Overview

overview

8

Static

static

3

smert.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    15s
  • max time network
    20s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-07-2024 05:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    smert.exe

  • Size

    138KB

  • MD5

    f9c0394067f1bd2c14a9b0181457c9d0

  • SHA1

    69886c797577e217b47781a63f847252ba0565a3

  • SHA256

    a3137c9fffca3cc28da3732fe4fcbb18624cf48b55f4c08b6a880f7b58f5aa63

  • SHA512

    406b6cdf2a0d52193d611adaa72a9d96a588797a725b4648ebef21cb4dbcd7c74efecd397006db34d05226882a7f3d62d5f627aa41f3e84297d658b3ba06a674

  • SSDEEP

    3072:2+bgzBoKPCgtO/B1rYT6YtxeB8Nz/B90AOqq:2ciPCg0/BuTTa8NLA

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 8 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\smert.exe
    "C:\Users\Admin\AppData\Local\Temp\smert.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2204
    • C:\Users\Admin\AppData\Local\Temp\smert.exe
      "C:\Users\Admin\AppData\Local\Temp\smert.exe" --food
      2⤵
      • Drops file in Drivers directory
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      PID:448
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
    1⤵
    • Drops file in System32 directory
    • Modifies data under HKEY_USERS
    PID:3412

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\Documents\README.txt
    Filesize

    7B

    MD5

    b73bf7d3ba1a517644661bc4bcd85f9a

    SHA1

    fedd18797811a4af659678ea5db618f8dc91480b

    SHA256

    05ade08fcfb104f40b2536a14dfcd6e916d643f5cf8044b19028b607ae8f4908

    SHA512

    c57f2664de2758175f245932b24a51518b61e5987170c835a2b914a0cbe6f01a9078b97800237e6a402b3a0331f47b91c28ccb6948599b901e3a49695a57ac31

    Download Submit

  • memory/3412-663-0x00000165B9C40000-0x00000165B9C50000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3412-669-0x00000165B9CA0000-0x00000165B9CB0000-memory.dmp

    Filesize

    64KB

    Download