EF5D850E5}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-9A18-40ED-9FE2-E92979DDE094}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEMate.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D24F2003-CAE9-45AE-99DA-B2913D33F56D}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1037046C-EE73-46E9-B8C1-1DA827C973B4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{50AD7E22-9772-4A25-8E88-00B6CDAF71A5}	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3120 wrote to memory of 764	3120	regsvr32.exe	91
PID 3120 wrote to memory of 764	3120	regsvr32.exe	91
PID 3120 wrote to memory of 764	3120	regsvr32.exe	91

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\IEMate.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3120
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\IEMate.dll
  2⤵
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4228,i,10369132178352108590,11047993562598554317,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:8
1⤵
PID:224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\option.ini

Filesize
2KB

MD5
cb290bb202865282e67ec573a98941d6

SHA1
78f51a4d823c91db8cc8b874686524ffeaa56b0d

SHA256
0ea865442bfbf646a4ab7ef9bd17174cc6ed5a4af861361dab53596d2cb50465

SHA512
b7a070b85714d08804f2afc059908196bf1e2542369fe2e4f1738cff7ea51faad148300789e6017d37b978011e0d56976a30b1f07865c0e20751d22d82a07bde

Download Submit
memory/764-7-0x0000000000B00000-0x0000000000B1B000-memory.dmp

Filesize
108KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads