Malware Analysis Report

2025-04-14 03:19

Sample ID 240613-d65b3swgkr
Target 38733650d0a929e36618e19035cdc1a57c00da44ba8f09eb2e03e1bb50bfc272
SHA256 38733650d0a929e36618e19035cdc1a57c00da44ba8f09eb2e03e1bb50bfc272
Tags
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

38733650d0a929e36618e19035cdc1a57c00da44ba8f09eb2e03e1bb50bfc272

Threat Level: Shows suspicious behavior

The file 38733650d0a929e36618e19035cdc1a57c00da44ba8f09eb2e03e1bb50bfc272 was found to be: Shows suspicious behavior.

Malicious Activity Summary


Loads dropped DLL

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Modifies system certificate store

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-13 03:38

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 03:38

Reported

2024-06-13 03:40

Platform

win7-20240220-en

Max time kernel

120s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\38733650d0a929e36618e19035cdc1a57c00da44ba8f09eb2e03e1bb50bfc272.exe"

Signatures

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 C:\Users\Admin\AppData\Local\Temp\38733650d0a929e36618e19035cdc1a57c00da44ba8f09eb2e03e1bb50bfc272.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\84C05F33983B4F73E870D6E0582A00696A2FC472 C:\Users\Admin\AppData\Local\Temp\38733650d0a929e36618e19035cdc1a57c00da44ba8f09eb2e03e1bb50bfc272.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\84C05F33983B4F73E870D6E0582A00696A2FC472\Blob = 03000000010000001400000084c05f33983b4f73e870d6e0582a00696a2fc4722000000001000000a7030000308203a33082028ba00302010202100083770212b5a5b1c1609728d61b629d300d06092a864886f70d01010b0500306a312b3029060355040b0c224372656174656420627920687474703a2f2f7777772e666964646c6572322e636f6d31183016060355040a0c0f444f5f4e4f545f54525553545f42433121301f06035504030c18444f5f4e4f545f54525553545f466964646c6572526f6f74301e170d3234303630363030303030305a170d3334303631333033333831385a306a312b3029060355040b0c224372656174656420627920687474703a2f2f7777772e666964646c6572322e636f6d31183016060355040a0c0f444f5f4e4f545f54525553545f42433121301f06035504030c18444f5f4e4f545f54525553545f466964646c6572526f6f7430820122300d06092a864886f70d01010105000382010f003082010a028201010087a2b5991c7ef99946ce236786981c22d471bfba1cbd56a608e5d61982df2753d4fbe4a5fe9eef5fd5dc6050574fb5b33448215a6bee821c96123fbd9d6ff14973175c624e9219f78801ad96739c00b024199497d99d89013c0205ba9212c9a7430346e128faf9d131329bab7fcdc4b73d7fc737702baedd069864a661ac6e9128c2eaffea9eef87f819f08cf09f460ea4d265569821c9b6d5e3b3d8a1d9ce8d357af41268ff475163c5658e4b7681e1967b0aefbb3770557110a572810de6baeae1817b387af5e4fc513fb09f958036f52a820ef704250ebdb75eafb70523ab253e7c3d3fb36c49fc0bd2c9088e2ea8d19b7dd2b80e7b29857a5255a9d1229f0203010001a345304330120603551d130101ff040830060101ff020100300e0603551d0f0101ff040403020204301d0603551d0e041604148cff63d87e0e3a4dd178f93f267b583a918d49c2300d06092a864886f70d01010b0500038201010004391b23aa25988676f73d539b9e192fbec89cb6d6fa19ffccdf6016267d2dba6d2c792e67f92393bf0ebb2ff1b64d535ce22dd85cd02b3194ba7f0ce6a3d8ecd8ad566f3cb627322d448122d957decc5a65c0e3968cf9c7c25b40e2039699239ce04d3327022ea73cb33285d1593bd848c5f695d8318f118d83cf01ee7da1256b9599ca12862236220958d9d062187d58f05bf1de7ce96e37e690fe3e55df26c5ea757efbe934545d94cbbc12738494ed1c3f2dd6163f16f430aa454ee522956c1b12a19f074b5e796a2891cc54fd760e8a06de0f583960c6ca309c5d413cfc9f3e688c013e15e6a09f094fbe38fb0ad92b76d62274697dd9b9d08b49143010 C:\Users\Admin\AppData\Local\Temp\38733650d0a929e36618e19035cdc1a57c00da44ba8f09eb2e03e1bb50bfc272.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 C:\Users\Admin\AppData\Local\Temp\38733650d0a929e36618e19035cdc1a57c00da44ba8f09eb2e03e1bb50bfc272.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\38733650d0a929e36618e19035cdc1a57c00da44ba8f09eb2e03e1bb50bfc272.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38733650d0a929e36618e19035cdc1a57c00da44ba8f09eb2e03e1bb50bfc272.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\38733650d0a929e36618e19035cdc1a57c00da44ba8f09eb2e03e1bb50bfc272.exe

"C:\Users\Admin\AppData\Local\Temp\38733650d0a929e36618e19035cdc1a57c00da44ba8f09eb2e03e1bb50bfc272.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.smartoba.life udp
HK 8.217.205.125:443 www.smartoba.life tcp

Files

\Users\Admin\AppData\Local\Temp\efd.dll

MD5 5df37d5f681e6510d70a7980ec1bd1ed
SHA1 4a6832c6ee35d6b834847a9c648edc028ea0d30f
SHA256 932cb9dd22637532df47ed17f529649d959a7115077820d7e856299321d53a4b
SHA512 2d13020417f9069a060561fefc2c3ee4519548b12ce0db4ece4447f6ad89e18c8677d8e89bc63cfe88a0145ed194c08dced82c5736e0b85d804dd7a0cb708d5c

memory/2184-82-0x0000000002900000-0x0000000002940000-memory.dmp

memory/2184-86-0x0000000003E50000-0x0000000003E5D000-memory.dmp

memory/2184-87-0x0000000074DD0000-0x0000000074DDD000-memory.dmp

\Users\Admin\AppData\Local\Temp\FiddlerCore4.dll

MD5 79fe5228b7ccdc88cf7ddba2893ea71f
SHA1 4313028e5354d66be81fd2103a16b16e1ad1a6f3
SHA256 5850d403352d76e7f7ebda93a7bff5ab1ea57c91a54a2f6c2cfaf1c9d356d55f
SHA512 f46380ccd2fcb8246206f176f17c1931d57c3bc1312c95e059cf9feab4bc392ad31fa6ffc6a1dac3b0bd70c5393ab1c2cf21729e357cb7c523d487dd92aacac3

memory/2184-91-0x0000000006E50000-0x0000000006ED2000-memory.dmp

\Users\Admin\AppData\Local\Temp\CertMaker.dll

MD5 eccc93a46c56da30635aab9946d3773a
SHA1 ebd3dc61655b938fbfc9371f8e3ba87e5c718caf
SHA256 476a9a6ccf39353ca004118829dda91ff771906ea18f5db7db9a73044dda3bd8
SHA512 4ad695ebeaa66cc19066431e86cd1064d0ac359733452effac36dcb98aafd4a5c7ce31925baaf33964520daf4e78718bf6a2294fd323ee33f1e8eddd311cca5c

memory/2184-95-0x0000000004530000-0x000000000453E000-memory.dmp

memory/2184-100-0x0000000004530000-0x000000000453E000-memory.dmp

\Users\Admin\AppData\Local\Temp\BCMakeCert.dll

MD5 5d895d1c6cee56d206b6cd973479638d
SHA1 08fa15d13454b1113d3818133f7a10f3cb3dd451
SHA256 bcfc362b42422cede445c8a119d454484b3842eb808b7ddf1b5aeb7242e06abb
SHA512 8f2b3b76b84fc62b4f8660e4b6e32510c70db5b00ddccfcf4a41a1c5416b974b282cb375b60222884f3c04e9e97cf6f86223f93cadf3d45ebc641c6d703f077c

memory/2184-104-0x0000000006EE0000-0x0000000006F5A000-memory.dmp

memory/2184-110-0x0000000002900000-0x0000000002940000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 03:38

Reported

2024-06-13 03:40

Platform

win10v2004-20240226-en

Max time kernel

141s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\38733650d0a929e36618e19035cdc1a57c00da44ba8f09eb2e03e1bb50bfc272.exe"

Signatures

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\32987D8F9D3AC640DDD79C53F1200353F2319D76 C:\Users\Admin\AppData\Local\Temp\38733650d0a929e36618e19035cdc1a57c00da44ba8f09eb2e03e1bb50bfc272.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\32987D8F9D3AC640DDD79C53F1200353F2319D76\Blob = 03000000010000001400000032987d8f9d3ac640ddd79c53f1200353f2319d762000000001000000a7030000308203a33082028ba003020102021000f0197fd5c3ff180cf87c1d3448f54b300d06092a864886f70d01010b0500306a312b3029060355040b0c224372656174656420627920687474703a2f2f7777772e666964646c6572322e636f6d31183016060355040a0c0f444f5f4e4f545f54525553545f42433121301f06035504030c18444f5f4e4f545f54525553545f466964646c6572526f6f74301e170d3234303630363030303030305a170d3334303631333033333834305a306a312b3029060355040b0c224372656174656420627920687474703a2f2f7777772e666964646c6572322e636f6d31183016060355040a0c0f444f5f4e4f545f54525553545f42433121301f06035504030c18444f5f4e4f545f54525553545f466964646c6572526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100830fa69a12a80e2787fe8ecd15f2b8e780b8b71415a8e7b9587bc13516379c28b6c97048880b04c74d6d0d74ff152da5975c856e2867d43b1d5575e583471fb4bba5702e1ac2008106f034ed6ae9677c46b4dfe8c7bc6d6becf1e5c45d53400e65b4b02d7b593021d796fa7b9d78acb78581b78ec93b6dec9bd8192ea7e0140ab8078d2eaa0cae45068bb0fa26504765830e7e7d38e65e0b3afbf557bfbfdf069869a75df0f174fee4324b7dde2b555a8e1c22571f20b50474e6f9ee3d9debd95a72b94193f62b6ea4cadb155fce7025c72b4f3695ce2ede878ddc73fe81c82e92b515d5907a1f356daeb2e514b3356e36aff07fb5e6552eb22f0c52c03cf21f0203010001a345304330120603551d130101ff040830060101ff020100300e0603551d0f0101ff040403020204301d0603551d0e041604148c3761661284a86c341855e16c17a9a93338b413300d06092a864886f70d01010b050003820101003b9914107dc992c6f26f1da772a21887ef9a8f01d26f7e0070eca2db3ab574ef91a6c0088fb18966cf7d340097cb3ea2db13fbcc7505657fdf3880c28d26e6c65f523199c43d23d9ceb6985e72c0fd5d541e6e4d838f0283aedbe063349d2796c72c53e631dfa731ca4a82845274df261563facba823f2a4265402e8d4717bc76caeab9321d29205ed9f92cd4428440a35f75da28ecce4a233d58f740b22bfa41ef2ed902239bc01e08be17a0b1c0366ff0fcc12c41313796cbe6a79ff001a45bdede44ad3fb905fe8e5f61082dd17da1c7a46015685aeb9643fe645fb0de2c73e3a92f30430271fbc50d7f74d6c1fffbe94587dbe19e891c7689463776b87ac C:\Users\Admin\AppData\Local\Temp\38733650d0a929e36618e19035cdc1a57c00da44ba8f09eb2e03e1bb50bfc272.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38733650d0a929e36618e19035cdc1a57c00da44ba8f09eb2e03e1bb50bfc272.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\38733650d0a929e36618e19035cdc1a57c00da44ba8f09eb2e03e1bb50bfc272.exe

"C:\Users\Admin\AppData\Local\Temp\38733650d0a929e36618e19035cdc1a57c00da44ba8f09eb2e03e1bb50bfc272.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5012 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
GB 96.16.110.114:80 tcp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 www.smartoba.life udp
HK 8.217.205.125:443 www.smartoba.life tcp
US 8.8.8.8:53 125.205.217.8.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 76.234.34.23.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
GB 142.250.187.234:443 tcp
N/A 127.0.0.1:8818 tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
N/A 127.0.0.1:8818 tcp
US 13.107.246.64:443 tcp
N/A 127.0.0.1:8818 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
N/A 127.0.0.1:8818 tcp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 16.173.189.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\efd.dll

MD5 5df37d5f681e6510d70a7980ec1bd1ed
SHA1 4a6832c6ee35d6b834847a9c648edc028ea0d30f
SHA256 932cb9dd22637532df47ed17f529649d959a7115077820d7e856299321d53a4b
SHA512 2d13020417f9069a060561fefc2c3ee4519548b12ce0db4ece4447f6ad89e18c8677d8e89bc63cfe88a0145ed194c08dced82c5736e0b85d804dd7a0cb708d5c

memory/1600-67-0x0000000002BA0000-0x0000000002BB0000-memory.dmp

memory/1600-68-0x000000007369E000-0x000000007369F000-memory.dmp

memory/1600-72-0x0000000003BA0000-0x0000000003BAD000-memory.dmp

memory/1600-73-0x0000000075440000-0x000000007544D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\FiddlerCore4.dll

MD5 79fe5228b7ccdc88cf7ddba2893ea71f
SHA1 4313028e5354d66be81fd2103a16b16e1ad1a6f3
SHA256 5850d403352d76e7f7ebda93a7bff5ab1ea57c91a54a2f6c2cfaf1c9d356d55f
SHA512 f46380ccd2fcb8246206f176f17c1931d57c3bc1312c95e059cf9feab4bc392ad31fa6ffc6a1dac3b0bd70c5393ab1c2cf21729e357cb7c523d487dd92aacac3

memory/1600-77-0x0000000005EA0000-0x0000000005F22000-memory.dmp

memory/1600-78-0x0000000005F40000-0x00000000064E4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BCMakeCert.dll

MD5 5d895d1c6cee56d206b6cd973479638d
SHA1 08fa15d13454b1113d3818133f7a10f3cb3dd451
SHA256 bcfc362b42422cede445c8a119d454484b3842eb808b7ddf1b5aeb7242e06abb
SHA512 8f2b3b76b84fc62b4f8660e4b6e32510c70db5b00ddccfcf4a41a1c5416b974b282cb375b60222884f3c04e9e97cf6f86223f93cadf3d45ebc641c6d703f077c

C:\Users\Admin\AppData\Local\Temp\CertMaker.dll

MD5 eccc93a46c56da30635aab9946d3773a
SHA1 ebd3dc61655b938fbfc9371f8e3ba87e5c718caf
SHA256 476a9a6ccf39353ca004118829dda91ff771906ea18f5db7db9a73044dda3bd8
SHA512 4ad695ebeaa66cc19066431e86cd1064d0ac359733452effac36dcb98aafd4a5c7ce31925baaf33964520daf4e78718bf6a2294fd323ee33f1e8eddd311cca5c

memory/1600-82-0x0000000005F30000-0x0000000005F3E000-memory.dmp

memory/1600-90-0x0000000006860000-0x00000000068DA000-memory.dmp

memory/1600-98-0x0000000002BA0000-0x0000000002BB0000-memory.dmp

memory/1600-99-0x000000007369E000-0x000000007369F000-memory.dmp