2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80

General

Target

2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
Size

17KB
MD5

ac88cf156ecae3c17833d98e2d24cb89
SHA1

4d238e454fd2c82d809f7dbd5117b16a6d7686a4
SHA256

2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80
SHA512

b2e54b89be1ed110e889fe228da238071c7db1f24e55dc8a37f73d54ee56d4728131fb7c8c277c5cdcc7629158cb8e58f55ab2aa0503523cad69a8483448821b

Score

9^/10

adware persistence stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\sbmdl.dll	acprotect

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\explorer\run	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\start = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe"	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe

Executes dropped EXE 1 IoCs

Processes:

sbsm.exe

pid process

1184 sbsm.exe

pid	process
1184	sbsm.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\sbmdl.dll	upx
\Users\Admin\AppData\Local\Temp\sbsm.exe	upx
\Users\Admin\AppData\Local\Temp\sbsm.exe	upx
C:\Users\Admin\AppData\Local\Temp\sbsm.exe	upx

Loads dropped DLL 3 IoCs

Processes:

2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe

pid	process
1944	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
1944	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
1944	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe

Installs/modifies Browser Helper Object 2 TTPs
BHOs are DLL modules which act as plugins for Internet Explorer.
stealer adware

Modify Registry
T1112

Browser Extensions
T1176

Modifies Internet Explorer settings 1 TTPs 11 IoCs

adware spyware

Modify Registry

T1112

Processes:

2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}\URL = "http://www.srchgate.com/index.php?b=1&t=0&q={searchTerms}"	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\MenuText = "IE Anti-Spyware"	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\Exec = "http://www.dwnldietool.com/redirect.php"	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\CLSID = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}"	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Search	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}\DisplayName = "Search"	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\SearchScopes	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}"	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe

Modifies registry class 6 IoCs

Processes:

2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}\InprocServer32\ThreadingModel = "Apartment"	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}\xxx = "xxx"	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}\InprocServer32	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sbmdl.dll"	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exesbsm.exe

pid	process
1944	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
1184	sbsm.exe
1944	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
1184	sbsm.exe
1944	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
1184	sbsm.exe
1944	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
1184	sbsm.exe
1944	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
1184	sbsm.exe
1944	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
1184	sbsm.exe
1944	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
1184	sbsm.exe
1944	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
1184	sbsm.exe
1944	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
1184	sbsm.exe
1944	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
1184	sbsm.exe
1944	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
1184	sbsm.exe
1944	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
1184	sbsm.exe
1944	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
1184	sbsm.exe
1944	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
1184	sbsm.exe
1944	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
1184	sbsm.exe
1944	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
1184	sbsm.exe
1944	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
1184	sbsm.exe
1944	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
1184	sbsm.exe
1944	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
1184	sbsm.exe
1944	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
1184	sbsm.exe
1944	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
1184	sbsm.exe
1944	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
1184	sbsm.exe
1944	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
1184	sbsm.exe
1944	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
1184	sbsm.exe
1944	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
1184	sbsm.exe
1944	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
1184	sbsm.exe
1944	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
1184	sbsm.exe
1944	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
1184	sbsm.exe
1944	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
1184	sbsm.exe
1944	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
1184	sbsm.exe
1944	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
1184	sbsm.exe
1944	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
1184	sbsm.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exesbsm.exe

pid process

1944 2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
1184 sbsm.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe

description	pid	process	target process
PID 1944 wrote to memory of 1392	1944	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe	ctfmon.exe
PID 1944 wrote to memory of 1392	1944	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe	ctfmon.exe
PID 1944 wrote to memory of 1392	1944	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe	ctfmon.exe
PID 1944 wrote to memory of 1392	1944	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe	ctfmon.exe
PID 1944 wrote to memory of 1184	1944	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe	sbsm.exe
PID 1944 wrote to memory of 1184	1944	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe	sbsm.exe
PID 1944 wrote to memory of 1184	1944	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe	sbsm.exe
PID 1944 wrote to memory of 1184	1944	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe	sbsm.exe
PID 1944 wrote to memory of 1692	1944	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe	ctfmon.exe
PID 1944 wrote to memory of 1692	1944	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe	ctfmon.exe
PID 1944 wrote to memory of 1692	1944	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe	ctfmon.exe
PID 1944 wrote to memory of 1692	1944	2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe	ctfmon.exe

C:\Users\Admin\AppData\Local\Temp\2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe
"C:\Users\Admin\AppData\Local\Temp\2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80.exe"
1⤵
- Adds policy Run key to start application
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1944

C:\Windows\SysWOW64\ctfmon.exe
ctfmon.exe
2⤵
PID:1392

C:\Windows\SysWOW64\ctfmon.exe
ctfmon.exe
2⤵
PID:1692

C:\Users\Admin\AppData\Local\Temp\sbsm.exe
C:\Users\Admin\AppData\Local\Temp\sbsm.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:1184

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\sbsm.exe
Filesize
4KB

MD5
e0f7ced526b99e14505dc5f20a519cc2

SHA1
89dfd546230cdb96e30076c14cc63335f463d79d

SHA256
756511a2c6902b5828f754cb0a0849d0441034d90fc32f81196def0c85a725fa

SHA512
1cba73b7a7751647ca0d45bfb5bc57392529c1ee67686d790313415315d1b746bd16bfda599a19da8c19fed6be48d3e1a02a11bf2b3306ff0961c3f4bfc29fd1

Download Submit
\Users\Admin\AppData\Local\Temp\sbmdl.dll
Filesize
8KB

MD5
4a4bf873392614e5d5c4e2b5bdfa39e0

SHA1
7de1c3e45e8491bc21a0c3c89d0e73c8541142fd

SHA256
db7692f8a1446bc82ac3e48a80f69cb8c4f284a02abb800d4ddc732c42295b5a

SHA512
a56f2ac3ab5ec0206e178ac458f105bd0c00f407c8e06bad24cce902f098342ca48ac69eb22f6307e37a4818bfdd482c336da156a7b1c835ca0119c0ae35788e

Download Submit
\Users\Admin\AppData\Local\Temp\sbsm.exe
Filesize
4KB

MD5
e0f7ced526b99e14505dc5f20a519cc2

SHA1
89dfd546230cdb96e30076c14cc63335f463d79d

SHA256
756511a2c6902b5828f754cb0a0849d0441034d90fc32f81196def0c85a725fa

SHA512
1cba73b7a7751647ca0d45bfb5bc57392529c1ee67686d790313415315d1b746bd16bfda599a19da8c19fed6be48d3e1a02a11bf2b3306ff0961c3f4bfc29fd1

Download Submit
\Users\Admin\AppData\Local\Temp\sbsm.exe
Filesize
4KB

MD5
e0f7ced526b99e14505dc5f20a519cc2

SHA1
89dfd546230cdb96e30076c14cc63335f463d79d

SHA256
756511a2c6902b5828f754cb0a0849d0441034d90fc32f81196def0c85a725fa

SHA512
1cba73b7a7751647ca0d45bfb5bc57392529c1ee67686d790313415315d1b746bd16bfda599a19da8c19fed6be48d3e1a02a11bf2b3306ff0961c3f4bfc29fd1

Download Submit
memory/1184-59-0x0000000000000000-mapping.dmp

Download
memory/1392-56-0x0000000000000000-mapping.dmp

Download
memory/1692-60-0x0000000000000000-mapping.dmp

Download
memory/1944-54-0x00000000754A1000-0x00000000754A3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads