b3a49387b17695e73d0f1a9edae64cd73a4fd27abe5bf122ab0826ead7cb82a9

General

Target

5258dc85ea82bb08d30a74ffa363d39a9a35ca29558903b0200500acb15c6dccN.dll
Size

339KB
MD5

3598b58fcd27847b98fdc05d784c3e77
SHA1

0e84e2c831e3ed92ebce7dffe74e537e23fe537f
SHA256

b3a49387b17695e73d0f1a9edae64cd73a4fd27abe5bf122ab0826ead7cb82a9
SHA512

3ff7a7bcc5de1e1a17c891564d9730ba9fe2d205ec61f8a5d041c4e65e843e1c1559a74e20cf1d31ed5fc392eafeec753467a7c60df3c5ab0cee044d1777517d
SSDEEP

6144:xJ7D5RtYutKWXfsMWxbsFMTk8YnpjAycXdBk+:PbtYapX0yrX+

Score

8^/10

adware discovery persistence stealer

Malware Config

Signatures

Modifies Shared Task Scheduler registry keys 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\SharedTaskScheduler\{38D27C05-49F4-F4AF-16B0-AF5AE38D17C1}	rundll32.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{D28C16BF-E39E-AE49-B05A-49F48D27C16B}\	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D28C16BF-E39E-AE49-B05A-49F48D27C16B}	rundll32.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\XK.dll	rundll32.exe
File created	C:\Windows\SysWOW64\DQ.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\DQ.dll	rundll32.exe
File created	C:\Windows\SysWOW64\XK.dll	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D28C16BF-E39E-AE49-B05A-49F48D27C16B}\	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D28C16BF-E39E-AE49-B05A-49F48D27C16B}\InprocServer32\ = "C:\\Windows\\SysWow64\\XK.dll"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38D27C05-49F4-F4AF-16B0-AF5AE38D17C1}\	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38D27C05-49F4-F4AF-16B0-AF5AE38D17C1}\InprocServer32\ThreadingModel = "Apartment"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D28C16BF-E39E-AE49-B05A-49F48D27C16B}	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D28C16BF-E39E-AE49-B05A-49F48D27C16B}\InprocServer32	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D28C16BF-E39E-AE49-B05A-49F48D27C16B}\InprocServer32\ThreadingModel = "Apartment"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38D27C05-49F4-F4AF-16B0-AF5AE38D17C1}	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38D27C05-49F4-F4AF-16B0-AF5AE38D17C1}\InprocServer32	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38D27C05-49F4-F4AF-16B0-AF5AE38D17C1}\InprocServer32\ = "C:\\Windows\\SysWow64\\DQ.dll"	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2904	2860	rundll32.exe	28
PID 2860 wrote to memory of 2904	2860	rundll32.exe	28
PID 2860 wrote to memory of 2904	2860	rundll32.exe	28
PID 2860 wrote to memory of 2904	2860	rundll32.exe	28
PID 2860 wrote to memory of 2904	2860	rundll32.exe	28
PID 2860 wrote to memory of 2904	2860	rundll32.exe	28
PID 2860 wrote to memory of 2904	2860	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5258dc85ea82bb08d30a74ffa363d39a9a35ca29558903b0200500acb15c6dccN.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5258dc85ea82bb08d30a74ffa363d39a9a35ca29558903b0200500acb15c6dccN.dll,#1
  2⤵
  - Modifies Shared Task Scheduler registry keys
  - Installs/modifies Browser Helper Object
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Browser Extensions

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\XK.dll

Filesize
339KB

MD5
ef3583111e792e7e17a49bb80f2d27a7

SHA1
cb8a3794f912d1055734ad6cd592fbe4c7d2eec7

SHA256
19fae5febb28546e850a72bfc54d3b8dc6c943dfee6877f9ecb52777e1776cdf

SHA512
9e166c6e00380e4fb4d03016ea6bff98abf56927065851b0b8bc8576477ae5e94a5f9b87670eb7f0e3905238ff8cd9f5b15994070d0891f8a12563d14900e22e

Download Submit
memory/2904-15-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2904-11-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2904-12-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2904-13-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2904-14-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2904-0-0x0000000077530000-0x0000000077531000-memory.dmp

Filesize
4KB

Download
memory/2904-16-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2904-17-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2904-18-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2904-19-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2904-20-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2904-21-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads