Analysis
- max time kernel
151s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 19:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
inst_smt012.exe
Resource
win10v2004-20260513-en
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
inst_smt012.exe
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
General
- Target inst_smt012.exe
- Size 55.2MB
- Sample260804-xtfbzacm9s
- SHA256 8df4857952b9a077fcf6bc954b64db5ef84d4561625f6caa5cfec60269e5ad73
- MD5 4136d2a743ac59fc6b8f2b7019e8ef51
- SHA1 086a20d1e6a63c669ea4e63fb0a410774bb8abac
- SHA512 9ee7ace4570b3e05a943c553a35585abb81938c806cf63c7a7ba6b106cd6e15c9c174efc5224255059bb4d46115a3e21452146687289a4c839df62dcb0cee025
- SSDEEP 196608:KnnmbV2qWwRNTc+u1aZfO8pP+QDhb6Z/LzEnSQ5Ps61:sSRe9QDV
- TLSH T1CCC78406F702899AD4799338488B4F91B372ECF14AB6972323B8733D2EFA35C5E91545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 260 fqAK92.exe - Loads dropped DLL 1 IoCs
pid Process 260 fqAK92.exe - Suspicious behavior: EnumeratesProcesses 38 IoCs
pid Process 4136 inst_smt012.exe 4136 inst_smt012.exe 4136 inst_smt012.exe 4136 inst_smt012.exe 4136 inst_smt012.exe 4136 inst_smt012.exe 4136 inst_smt012.exe 4136 inst_smt012.exe 4136 inst_smt012.exe 4136 inst_smt012.exe 4136 inst_smt012.exe 4136 inst_smt012.exe 4136 inst_smt012.exe 4136 inst_smt012.exe 4136 inst_smt012.exe 4136 inst_smt012.exe 4136 inst_smt012.exe 4136 inst_smt012.exe 4136 inst_smt012.exe 4136 inst_smt012.exe 4136 inst_smt012.exe 4136 inst_smt012.exe 4136 inst_smt012.exe 4136 inst_smt012.exe 4136 inst_smt012.exe 4136 inst_smt012.exe 4136 inst_smt012.exe 4136 inst_smt012.exe 4136 inst_smt012.exe 4136 inst_smt012.exe 4136 inst_smt012.exe 4136 inst_smt012.exe 260 fqAK92.exe 260 fqAK92.exe 260 fqAK92.exe 260 fqAK92.exe 260 fqAK92.exe 260 fqAK92.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 808 Process not Found 808 Process not Found
Processes
-
C:\Users\Admin\AppData\Local\Temp\inst_smt012.exe"C:\Users\Admin\AppData\Local\Temp\inst_smt012.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4136
-
C:\Users\Public\gmIPBQ\fqAK92.exe"C:\Users\Public\gmIPBQ\fqAK92.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:260
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Public\gmIPBQ\UxEnhance64.dll
- Size 3.1MB
- SHA256 68933af0307ad0f3aceb5819fd2f01e2d12c4a1fd3b305c2376f61871bd979be
- MD5 92b900d26598f1cb452dd17555504d27
- SHA1 edcd81c0b54ae3b977fc99d0c174143b70c4b49d
- SHA512 582a67fc40f5e860eefb91a5077a9bc3f4c794615d1aebf70bb241d2cb15de312c9fdfe75113a5312968147ecc7442694350108add118261f16d33d6cc1bd3ef
- SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+p:P9m29xx3Tiqt06ox6+z2rNNrKop
- TLSH T121E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\gmIPBQ\adoresd.dat
- Size 4.7MB
- SHA256 b503b280913d60fead48e3bfeba70f302b2c68d8f55b517c00bec170918154c0
- MD5 1fd5040e8fa5af105728df9430518fc0
- SHA1 ce3486d3640dade296d285bdb0fcbd6daeef00c6
- SHA512 dfbf7231396d6ae8addf13edf3ae3d8c8330132dbd251d349d4e77d362f1e833023fe5d2ba16c34db9cedef989aeb77dc319890db3069d43e32bf49fb4250076
- SSDEEP 98304:9mu1SwODpRGIRdXEMZYe6rFLoTTpMk6ZGvQv0Ss2i+XZXea1v5WZd8uCp:Yu1SwOflfZPF6Ma0bsoa5+qd
- TLSH T1913633368AE6F5C7E35B2A0AF36888DD12B0B7AD6E9D75C24AF070145DB30CE9015BC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\gmIPBQ\fqAK92.exe
- Size 135KB
- SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
- MD5 9ec587911e501b73b7cf09f05d0ae17d
- SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
- SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
- SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
- TLSH T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\gmIPBQ\msadox.tb
- Size 8KB
- SHA256 f97ed7ded32c9b47cf5cceb853f69a27d6cf0f65c286f3ff06a144a002fad204
- MD5 d2f92527f9783f979528b42eb5de9913
- SHA1 09ae82a63a8a96cba37eaa1550517cb424ecfc7d
- SHA512 e5e2b9b11fa071a06abe6d3d084c1d714386bc8d32af21f9747ecd13de869568c1f0890ddd8ed43171fa4a1d71817545d0571a6d228e39f2ef34948fa269b7d5
- SSDEEP 192:MqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:MsZqZOXQ3uqvR2Kfzp
- TLSH T194029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
- MD5 SHA1 SHA512 SSDEEP TLSH