Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
25/03/2024, 03:50
Behavioral task
behavioral1
Sample
dd2a27d5492ca0980d04f09baf446b18.exe
Resource
win7-20240319-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
dd2a27d5492ca0980d04f09baf446b18.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target dd2a27d5492ca0980d04f09baf446b18.exe
- Size 18KB
- Sample240325-edy52aac4s
- SHA256 81fd3972e4376e5d0553d8bdddd889b759b4ca396a37815f86ee7a4583642a95
- MD5 dd2a27d5492ca0980d04f09baf446b18
- SHA1 de1dabb1dc092eaddee4bdf9a35ab20e171383da
- SHA512 78e5ba061157453ce52549cd03050c92510f584b91550145d0b9b7ab43312c274489872bb98848d88c8ab2c7da503bf60520e67c7e23623702376f00bb25849e
- SSDEEP 384:cVlp3e2jIUhG/VgcgWqxIvG9caIVydSxDoiyEIaNJawcudoD7Uk:+vjIP/nkxqGyamydODgYnbcuyD7U
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\start = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dd2a27d5492ca0980d04f09baf446b18.exe" dd2a27d5492ca0980d04f09baf446b18.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\explorer\run dd2a27d5492ca0980d04f09baf446b18.exe - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000700000001e59e-2.dat acprotect - Executes dropped EXE 1 IoCs
pid Process 1532 sbsm.exe - Loads dropped DLL 1 IoCs
pid Process 1620 dd2a27d5492ca0980d04f09baf446b18.exe -
resource yara_rule behavioral2/memory/1620-0-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral2/files/0x000700000001e59e-2.dat upx behavioral2/memory/1620-5-0x0000000010000000-0x000000001000A000-memory.dmp upx behavioral2/memory/1620-10-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral2/memory/1620-12-0x0000000010000000-0x000000001000A000-memory.dmp upx - Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7C109800-A5D5-438F-9640-18D17E168B88} dd2a27d5492ca0980d04f09baf446b18.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7C109800-A5D5-438F-9640-18D17E168B88}\ dd2a27d5492ca0980d04f09baf446b18.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects dd2a27d5492ca0980d04f09baf446b18.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\CLSID = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}" dd2a27d5492ca0980d04f09baf446b18.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\Search dd2a27d5492ca0980d04f09baf446b18.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\Main dd2a27d5492ca0980d04f09baf446b18.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302} dd2a27d5492ca0980d04f09baf446b18.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\MenuText = "IE Anti-Spyware" dd2a27d5492ca0980d04f09baf446b18.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\Exec = "http://www.iefixgate.com/redirect.php" dd2a27d5492ca0980d04f09baf446b18.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}" dd2a27d5492ca0980d04f09baf446b18.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E} dd2a27d5492ca0980d04f09baf446b18.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}\DisplayName = "Search" dd2a27d5492ca0980d04f09baf446b18.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}\URL = "http://www.searchinggate.com/index.php?b=1&t=0&q={searchTerms}" dd2a27d5492ca0980d04f09baf446b18.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\SearchScopes dd2a27d5492ca0980d04f09baf446b18.exe - Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88} dd2a27d5492ca0980d04f09baf446b18.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}\xxx = "xxx" dd2a27d5492ca0980d04f09baf446b18.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}\InprocServer32 dd2a27d5492ca0980d04f09baf446b18.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sbmdl.dll" dd2a27d5492ca0980d04f09baf446b18.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}\InprocServer32\ThreadingModel = "Apartment" dd2a27d5492ca0980d04f09baf446b18.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID dd2a27d5492ca0980d04f09baf446b18.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1620 dd2a27d5492ca0980d04f09baf446b18.exe 1620 dd2a27d5492ca0980d04f09baf446b18.exe 1532 sbsm.exe 1532 sbsm.exe 1620 dd2a27d5492ca0980d04f09baf446b18.exe 1620 dd2a27d5492ca0980d04f09baf446b18.exe 1532 sbsm.exe 1532 sbsm.exe 1620 dd2a27d5492ca0980d04f09baf446b18.exe 1620 dd2a27d5492ca0980d04f09baf446b18.exe 1532 sbsm.exe 1532 sbsm.exe 1620 dd2a27d5492ca0980d04f09baf446b18.exe 1620 dd2a27d5492ca0980d04f09baf446b18.exe 1532 sbsm.exe 1532 sbsm.exe 1620 dd2a27d5492ca0980d04f09baf446b18.exe 1620 dd2a27d5492ca0980d04f09baf446b18.exe 1532 sbsm.exe 1532 sbsm.exe 1620 dd2a27d5492ca0980d04f09baf446b18.exe 1620 dd2a27d5492ca0980d04f09baf446b18.exe 1532 sbsm.exe 1532 sbsm.exe 1620 dd2a27d5492ca0980d04f09baf446b18.exe 1620 dd2a27d5492ca0980d04f09baf446b18.exe 1532 sbsm.exe 1532 sbsm.exe 1620 dd2a27d5492ca0980d04f09baf446b18.exe 1620 dd2a27d5492ca0980d04f09baf446b18.exe 1532 sbsm.exe 1532 sbsm.exe 1620 dd2a27d5492ca0980d04f09baf446b18.exe 1620 dd2a27d5492ca0980d04f09baf446b18.exe 1532 sbsm.exe 1532 sbsm.exe 1620 dd2a27d5492ca0980d04f09baf446b18.exe 1620 dd2a27d5492ca0980d04f09baf446b18.exe 1532 sbsm.exe 1532 sbsm.exe 1620 dd2a27d5492ca0980d04f09baf446b18.exe 1620 dd2a27d5492ca0980d04f09baf446b18.exe 1532 sbsm.exe 1532 sbsm.exe 1620 dd2a27d5492ca0980d04f09baf446b18.exe 1620 dd2a27d5492ca0980d04f09baf446b18.exe 1532 sbsm.exe 1532 sbsm.exe 1620 dd2a27d5492ca0980d04f09baf446b18.exe 1620 dd2a27d5492ca0980d04f09baf446b18.exe 1532 sbsm.exe 1532 sbsm.exe 1620 dd2a27d5492ca0980d04f09baf446b18.exe 1620 dd2a27d5492ca0980d04f09baf446b18.exe 1532 sbsm.exe 1532 sbsm.exe 1620 dd2a27d5492ca0980d04f09baf446b18.exe 1620 dd2a27d5492ca0980d04f09baf446b18.exe 1532 sbsm.exe 1532 sbsm.exe 1620 dd2a27d5492ca0980d04f09baf446b18.exe 1620 dd2a27d5492ca0980d04f09baf446b18.exe 1532 sbsm.exe 1532 sbsm.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1620 wrote to memory of 1532 1620 dd2a27d5492ca0980d04f09baf446b18.exe 89 PID 1620 wrote to memory of 1532 1620 dd2a27d5492ca0980d04f09baf446b18.exe 89 PID 1620 wrote to memory of 1532 1620 dd2a27d5492ca0980d04f09baf446b18.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd2a27d5492ca0980d04f09baf446b18.exe"C:\Users\Admin\AppData\Local\Temp\dd2a27d5492ca0980d04f09baf446b18.exe"1⤵
- Adds policy Run key to start application
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\sbsm.exeC:\Users\Admin\AppData\Local\Temp\sbsm.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1532
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\sbmdl.dll
- Size 10KB
- SHA256 3e6f02590be979de69d7d9692cfca2e4e28b0e4659c5bca31deb98a4a340c3bf
- MD5 99ec576fecc120f7d71e8182cb7c41df
- SHA1 b0efe368f2a9f1219fd58cd1c2333926ec11dbbd
- SHA512 598bdef38af8a0882fd5a0c3f63f3cbc09f7355a39736174aba835de651508f6835d1bcd0dd75500dc218ceca30625768319e749a7dd0fb335a203e14d130276
- SSDEEP 192:VJoIGhLsawOzp9JmJAPgOn2H1URPUxFFaNJhLkwcud2DH9VwGfctIQaN:JGhoWdmggOMdTaNJawcudoD7U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\sbsm.exe
- Size 5KB
- SHA256 a4416b4b7cd2b05d328b9904abddeca1a959547a223704c8a6187163346dd372
- MD5 e84c24eea5b70f0cb5c2a2c4d35f32ac
- SHA1 5fb351fc7bbeffd824e1a38fcc517eb0ea295fec
- SHA512 aad4729a3822363132857c36ed90f2129400233a4a58e02b2c258328425df824ade1f98529109fd6613a58a5da0732a7efea6bf01c14ae2160381ecdbc120bb4
- SSDEEP 96:MBghrsKQi9f520BN2bnqM3BqFnf7IBq6:kggJqyqGB+nTIBq6
- MD5 SHA1 SHA512 SSDEEP