Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
12-02-2024 02:26
Behavioral task
behavioral1
Sample
95fef0c257d1c33e4921d1ed272b6027.exe
Resource
win7-20231129-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
95fef0c257d1c33e4921d1ed272b6027.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
95fef0c257d1c33e4921d1ed272b6027.exe
-
Size
31KB
-
MD5
95fef0c257d1c33e4921d1ed272b6027
-
SHA1
23903d45e95dc0869a92bfc7637b40411e57e037
-
SHA256
7fc4182ebf0b609a4a3ddecb7c53f9ffda1dad9c6fbe8a404ac1919c711449c8
-
SHA512
d2d57745359016c1004dfc55d4898aa97803efb790cd0717797524f622e5125ace3cee558e929e506388be8e40941e7b0411828943c6ac976a25324926d60fce
-
SSDEEP
768:vUCCHQwCFF4AEAe6tgyzs/vZVry4E7PLDdjnHnbcuyD7U:vUCCHQv7zYusnZV3QLprnouy8
Score
8/10
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\explorer\run sbmntr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\start = "C:\\Program Files (x86)\\NetProject\\sbmntr.exe" sbmntr.exe -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000800000001342b-15.dat acprotect -
Executes dropped EXE 2 IoCs
pid Process 1664 sbmntr.exe 2576 sbsm.exe -
Loads dropped DLL 5 IoCs
pid Process 2352 95fef0c257d1c33e4921d1ed272b6027.exe 2352 95fef0c257d1c33e4921d1ed272b6027.exe 1664 sbmntr.exe 1664 sbmntr.exe 1664 sbmntr.exe -
resource yara_rule behavioral1/memory/2352-0-0x0000000000400000-0x0000000000411000-memory.dmp upx behavioral1/files/0x000a0000000126e1-8.dat upx behavioral1/memory/2352-12-0x0000000000400000-0x0000000000411000-memory.dmp upx behavioral1/memory/1664-13-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral1/files/0x000800000001342b-15.dat upx behavioral1/memory/1664-26-0x0000000000400000-0x000000000040D000-memory.dmp upx -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7C109800-A5D5-438F-9640-18D17E168B88} sbmntr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{7C109800-A5D5-438F-9640-18D17E168B88}\ sbmntr.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects sbmntr.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files (x86)\NetProject\sbun.exe 95fef0c257d1c33e4921d1ed272b6027.exe File created C:\Program Files (x86)\NetProject\sbmdl.dll sbmntr.exe File created C:\Program Files (x86)\NetProject\sbsm.exe sbmntr.exe File created C:\Program Files (x86)\NetProject\sbmntr.exe 95fef0c257d1c33e4921d1ed272b6027.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302} sbmntr.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}" sbmntr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E} sbmntr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\Exec = "http://www.ieservicegate.com/redirect.php" sbmntr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\CLSID = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}" sbmntr.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Search sbmntr.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}\DisplayName = "Search" sbmntr.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}\URL = "http://www.gatetofind.com/index.php?b=1&t=0&q={searchTerms}" sbmntr.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes sbmntr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\MenuText = "IE Anti-Spyware" sbmntr.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main sbmntr.exe -
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}\InprocServer32 sbmntr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}\InprocServer32\ = "C:\\Program Files (x86)\\NetProject\\sbmdl.dll" sbmntr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}\InprocServer32\ThreadingModel = "Apartment" sbmntr.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID sbmntr.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88} sbmntr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}\xxx = "xxx" sbmntr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2352 95fef0c257d1c33e4921d1ed272b6027.exe 1664 sbmntr.exe 2576 sbsm.exe 1664 sbmntr.exe 2576 sbsm.exe 1664 sbmntr.exe 2576 sbsm.exe 1664 sbmntr.exe 2576 sbsm.exe 1664 sbmntr.exe 2576 sbsm.exe 1664 sbmntr.exe 2576 sbsm.exe 1664 sbmntr.exe 2576 sbsm.exe 1664 sbmntr.exe 2576 sbsm.exe 1664 sbmntr.exe 2576 sbsm.exe 1664 sbmntr.exe 2576 sbsm.exe 1664 sbmntr.exe 2576 sbsm.exe 1664 sbmntr.exe 2576 sbsm.exe 1664 sbmntr.exe 2576 sbsm.exe 1664 sbmntr.exe 2576 sbsm.exe 1664 sbmntr.exe 2576 sbsm.exe 1664 sbmntr.exe 2576 sbsm.exe 1664 sbmntr.exe 2576 sbsm.exe 1664 sbmntr.exe 2576 sbsm.exe 1664 sbmntr.exe 2576 sbsm.exe 1664 sbmntr.exe 2576 sbsm.exe 1664 sbmntr.exe 2576 sbsm.exe 1664 sbmntr.exe 2576 sbsm.exe 1664 sbmntr.exe 2576 sbsm.exe 1664 sbmntr.exe 2576 sbsm.exe 1664 sbmntr.exe 2576 sbsm.exe 1664 sbmntr.exe 2576 sbsm.exe 1664 sbmntr.exe 2576 sbsm.exe 1664 sbmntr.exe 2576 sbsm.exe 1664 sbmntr.exe 2576 sbsm.exe 1664 sbmntr.exe 2576 sbsm.exe 1664 sbmntr.exe 2576 sbsm.exe 1664 sbmntr.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2352 wrote to memory of 1664 2352 95fef0c257d1c33e4921d1ed272b6027.exe 28 PID 2352 wrote to memory of 1664 2352 95fef0c257d1c33e4921d1ed272b6027.exe 28 PID 2352 wrote to memory of 1664 2352 95fef0c257d1c33e4921d1ed272b6027.exe 28 PID 2352 wrote to memory of 1664 2352 95fef0c257d1c33e4921d1ed272b6027.exe 28 PID 1664 wrote to memory of 2576 1664 sbmntr.exe 29 PID 1664 wrote to memory of 2576 1664 sbmntr.exe 29 PID 1664 wrote to memory of 2576 1664 sbmntr.exe 29 PID 1664 wrote to memory of 2576 1664 sbmntr.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\95fef0c257d1c33e4921d1ed272b6027.exe"C:\Users\Admin\AppData\Local\Temp\95fef0c257d1c33e4921d1ed272b6027.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Program Files (x86)\NetProject\sbmntr.exe"C:\Program Files (x86)\NetProject\sbmntr.exe"2⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Program Files (x86)\NetProject\sbsm.exe"C:\Program Files (x86)\NetProject\sbsm.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2576
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD53e3ef49c846543a4b284d54bbe1dc70e
SHA1f1830871007ce7e6739d2d2a812a90f282a897a2
SHA25610e1da579988d54dbdc353254ca0bb39f6ec6017fa8fb3f72e784fcf16f40feb
SHA512a2fc16a39621ea29e0b11d8ae55c952fb411ffc0ef8dbaa72202fcea1e855499d3f7f1b81417e36911b651fe10067086a28287fe4b94015830470b9ba1b44259
-
Filesize
10KB
MD58ac5c4e5765360e409f6e7d60ee3d86f
SHA1027f9513ae003dc842533586a85947b7ce229247
SHA256feff23f82b0556b145acdd5ea3f4da2582abf6567f0d0ad54eb15bdfd15a9cf9
SHA5121cead8a5d55e6e88ff7676f3495688f59cb2991c562282f8a8d4bd7739e6d445d97b38cdb115b0e551e52f75aeeb224758a69d5439e97a179610402f411f611d
-
Filesize
5KB
MD5c28d57d1894f3b2efccee5b55689ced5
SHA14f3884dfa98121d1da4f3748084fd4437d1fae55
SHA2564c8207d5af11ea61a5bad1f8743a399596fb8768b73b8acd1bca65d310cf65a8
SHA51221049018685511e8942ffc3c7538f5987bba0b5cf5e22769e057379553526e8aedebf987c6e2775a7ef5a6ca2460c02b16fe0155ab3efbea2d9cf73767accc2f