a2cec807b4752a16c363327f158ba145311017a8eee94cb8894e5e4203ce0e9a

General

Target

a2cec807b4752a16c363327f158ba145311017a8eee94cb8894e5e4203ce0e9a.dll
Size

339KB
MD5

fee5e29b70eed85418a9f6d6565c2b70
SHA1

c8c674f5a59f1e9aa288f54826f21e440dd09bcd
SHA256

a2cec807b4752a16c363327f158ba145311017a8eee94cb8894e5e4203ce0e9a
SHA512

83689249117cac4f98aeee861b0d9635d529cc53fefa94f834e7100a239893dd7883990b89643fe90aa68821d1d70b083a5506a03d4d3255c0b605c1234fad82
SSDEEP

6144:xJ7D5RtYutKWXfsMWxbsFMTk8YnpjAycXdBkF:PbtYapX0yrXF

Score

8^/10

adware discovery persistence stealer

Malware Config

Signatures

Modifies Shared Task Scheduler registry keys 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{7F81A3B4-81A3-3C5E-5D6F-E7092A2B4D6F}	rundll32.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1A2B4D5E-2B4D-D6F8-F809-81A3C5C5E709}	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1A2B4D5E-2B4D-D6F8-F809-81A3C5C5E709}\	rundll32.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\DSGVKZDS.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\DSGVKZDS.dll	rundll32.exe
File created	C:\Windows\SysWOW64\JXMBQFJY.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\JXMBQFJY.dll	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1A2B4D5E-2B4D-D6F8-F809-81A3C5C5E709}\	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1A2B4D5E-2B4D-D6F8-F809-81A3C5C5E709}\InprocServer32	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1A2B4D5E-2B4D-D6F8-F809-81A3C5C5E709}\InprocServer32\ = "C:\\Windows\\SysWow64\\DSGVKZDS.dll"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1A2B4D5E-2B4D-D6F8-F809-81A3C5C5E709}\InprocServer32\ThreadingModel = "Apartment"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7F81A3B4-81A3-3C5E-5D6F-E7092A2B4D6F}	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7F81A3B4-81A3-3C5E-5D6F-E7092A2B4D6F}\	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7F81A3B4-81A3-3C5E-5D6F-E7092A2B4D6F}\InprocServer32\ThreadingModel = "Apartment"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1A2B4D5E-2B4D-D6F8-F809-81A3C5C5E709}	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7F81A3B4-81A3-3C5E-5D6F-E7092A2B4D6F}\InprocServer32\ = "C:\\Windows\\SysWow64\\JXMBQFJY.dll"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7F81A3B4-81A3-3C5E-5D6F-E7092A2B4D6F}\InprocServer32	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 1388	764	rundll32.exe	83
PID 764 wrote to memory of 1388	764	rundll32.exe	83
PID 764 wrote to memory of 1388	764	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a2cec807b4752a16c363327f158ba145311017a8eee94cb8894e5e4203ce0e9a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a2cec807b4752a16c363327f158ba145311017a8eee94cb8894e5e4203ce0e9a.dll,#1
  2⤵
  - Modifies Shared Task Scheduler registry keys
  - Installs/modifies Browser Helper Object
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:1388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Browser Extensions

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\DSGVKZDS.dll

Filesize
339KB

MD5
f7b5a75ad39ed88a6ff3ab0c1b49c7ad

SHA1
14dc1c13a8a349cc74700387702327bd5ec59094

SHA256
03f63c2726f18cf134b2a7569e5aa5bf114ebc66c51c6aef9da94272a1b42858

SHA512
26dd9a0045fc39b16080def7f27c5cb15666ff96e764aebc899aefd2384257c7bf54edf3226e4775dcf4f9b65b34b28e33c6f5a85199ed00c02248c20d362f2e

Download Submit
memory/1388-15-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1388-11-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1388-12-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1388-13-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1388-14-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1388-0-0x00000000777E4000-0x00000000777E5000-memory.dmp

Filesize
4KB

Download
memory/1388-16-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1388-17-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1388-18-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1388-19-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1388-20-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1388-21-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads