1be70aadab1048bf2cbf71ee7fdb951cf47f04065674e6ad83d114a670f5a170

General

Target

1be70aadab1048bf2cbf71ee7fdb951cf47f04065674e6ad83d114a670f5a170.exe
Size

164KB
MD5

5664b9abe1b27ac646d149a4e0383d3a
SHA1

95ae306087d40d64757c8328d5ecad288025a254
SHA256

1be70aadab1048bf2cbf71ee7fdb951cf47f04065674e6ad83d114a670f5a170
SHA512

478e753a03a9bcb5040acd1122d1f274cef481711d0e9858474c84f36e9dbdc5d5eddab5ee205ff3ab4d8a33872251f0d130ace7f12cf017efe510424576fb7e
SSDEEP

3072:ASpYdBUSchnEDRjIs+IrRiSv4Z9QkDIUCeTxnMwwYeIfB4cOS8oCRcLYB3IMgHZp:1edBUSeWjwwRiMGDIUCe1nMwuIfB4cOy

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

Smohua.exe

pid process

1924 Smohua.exe

pid	process
1924	Smohua.exe

Drops file in Windows directory 6 IoCs

Processes:

1be70aadab1048bf2cbf71ee7fdb951cf47f04065674e6ad83d114a670f5a170.exeSmohua.exe

description	ioc	process
File created	C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job	1be70aadab1048bf2cbf71ee7fdb951cf47f04065674e6ad83d114a670f5a170.exe
File opened for modification	C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job	1be70aadab1048bf2cbf71ee7fdb951cf47f04065674e6ad83d114a670f5a170.exe
File created	C:\Windows\Smohua.exe	1be70aadab1048bf2cbf71ee7fdb951cf47f04065674e6ad83d114a670f5a170.exe
File opened for modification	C:\Windows\Smohua.exe	1be70aadab1048bf2cbf71ee7fdb951cf47f04065674e6ad83d114a670f5a170.exe
File created	C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job	Smohua.exe
File opened for modification	C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job	Smohua.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

Smohua.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\International	Smohua.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

1be70aadab1048bf2cbf71ee7fdb951cf47f04065674e6ad83d114a670f5a170.exeSmohua.exe

pid	process
1900	1be70aadab1048bf2cbf71ee7fdb951cf47f04065674e6ad83d114a670f5a170.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe
1924	Smohua.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1be70aadab1048bf2cbf71ee7fdb951cf47f04065674e6ad83d114a670f5a170.exe

description	pid	process	target process
PID 1900 wrote to memory of 1924	1900	1be70aadab1048bf2cbf71ee7fdb951cf47f04065674e6ad83d114a670f5a170.exe	Smohua.exe
PID 1900 wrote to memory of 1924	1900	1be70aadab1048bf2cbf71ee7fdb951cf47f04065674e6ad83d114a670f5a170.exe	Smohua.exe
PID 1900 wrote to memory of 1924	1900	1be70aadab1048bf2cbf71ee7fdb951cf47f04065674e6ad83d114a670f5a170.exe	Smohua.exe
PID 1900 wrote to memory of 1924	1900	1be70aadab1048bf2cbf71ee7fdb951cf47f04065674e6ad83d114a670f5a170.exe	Smohua.exe

C:\Users\Admin\AppData\Local\Temp\1be70aadab1048bf2cbf71ee7fdb951cf47f04065674e6ad83d114a670f5a170.exe
"C:\Users\Admin\AppData\Local\Temp\1be70aadab1048bf2cbf71ee7fdb951cf47f04065674e6ad83d114a670f5a170.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1900

C:\Windows\Smohua.exe
C:\Windows\Smohua.exe
2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
PID:1924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Smohua.exe

Filesize
164KB

MD5
5664b9abe1b27ac646d149a4e0383d3a

SHA1
95ae306087d40d64757c8328d5ecad288025a254

SHA256
1be70aadab1048bf2cbf71ee7fdb951cf47f04065674e6ad83d114a670f5a170

SHA512
478e753a03a9bcb5040acd1122d1f274cef481711d0e9858474c84f36e9dbdc5d5eddab5ee205ff3ab4d8a33872251f0d130ace7f12cf017efe510424576fb7e

Download Submit
C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job

Filesize
408B

MD5
a4bcde6e0df739fefc86813f02674a57

SHA1
3ade3b071e047a66467e1604c2b5a7d4813ba09c

SHA256
edbf1e435441d8a3bbced0b2b090d4c48e7f3fed83c22b3a0d5f518c8701ac39

SHA512
1ea1a60c9c011ace1661eb473b3109fc1a05a2b4549c14e5775255bd70dbacbf6dab55a6f03cda83015d86b16484241beea1b73ef5c7aaecc1922a19c2c85c0f

Download Submit
memory/1900-54-0x0000000075A81000-0x0000000075A83000-memory.dmp

Filesize
8KB

Download
memory/1900-55-0x0000000000220000-0x000000000022E000-memory.dmp

Filesize
56KB

Download
memory/1900-56-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1900-62-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1900-63-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1924-57-0x0000000000000000-mapping.dmp

Download
memory/1924-61-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1924-64-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads