Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
04/02/2024, 04:45
Behavioral task
behavioral1
Sample
8e3f3c50ed832b76c5668fcf168182b1.exe
Resource
win7-20231129-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
8e3f3c50ed832b76c5668fcf168182b1.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
8e3f3c50ed832b76c5668fcf168182b1.exe
-
Size
18KB
-
MD5
8e3f3c50ed832b76c5668fcf168182b1
-
SHA1
40783e25e50dafd21ffd4f465839d39d26afcb7b
-
SHA256
e2b0f388e0013afe05115a79d0f095d9cdb35d7ea7d61edd0ffc29046fce2252
-
SHA512
452c1a8dde585d6e8095c64ffcd549ba21ab9891ee942b687251287d71db62888139025f551d55a228994c283225532891effaec35fe5dc1220ded87ce9670b7
-
SSDEEP
384:vyO/pImTheG/f94t6ARtRYN8fyJ6kNT7rQUSZL6uWGKRGZdpgH6pdWaNJawcudoD:v//GmsG/Gt6qYN3NTnVSZX4KIH6ppnbl
Score
8/10
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\explorer\run 8e3f3c50ed832b76c5668fcf168182b1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\start = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8e3f3c50ed832b76c5668fcf168182b1.exe" 8e3f3c50ed832b76c5668fcf168182b1.exe -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000700000002323a-2.dat acprotect -
Executes dropped EXE 1 IoCs
pid Process 1988 sbsm.exe -
Loads dropped DLL 1 IoCs
pid Process 920 8e3f3c50ed832b76c5668fcf168182b1.exe -
resource yara_rule behavioral2/memory/920-0-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/files/0x000700000002323a-2.dat upx behavioral2/memory/920-10-0x0000000000400000-0x000000000040D000-memory.dmp upx -
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6860A44B-5D3E-433D-A7B5-D517F810D0E7} 8e3f3c50ed832b76c5668fcf168182b1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6860A44B-5D3E-433D-A7B5-D517F810D0E7}\ 8e3f3c50ed832b76c5668fcf168182b1.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 8e3f3c50ed832b76c5668fcf168182b1.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\CLSID = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}" 8e3f3c50ed832b76c5668fcf168182b1.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Search 8e3f3c50ed832b76c5668fcf168182b1.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main 8e3f3c50ed832b76c5668fcf168182b1.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302} 8e3f3c50ed832b76c5668fcf168182b1.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}\URL = "http://www.searchinggate.com/index.php?b=1&t=0&q={searchTerms}" 8e3f3c50ed832b76c5668fcf168182b1.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\SearchScopes 8e3f3c50ed832b76c5668fcf168182b1.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}" 8e3f3c50ed832b76c5668fcf168182b1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E} 8e3f3c50ed832b76c5668fcf168182b1.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}\DisplayName = "Search" 8e3f3c50ed832b76c5668fcf168182b1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\MenuText = "IE Anti-Spyware" 8e3f3c50ed832b76c5668fcf168182b1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\Exec = "http://www.safeiegate.com/redirect.php" 8e3f3c50ed832b76c5668fcf168182b1.exe -
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{6860A44B-5D3E-433D-A7B5-D517F810D0E7} 8e3f3c50ed832b76c5668fcf168182b1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6860A44B-5D3E-433D-A7B5-D517F810D0E7}\xxx = "xxx" 8e3f3c50ed832b76c5668fcf168182b1.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{6860A44B-5D3E-433D-A7B5-D517F810D0E7}\InprocServer32 8e3f3c50ed832b76c5668fcf168182b1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6860A44B-5D3E-433D-A7B5-D517F810D0E7}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sbmdl.dll" 8e3f3c50ed832b76c5668fcf168182b1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6860A44B-5D3E-433D-A7B5-D517F810D0E7}\InprocServer32\ThreadingModel = "Apartment" 8e3f3c50ed832b76c5668fcf168182b1.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID 8e3f3c50ed832b76c5668fcf168182b1.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 920 8e3f3c50ed832b76c5668fcf168182b1.exe 920 8e3f3c50ed832b76c5668fcf168182b1.exe 1988 sbsm.exe 1988 sbsm.exe 920 8e3f3c50ed832b76c5668fcf168182b1.exe 920 8e3f3c50ed832b76c5668fcf168182b1.exe 1988 sbsm.exe 1988 sbsm.exe 920 8e3f3c50ed832b76c5668fcf168182b1.exe 920 8e3f3c50ed832b76c5668fcf168182b1.exe 1988 sbsm.exe 1988 sbsm.exe 920 8e3f3c50ed832b76c5668fcf168182b1.exe 920 8e3f3c50ed832b76c5668fcf168182b1.exe 1988 sbsm.exe 1988 sbsm.exe 920 8e3f3c50ed832b76c5668fcf168182b1.exe 920 8e3f3c50ed832b76c5668fcf168182b1.exe 1988 sbsm.exe 1988 sbsm.exe 920 8e3f3c50ed832b76c5668fcf168182b1.exe 920 8e3f3c50ed832b76c5668fcf168182b1.exe 1988 sbsm.exe 1988 sbsm.exe 920 8e3f3c50ed832b76c5668fcf168182b1.exe 920 8e3f3c50ed832b76c5668fcf168182b1.exe 1988 sbsm.exe 1988 sbsm.exe 920 8e3f3c50ed832b76c5668fcf168182b1.exe 920 8e3f3c50ed832b76c5668fcf168182b1.exe 1988 sbsm.exe 1988 sbsm.exe 920 8e3f3c50ed832b76c5668fcf168182b1.exe 920 8e3f3c50ed832b76c5668fcf168182b1.exe 1988 sbsm.exe 1988 sbsm.exe 920 8e3f3c50ed832b76c5668fcf168182b1.exe 920 8e3f3c50ed832b76c5668fcf168182b1.exe 1988 sbsm.exe 1988 sbsm.exe 920 8e3f3c50ed832b76c5668fcf168182b1.exe 920 8e3f3c50ed832b76c5668fcf168182b1.exe 1988 sbsm.exe 1988 sbsm.exe 920 8e3f3c50ed832b76c5668fcf168182b1.exe 920 8e3f3c50ed832b76c5668fcf168182b1.exe 1988 sbsm.exe 1988 sbsm.exe 920 8e3f3c50ed832b76c5668fcf168182b1.exe 920 8e3f3c50ed832b76c5668fcf168182b1.exe 1988 sbsm.exe 1988 sbsm.exe 920 8e3f3c50ed832b76c5668fcf168182b1.exe 920 8e3f3c50ed832b76c5668fcf168182b1.exe 1988 sbsm.exe 1988 sbsm.exe 920 8e3f3c50ed832b76c5668fcf168182b1.exe 920 8e3f3c50ed832b76c5668fcf168182b1.exe 1988 sbsm.exe 1988 sbsm.exe 920 8e3f3c50ed832b76c5668fcf168182b1.exe 920 8e3f3c50ed832b76c5668fcf168182b1.exe 1988 sbsm.exe 1988 sbsm.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 920 wrote to memory of 1988 920 8e3f3c50ed832b76c5668fcf168182b1.exe 34 PID 920 wrote to memory of 1988 920 8e3f3c50ed832b76c5668fcf168182b1.exe 34 PID 920 wrote to memory of 1988 920 8e3f3c50ed832b76c5668fcf168182b1.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e3f3c50ed832b76c5668fcf168182b1.exe"C:\Users\Admin\AppData\Local\Temp\8e3f3c50ed832b76c5668fcf168182b1.exe"1⤵
- Adds policy Run key to start application
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Users\Admin\AppData\Local\Temp\sbsm.exeC:\Users\Admin\AppData\Local\Temp\sbsm.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1988
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD5604e2fb38baffacd39c436cf3d736b66
SHA1776bc57cd88b655da42aef3ec2accddd03da7cdd
SHA25610995d6958fd5ff5827319e793391a3a1be1d33bf85f572dcaccab8f4ced5c17
SHA51248b388af886f8d171983557443e5b11d5d4cc0a42ad92233af2948c87ed595f76532a77dba6c0fb50b2bd437f7e18bc227be26d8eb66a52bc7b1993e70d7b00d
-
Filesize
5KB
MD50243158b002082798dba23cca4eddff8
SHA112ec97521c9ed8cd21b20d0f334e98a9651cfd14
SHA2567134d7fafb1ebc607792dbda0a407a49344fd7e4fc230b87e44fe8df5e00f0eb
SHA512f2a76a64258997b2298e91235086ffeb379ebe20b204b64328c8be50e35450984a987e059e5531c807c4b94be97b32c9a304ed36971c027b07014ad0d5e0212d