Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
05/02/2024, 14:58
Behavioral task
behavioral1
Sample
924a69436641aa68fffe8694bccbee42.exe
Resource
win7-20231215-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
924a69436641aa68fffe8694bccbee42.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target 924a69436641aa68fffe8694bccbee42.exe
- Size 29KB
- Sample240205-scfh7acfak
- SHA256 733f311968ab08783285407c968c7b559b7228e1b14349aba10184be9fad23e0
- MD5 924a69436641aa68fffe8694bccbee42
- SHA1 90e9d6d2b9bbb0f1349669c2c96afd4b613b18ee
- SHA512 1d50c646e2ead96c49a0f061875f6cab32547774c9a106f9808b673432c38d34a2f109c19c57e8d42f59be2c6d98181827795d6821d28006d0cff50274d78e27
- SSDEEP 768:UJUZemRHLdujPy5Zy3pHmi9oJQCDB/aPTYwZu5DkSnF:9Im5pcqk9v9oJQ4ibYwCDkkF
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\explorer\run sbmntr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\start = "C:\\Program Files (x86)\\NetProject\\sbmntr.exe" sbmntr.exe - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x0006000000023223-7.dat acprotect - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation 924a69436641aa68fffe8694bccbee42.exe - Executes dropped EXE 2 IoCs
pid Process 1188 sbmntr.exe 2728 sbsm.exe - Loads dropped DLL 1 IoCs
pid Process 1188 sbmntr.exe -
resource yara_rule behavioral2/memory/2892-0-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/files/0x000700000002321c-3.dat upx behavioral2/memory/1188-4-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/files/0x0006000000023223-7.dat upx behavioral2/files/0x0006000000023226-15.dat upx behavioral2/memory/2728-16-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/2892-20-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1188-22-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/2728-23-0x0000000000400000-0x0000000000408000-memory.dmp upx - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{99BA268B-4021-4739-9945-3C774217FE75} sbmntr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{99BA268B-4021-4739-9945-3C774217FE75}\ sbmntr.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects sbmntr.exe - Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files (x86)\NetProject\sbsm.exe sbmntr.exe File created C:\Program Files (x86)\NetProject\sbmntr.exe 924a69436641aa68fffe8694bccbee42.exe File created C:\Program Files (x86)\NetProject\sbmdl.dll sbmntr.exe File created C:\Program Files (x86)\NetProject\sbun.exe 924a69436641aa68fffe8694bccbee42.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E} sbmntr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\MenuText = "IE Anti-Spyware" sbmntr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\CLSID = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}" sbmntr.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}\DisplayName = "Search" sbmntr.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}\URL = "http://www.searchesopen.com/index.php?b=1&t=0&q={searchTerms}" sbmntr.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}" sbmntr.exe Key created \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Internet Explorer\Search sbmntr.exe Key created \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Internet Explorer\Main sbmntr.exe Key created \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302} sbmntr.exe Key created \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Internet Explorer\SearchScopes sbmntr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\Exec = "http://www.ietoolpro.com/redirect.php" sbmntr.exe - Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID sbmntr.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{99BA268B-4021-4739-9945-3C774217FE75} sbmntr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99BA268B-4021-4739-9945-3C774217FE75}\xxx = "xxx" sbmntr.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{99BA268B-4021-4739-9945-3C774217FE75}\InprocServer32 sbmntr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99BA268B-4021-4739-9945-3C774217FE75}\InprocServer32\ = "C:\\Program Files (x86)\\NetProject\\sbmdl.dll" sbmntr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99BA268B-4021-4739-9945-3C774217FE75}\InprocServer32\ThreadingModel = "Apartment" sbmntr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2892 924a69436641aa68fffe8694bccbee42.exe 2892 924a69436641aa68fffe8694bccbee42.exe 1188 sbmntr.exe 1188 sbmntr.exe 2728 sbsm.exe 2728 sbsm.exe 1188 sbmntr.exe 1188 sbmntr.exe 2728 sbsm.exe 2728 sbsm.exe 1188 sbmntr.exe 1188 sbmntr.exe 2728 sbsm.exe 2728 sbsm.exe 1188 sbmntr.exe 1188 sbmntr.exe 2728 sbsm.exe 2728 sbsm.exe 1188 sbmntr.exe 1188 sbmntr.exe 2728 sbsm.exe 2728 sbsm.exe 1188 sbmntr.exe 1188 sbmntr.exe 2728 sbsm.exe 2728 sbsm.exe 1188 sbmntr.exe 1188 sbmntr.exe 2728 sbsm.exe 2728 sbsm.exe 1188 sbmntr.exe 1188 sbmntr.exe 2728 sbsm.exe 2728 sbsm.exe 1188 sbmntr.exe 1188 sbmntr.exe 2728 sbsm.exe 2728 sbsm.exe 1188 sbmntr.exe 1188 sbmntr.exe 2728 sbsm.exe 2728 sbsm.exe 1188 sbmntr.exe 1188 sbmntr.exe 2728 sbsm.exe 2728 sbsm.exe 1188 sbmntr.exe 1188 sbmntr.exe 2728 sbsm.exe 2728 sbsm.exe 1188 sbmntr.exe 1188 sbmntr.exe 2728 sbsm.exe 2728 sbsm.exe 1188 sbmntr.exe 1188 sbmntr.exe 2728 sbsm.exe 2728 sbsm.exe 1188 sbmntr.exe 1188 sbmntr.exe 2728 sbsm.exe 2728 sbsm.exe 1188 sbmntr.exe 1188 sbmntr.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2892 wrote to memory of 1188 2892 924a69436641aa68fffe8694bccbee42.exe 84 PID 2892 wrote to memory of 1188 2892 924a69436641aa68fffe8694bccbee42.exe 84 PID 2892 wrote to memory of 1188 2892 924a69436641aa68fffe8694bccbee42.exe 84 PID 1188 wrote to memory of 2728 1188 sbmntr.exe 85 PID 1188 wrote to memory of 2728 1188 sbmntr.exe 85 PID 1188 wrote to memory of 2728 1188 sbmntr.exe 85 PID 2892 wrote to memory of 2220 2892 924a69436641aa68fffe8694bccbee42.exe 86 PID 2892 wrote to memory of 2220 2892 924a69436641aa68fffe8694bccbee42.exe 86 PID 2892 wrote to memory of 2220 2892 924a69436641aa68fffe8694bccbee42.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\924a69436641aa68fffe8694bccbee42.exe"C:\Users\Admin\AppData\Local\Temp\924a69436641aa68fffe8694bccbee42.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Program Files (x86)\NetProject\sbmntr.exe"C:\Program Files (x86)\NetProject\sbmntr.exe"2⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Program Files (x86)\NetProject\sbsm.exe"C:\Program Files (x86)\NetProject\sbsm.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2728
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\awer0.bat" "2⤵PID:2220
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\NetProject\sbmdl.dll
- Size 8KB
- SHA256 946990b81856ecc9f11a7d299690e523e5580bbe46eb94c7f940b07f116c7e8e
- MD5 317b1376f15dbbf883c8e78f7633f1ca
- SHA1 76fc1f65f3b04cc600850bad28b0f48ae104be6e
- SHA512 cb2f22b52a192dfa7221e0716aac0f304abfb587efbf5d0cf7de3b55487afc606f6d648a9aae825633390d9078b8198504d64a836f8914b3db39426795102aa3
- SSDEEP 192:hffKRhtPdz/Q8Hs+hW7ldvX1D44Z6kWzYZuKcBr/U6vzBdlHS:ViRf5/QkhW7HvX1Dd1WzYbCU6vdd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\NetProject\sbmntr.exe
- Size 18KB
- SHA256 ce1ba4479c24e1aee19664ecae0eff46c1b04d4ab965186f17e93669161330c9
- MD5 6e3dee6a96857f612e1ff6811425beff
- SHA1 8130d6e3990492bb492c550ae71bf3d1368350a6
- SHA512 480f8e6c652c9b46506c67fee429d39f1badf9419ba65c2250f8224cd541555fbd2da10b2349592eed3241a1bb5194f8e719ed2350c01b300dca696001a41942
- SSDEEP 384:QDsoiRb1qu4Gyi+cL7da/teLm8skHuD5sB9fDqK3K4uV+Xs:QIRuFGSgJa/cxskOVsfDqK3Y+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\NetProject\sbsm.exe
- Size 5KB
- SHA256 b7ce5fdda3342472ddb7e9f0881c0f9f64e287269d4844608dbc1d1069ed046b
- MD5 2c9605b3b6130c6733323a4b2d94d943
- SHA1 11a78d7ef877ce8a6e8d1b7adf525fb754472ce8
- SHA512 25cdee3181870d73c9a7ed3cc05d7b9eb161d40fb870a85955335c922fd6750988f05ada25c0b8c57bd973c81c394c5a708be2b24d7e2844e419fdda68fa31d3
- SSDEEP 96:BibdFHRXRdMmS0c1S8JjMfzX92WzbzTnMcYo:B8hdvS11b6fzt3LDMY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\awer0.bat
- Size 274B
- SHA256 9d1bb5757da8c33b18c9f124395976df4ff099761641a117e2f1e5f02f152bdb
- MD5 8f620fa752758a037cb0d83e3ea38049
- SHA1 8dfc17af3334aded3ebe1c79d97ec032c6f758ce
- SHA512 acf5a6c7c7c03344d78e1858c4bd4c30fddef1a54cb76dbae6aceb53ca9215e325146c595cf867781506912095b2e20342190df95c2595ea557d09621ce2d19c
- MD5 SHA1 SHA512