5258dc85ea82bb08d30a74ffa363d39a9a35ca29558903b0200500acb15c6dcc

General

Target

5258dc85ea82bb08d30a74ffa363d39a9a35ca29558903b0200500acb15c6dccN.dll
Size

339KB
MD5

3ddbddd414bfd9c80718830c39a7d120
SHA1

a8548a42237c113b5495a8c428a82ea2a7da0a8f
SHA256

5258dc85ea82bb08d30a74ffa363d39a9a35ca29558903b0200500acb15c6dcc
SHA512

cdcca30814bbdf5349edabd299d59673d9a049427a88d58909398e908bb8b0ca6089cf0ca6f8b2411e20e516339aef9d4e1c4c4adc766a64eee46ca5a65ab5b7
SSDEEP

6144:xJ7D5RtYutKWXfsMWxbsFMTk8YnpjAycXdBkg:PbtYapX0yrXg

Score

8^/10

adware discovery persistence stealer

Malware Config

Signatures

Modifies Shared Task Scheduler registry keys 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\SharedTaskScheduler\{4D6E7F91-5E70-192B-2A4C-B4D6E7091A2B}	rundll32.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E709193B-081A-B3D5-C5E6-6E7081A3B4C6}	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{E709193B-081A-B3D5-C5E6-6E7081A3B4C6}\	rundll32.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\K.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\K.dll	rundll32.exe
File created	C:\Windows\SysWOW64\E.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\E.dll	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E709193B-081A-B3D5-C5E6-6E7081A3B4C6}	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E709193B-081A-B3D5-C5E6-6E7081A3B4C6}\InprocServer32\ = "C:\\Windows\\SysWow64\\E.dll"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4D6E7F91-5E70-192B-2A4C-B4D6E7091A2B}	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4D6E7F91-5E70-192B-2A4C-B4D6E7091A2B}\	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4D6E7F91-5E70-192B-2A4C-B4D6E7091A2B}\InprocServer32\ThreadingModel = "Apartment"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E709193B-081A-B3D5-C5E6-6E7081A3B4C6}\	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E709193B-081A-B3D5-C5E6-6E7081A3B4C6}\InprocServer32	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E709193B-081A-B3D5-C5E6-6E7081A3B4C6}\InprocServer32\ThreadingModel = "Apartment"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4D6E7F91-5E70-192B-2A4C-B4D6E7091A2B}\InprocServer32	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4D6E7F91-5E70-192B-2A4C-B4D6E7091A2B}\InprocServer32\ = "C:\\Windows\\SysWow64\\K.dll"	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2072	2124	rundll32.exe	30
PID 2124 wrote to memory of 2072	2124	rundll32.exe	30
PID 2124 wrote to memory of 2072	2124	rundll32.exe	30
PID 2124 wrote to memory of 2072	2124	rundll32.exe	30
PID 2124 wrote to memory of 2072	2124	rundll32.exe	30
PID 2124 wrote to memory of 2072	2124	rundll32.exe	30
PID 2124 wrote to memory of 2072	2124	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5258dc85ea82bb08d30a74ffa363d39a9a35ca29558903b0200500acb15c6dccN.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5258dc85ea82bb08d30a74ffa363d39a9a35ca29558903b0200500acb15c6dccN.dll,#1
  2⤵
  - Modifies Shared Task Scheduler registry keys
  - Installs/modifies Browser Helper Object
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Browser Extensions

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\E.dll

Filesize
339KB

MD5
a40e1207c6f8776a1169dd43b993dfd1

SHA1
7f7547b9c1ef897ab9a2f4d9c0e40e37ae453f2f

SHA256
5a6f0d95b59f958fa16c946563d0f82ce6a6ce50f5ec9d76c7eca4bfed708ace

SHA512
ca20ff98aaf4b794fe39a3bec5df690ce094d38a24512e4e9529f296b65793e5b27f7800372513eceaaf04c7394959fd9345e2dcee0a5b983c2374d669130d64

Download Submit
memory/2072-15-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2072-11-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2072-12-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2072-13-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2072-14-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2072-0-0x0000000077C30000-0x0000000077C31000-memory.dmp

Filesize
4KB

Download
memory/2072-16-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2072-17-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2072-18-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2072-19-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2072-20-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2072-21-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads