Overview
overview
7Static
static
7c70bf07e4e...68.exe
windows7-x64
7c70bf07e4e...68.exe
windows10-2004-x64
7$PLUGINSDI...ig.dll
windows7-x64
3$PLUGINSDI...ig.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...el.dll
windows7-x64
7$PLUGINSDI...el.dll
windows10-2004-x64
7$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows7-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
3SmartTool.dll
windows7-x64
6SmartTool.dll
windows10-2004-x64
6SmartTool.exe
windows7-x64
6SmartTool.exe
windows10-2004-x64
6adc.dll
windows7-x64
1adc.dll
windows10-2004-x64
1Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
13-03-2024 22:48
Behavioral task
behavioral1
Sample
c70bf07e4e32f9f33d1589ec9f4b1068.exe
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral2
Sample
c70bf07e4e32f9f33d1589ec9f4b1068.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/IpConfig.dll
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/IpConfig.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/SelfDel.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/SelfDel.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
SmartTool.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral14
Sample
SmartTool.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
SmartTool.exe
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral16
Sample
SmartTool.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
adc.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral18
Sample
adc.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
General
-
Target
SmartTool.exe
-
Size
42KB
-
MD5
d1859658605c11d217cb9d3e0540ca61
-
SHA1
1e2cb13bdbe6c6e6568a127258d7df38e67e26d5
-
SHA256
7b9fd7ea1c9dc710f67d3066369f51bf5fc4002062b356a2f53038b02c79fce0
-
SHA512
5b144619b2b4d97724fcbb850c8041f020f1b44494121ce42a8949280c8570fb8cd9213e7d467eb695364c6ae31e8b83e08e609e55473c933e0828fed3ad052f
-
SSDEEP
384:J5ifwRFKhAcAELTLCT5/M7Ygi6RYm59Pe18WJ07c4xJ4YJLuPkCQu:6wRlcvCT5+06CHJ0A4xJNLuD
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SmartTool = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SmartTool.exe" SmartTool.exe -
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2D891923-34B7-4186-9B47-752624535DC1} regsvr32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 46 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\ProgID\ = "SmartTool.SmartToolCtl.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SmartTool.SmartToolCtl\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SmartTool.SmartToolCtl\CurVer\ = "SmartTool.SmartToolCtl.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SmartTool.SmartToolCtl.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SmartTool.SmartToolCtl\ = "SmartToolCtl Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\ = "ISmartToolCtl" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\VersionIndependentProgID\ = "SmartTool.SmartToolCtl" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\TypeLib\ = "{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E97662C9-6D8A-47A6-BBF6-17730FEE28F0} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SmartTool.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SmartTool.SmartToolCtl regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SmartTool.SmartToolCtl\CLSID\ = "{2D891923-34B7-4186-9B47-752624535DC1}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\ = "ISmartToolCtl" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SmartTool.SmartToolCtl.1\ = "SmartToolCtl Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SmartTool.SmartToolCtl\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\TypeLib\ = "{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SmartTool.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SmartTool.SmartToolCtl.1\CLSID\ = "{2D891923-34B7-4186-9B47-752624535DC1}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}\1.0\ = "SmartTool 1.0 Type Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\TypeLib\ = "{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SmartTool.SmartToolCtl.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\ = "SmartToolCtl Class" regsvr32.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe 3408 SmartTool.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3408 wrote to memory of 4036 3408 SmartTool.exe 92 PID 3408 wrote to memory of 4036 3408 SmartTool.exe 92 PID 3408 wrote to memory of 4036 3408 SmartTool.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\SmartTool.exe"C:\Users\Admin\AppData\Local\Temp\SmartTool.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Users\Admin\AppData\Local\Temp\SmartTool.dll"2⤵
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:4036
-