Analysis
- max time kernel
150s - max time network
122s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
03/02/2024, 03:50
Behavioral task
behavioral1
Sample
8b524072d5b0f8d167211d603e54a468.exe
Resource
win7-20231215-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
8b524072d5b0f8d167211d603e54a468.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 8b524072d5b0f8d167211d603e54a468.exe
- Size 18KB
- Sample240203-ed7geagde4
- SHA256 ef852d67e1c3dc953a9929f5119c3626bbdbfc5e72d455ac89d025d8ed126441
- MD5 8b524072d5b0f8d167211d603e54a468
- SHA1 0ca27d92047ae6136d4197517852b97bd5cfa453
- SHA512 3e72bb76b87d45297d1e412780da8f91360a85809301cf16debc96cd595a0bbb27d984290eb3709e5e909c9e9d36d1b26e386b3b08460833952f81383c10764b
- SSDEEP 384:5pbqo5F+rBerj7x/t7YRbOncVkbClDY0ABPaNJawcudoD7UV:50oyrWj7bYRqcVkbCKwnbcuyD7U
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\explorer\run 8b524072d5b0f8d167211d603e54a468.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\start = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8b524072d5b0f8d167211d603e54a468.exe" 8b524072d5b0f8d167211d603e54a468.exe - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x0007000000023227-2.dat acprotect - Executes dropped EXE 1 IoCs
pid Process 3764 sbsm.exe - Loads dropped DLL 1 IoCs
pid Process 1652 8b524072d5b0f8d167211d603e54a468.exe -
resource yara_rule behavioral2/memory/1652-0-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/1652-5-0x0000000010000000-0x000000001000A000-memory.dmp upx behavioral2/files/0x0007000000023227-2.dat upx behavioral2/memory/1652-10-0x0000000000400000-0x000000000040D000-memory.dmp upx - Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7C109800-A5D5-438F-9640-18D17E168B88} 8b524072d5b0f8d167211d603e54a468.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7C109800-A5D5-438F-9640-18D17E168B88}\ 8b524072d5b0f8d167211d603e54a468.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 8b524072d5b0f8d167211d603e54a468.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}\URL = "http://www.searchinggate.com/index.php?b=1&t=0&q={searchTerms}" 8b524072d5b0f8d167211d603e54a468.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}" 8b524072d5b0f8d167211d603e54a468.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E} 8b524072d5b0f8d167211d603e54a468.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\Exec = "http://www.iefixgate.com/redirect.php" 8b524072d5b0f8d167211d603e54a468.exe Key created \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\Main 8b524072d5b0f8d167211d603e54a468.exe Key created \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302} 8b524072d5b0f8d167211d603e54a468.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}\DisplayName = "Search" 8b524072d5b0f8d167211d603e54a468.exe Key created \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\SearchScopes 8b524072d5b0f8d167211d603e54a468.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\MenuText = "IE Anti-Spyware" 8b524072d5b0f8d167211d603e54a468.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\CLSID = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}" 8b524072d5b0f8d167211d603e54a468.exe Key created \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\Search 8b524072d5b0f8d167211d603e54a468.exe - Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88} 8b524072d5b0f8d167211d603e54a468.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}\xxx = "xxx" 8b524072d5b0f8d167211d603e54a468.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}\InprocServer32 8b524072d5b0f8d167211d603e54a468.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sbmdl.dll" 8b524072d5b0f8d167211d603e54a468.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}\InprocServer32\ThreadingModel = "Apartment" 8b524072d5b0f8d167211d603e54a468.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID 8b524072d5b0f8d167211d603e54a468.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1652 8b524072d5b0f8d167211d603e54a468.exe 1652 8b524072d5b0f8d167211d603e54a468.exe 3764 sbsm.exe 3764 sbsm.exe 1652 8b524072d5b0f8d167211d603e54a468.exe 1652 8b524072d5b0f8d167211d603e54a468.exe 3764 sbsm.exe 3764 sbsm.exe 1652 8b524072d5b0f8d167211d603e54a468.exe 1652 8b524072d5b0f8d167211d603e54a468.exe 3764 sbsm.exe 3764 sbsm.exe 1652 8b524072d5b0f8d167211d603e54a468.exe 1652 8b524072d5b0f8d167211d603e54a468.exe 3764 sbsm.exe 3764 sbsm.exe 1652 8b524072d5b0f8d167211d603e54a468.exe 1652 8b524072d5b0f8d167211d603e54a468.exe 3764 sbsm.exe 3764 sbsm.exe 1652 8b524072d5b0f8d167211d603e54a468.exe 1652 8b524072d5b0f8d167211d603e54a468.exe 3764 sbsm.exe 3764 sbsm.exe 1652 8b524072d5b0f8d167211d603e54a468.exe 1652 8b524072d5b0f8d167211d603e54a468.exe 3764 sbsm.exe 3764 sbsm.exe 1652 8b524072d5b0f8d167211d603e54a468.exe 1652 8b524072d5b0f8d167211d603e54a468.exe 3764 sbsm.exe 3764 sbsm.exe 1652 8b524072d5b0f8d167211d603e54a468.exe 1652 8b524072d5b0f8d167211d603e54a468.exe 3764 sbsm.exe 3764 sbsm.exe 1652 8b524072d5b0f8d167211d603e54a468.exe 1652 8b524072d5b0f8d167211d603e54a468.exe 3764 sbsm.exe 3764 sbsm.exe 1652 8b524072d5b0f8d167211d603e54a468.exe 1652 8b524072d5b0f8d167211d603e54a468.exe 3764 sbsm.exe 3764 sbsm.exe 1652 8b524072d5b0f8d167211d603e54a468.exe 1652 8b524072d5b0f8d167211d603e54a468.exe 3764 sbsm.exe 3764 sbsm.exe 1652 8b524072d5b0f8d167211d603e54a468.exe 1652 8b524072d5b0f8d167211d603e54a468.exe 3764 sbsm.exe 3764 sbsm.exe 1652 8b524072d5b0f8d167211d603e54a468.exe 1652 8b524072d5b0f8d167211d603e54a468.exe 3764 sbsm.exe 3764 sbsm.exe 1652 8b524072d5b0f8d167211d603e54a468.exe 1652 8b524072d5b0f8d167211d603e54a468.exe 3764 sbsm.exe 3764 sbsm.exe 1652 8b524072d5b0f8d167211d603e54a468.exe 1652 8b524072d5b0f8d167211d603e54a468.exe 3764 sbsm.exe 3764 sbsm.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1652 wrote to memory of 3764 1652 8b524072d5b0f8d167211d603e54a468.exe 84 PID 1652 wrote to memory of 3764 1652 8b524072d5b0f8d167211d603e54a468.exe 84 PID 1652 wrote to memory of 3764 1652 8b524072d5b0f8d167211d603e54a468.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b524072d5b0f8d167211d603e54a468.exe"C:\Users\Admin\AppData\Local\Temp\8b524072d5b0f8d167211d603e54a468.exe"1⤵
- Adds policy Run key to start application
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\sbsm.exeC:\Users\Admin\AppData\Local\Temp\sbsm.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3764
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\sbmdl.dll
- Size 10KB
- SHA256 0e945c65424689770f5e286c1f0fc295c7fd97ca9a76be16cfc0c6e5f2435af3
- MD5 7754c0c5b899284d79d88fe6cf54576e
- SHA1 aaca9e37c87f75def6ec6054113d9b41c283c8a0
- SHA512 8d62e368f50138403af8b932acf902b8c43c722c87925296089c2ff159b9d2ac28f571af36f3c0392cbdac142e46ab5e94787d61f2ec31b821e79007c198ad96
- SSDEEP 192:H+AucMK6mJxLBHpvyEAnWD/6LPbHWEllFaNJhLkwcud2DH9VwGfctPsN:vUoLBH0hkGPbnzaNJawcudoD7U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\sbsm.exe
- Size 5KB
- SHA256 c986643c2f36467eb8123cacf9ca293e50eefb71de73486a109da1114ce02db9
- MD5 573d73b849a7ecb6b74fdf6603581a0d
- SHA1 33f81a4909d79ea499b66d43084888550eeb12ca
- SHA512 386c986fabe0e7c6bfd3c9b1b16cff3558880e18c2bd730b7b8e2deb8972a926194b0ca9231452d3a1bddbc22c741a93e98d5e9d565e821d53124791e8e54e68
- SSDEEP 48:K4NUkA6aDBMBzVEfTPJGNmo6JNJ30ml1WiIZJvMv/fyYIHhBE1Lzmi:jPaiNibIchJNJ3PlM3BMnfzIB6xmi
- MD5 SHA1 SHA512 SSDEEP