Overview

overview

7

Static

static

7

1a2bedd154...18.exe

windows7-x64

7

1a2bedd154...18.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ps.dll

windows7-x64

3

$PLUGINSDI...ps.dll

windows10-2004-x64

3

$PLUGINSDI...rl.dll

windows7-x64

3

$PLUGINSDI...rl.dll

windows10-2004-x64

3

Baidu-TB-ASBar.exe

windows7-x64

7

Baidu-TB-ASBar.exe

windows10-2004-x64

1

$PROGRAM_F...er.exe

windows7-x64

1

$PROGRAM_F...er.exe

windows10-2004-x64

1

$PROGRAM_F...ar.dll

windows7-x64

7

$PROGRAM_F...ar.dll

windows10-2004-x64

7

$PROGRAM_F...rX.dll

windows7-x64

7

$PROGRAM_F...rX.dll

windows10-2004-x64

7

$PROGRAM_F...er.exe

windows7-x64

1

$PROGRAM_F...er.exe

windows10-2004-x64

1

$PROGRAM_F...rc.dll

windows7-x64

1

$PROGRAM_F...rc.dll

windows10-2004-x64

1

Data/Games/GAME.htm

windows7-x64

1

Data/Games/GAME.htm

windows10-2004-x64

1

Data/Nav1/DH1.htm

windows7-x64

1

Data/Nav1/DH1.htm

windows10-2004-x64

1

Data/Nav1/DH2.htm

windows7-x64

1

Data/Nav1/DH2.htm

windows10-2004-x64

1

Data/Nav1/DH3.htm

windows7-x64

1

Data/Nav1/DH3.htm

windows10-2004-x64

1

Data/Nav1/DH4.htm

windows7-x64

1

Data/Nav1/DH4.htm

windows10-2004-x64

1

Analysis

  • max time kernel
    122s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    28-06-2024 12:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    $PROGRAM_FILES/Baidu/AddressBar.dll

  • Size

    1.1MB

  • MD5

    57d9f8b6e595ef4a02d8630c53fddcc3

  • SHA1

    523dedd35613dc3221657876a3f5248e38e2a842

  • SHA256

    c9a2b8ff0be921e2ac2ff6993f7fecc486b02969254884f89af3a19babfcf7e6

  • SHA512

    e95f144caa3bb636fd4a085a24a41d95ac6dae1c47d729400bb65a37527863b02b15e98cb62121f2155956f8a2b177f3b1a11d9ba08881858924d9bd75be985e

  • SSDEEP

    24576:ToJx/zjXPRxxgihJfn9svZw/UDkK4ac3tHtTKJZTXjSH/:ToH//nxzhlXtNTKJdXjSH/

Score
7/10
adwarestealer

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 7 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Modifies Internet Explorer settings 1 TTPs 24 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$PROGRAM_FILES\Baidu\AddressBar.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2064
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\$PROGRAM_FILES\Baidu\AddressBar.dll
      2⤵
      • Loads dropped DLL
      • Installs/modifies Browser Helper Object
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2088
      • C:\Users\Admin\AppData\Local\Temp\$PROGR~1\Baidu\{BF1E8~1\ASBarBroker.exe
        "C:\Users\Admin\AppData\Local\Temp\$PROGR~1\Baidu\{BF1E8~1\ASBarBroker.exe" -RegServer
        3⤵
        • Executes dropped EXE
        • Modifies Internet Explorer settings
        • Modifies registry class
        PID:3060

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Browser Extensions

1
T1176

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\$PROGRAM_FILES\Baidu\{BF1E80D5-1697-C5E2-F5E6-873FF731DE35}\AddressBar.dll
    Filesize

    1.1MB

    MD5

    57d9f8b6e595ef4a02d8630c53fddcc3

    SHA1

    523dedd35613dc3221657876a3f5248e38e2a842

    SHA256

    c9a2b8ff0be921e2ac2ff6993f7fecc486b02969254884f89af3a19babfcf7e6

    SHA512

    e95f144caa3bb636fd4a085a24a41d95ac6dae1c47d729400bb65a37527863b02b15e98cb62121f2155956f8a2b177f3b1a11d9ba08881858924d9bd75be985e

    Download Submit
  • \Users\Admin\AppData\Local\Temp\$PROGR~1\Baidu\{BF1E8~1\ASBarBroker.exe
    Filesize

    129KB

    MD5

    0ebf8f583abb1ffb40c07b87eae4edb3

    SHA1

    ef91b3245f426b86c2b69fd9678176d3be05c009

    SHA256

    00a481ef9985281177c1f6cc6d055c2bdb719db224637e7eb474a3eaab6305cf

    SHA512

    0bca7bc46019628149afb00cd69d26fd59195c4cbecbb472f9afabf73e8b3eb1da20fdaa4ef03c0776d11b5c8532d16b40a927e4b8b68640067c145cb7e463b4

    Download Submit
  • memory/2088-4-0x0000000002AA0000-0x0000000002BC6000-memory.dmp
    Filesize

    1.1MB

    Download