popup

Report - 5a5ad5743da1c888bf3b54ccc3e34ff5_SmartbridgeLauncherInstaller_7.exe

Gen1 Emotet njRAT backdoor Eredel Stealer Extended Generic Malware Suspicious_Script UPX Malicious Library Admin Tool (Sysinternals etc ...) Malicious Packer Downloader .NET framework(MSIL) ASPack OS Processor Check MZP Format PE File PE32 DLL icon CAB MS
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2023.07.05 15:08 Machine s1_win7_x6401
Filename 5a5ad5743da1c888bf3b54ccc3e34ff5_SmartbridgeLauncherInstaller_7.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
5
 Behavior Score
11.8
ZERO API
VT API (file) 1 detected (Generic ML PUA)
md5 5a5ad5743da1c888bf3b54ccc3e34ff5
sha256 fd17fd333847a2bd4da021b63728f87f44997631fbc76c7f25088b5c04eddd98
ssdeep 49152:uqe3f6F+bs8IuWKNIl8IKpKyGXNaPzU3+zOAbL8SffPMWrQ0Zk+:fSiszIZKuKpKyYeDPnPcMZ
imphash 5a594319a0d69dbc452e748bcf05892e
impfuzzy 48:ukHAxN9RJjD3vF9X1RfOz9O1hr8XNVXGSHAS4Fo/g/RvEj5MlVNb7q/cE:ukH+NbJj7N9X1tOz9Yhr8XbalVNb7CcE
  Network IP location

Signature (30cnts)

Level Description
watch Attempts to create or modify system certificates
watch Attempts to stop active services
watch Deletes a large number of files from the system indicative of ransomware
watch Installs itself for autorun at Windows startup
watch One or more of the buffers contains an embedded PE file
notice A process attempted to delay the analysis task.
notice A process created a hidden window
notice Allocates read-write-execute memory (usually to unpack itself)
notice Checks adapter addresses which can be used to detect virtual network interfaces
notice Checks for the Locally Unique Identifier on the system for a suspicious privilege
notice Checks whether any human activity is being performed by constantly checking whether the foreground window changed
notice Creates a suspicious process
notice Creates executable files on the filesystem
notice Drops a binary and executes it
notice Drops an executable to the user AppData folder
notice Executes one or more WMI queries
notice Expresses interest in specific running processes
notice File has been identified by one AntiVirus engine on VirusTotal as malicious
notice One or more potentially interesting buffers were extracted
notice Performs some HTTP requests
notice Queries for potentially installed applications
notice Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation
notice Searches running processes potentially to identify processes for sandbox evasion
notice Uses Windows utilities for basic Windows functionality
info Checks amount of memory in system
info Checks if process is being debugged by a debugger
info Collects information to fingerprint the system (MachineGuid
info Command line console output was observed
info Queries for the computername
info The executable contains unknown PE section names indicative of a packer (could be a false positive)

Rules (32cnts)

Level Name Description Collection
danger Win32_Trojan_Emotet_2_Zero Win32 Trojan Emotet binaries (download)
danger Win32_Trojan_Gen_1_0904B0_Zero Win32 Trojan Emotet binaries (download)
danger Win_Backdoor_njRAT_Zero Win Backdoor njRAT binaries (download)
danger Win_Eredel_Stealer_Extended_IN_Zero Win Eredel Stealer Extended binaries (download)
warning Generic_Malware_Zero Generic Malware binaries (download)
warning Generic_Malware_Zero Generic Malware binaries (upload)
warning Suspicious_Obfuscation_Script Suspicious obfuscation script binaries (download)
watch Admin_Tool_IN_Zero Admin Tool Sysinternals binaries (download)
watch ASPack_Zero ASPack packed file binaries (download)
watch Malicious_Library_Zero Malicious_Library binaries (download)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch Malicious_Packer_Zero Malicious Packer binaries (download)
watch Network_Downloader File Downloader binaries (download)
watch UPX_Zero UPX packed file binaries (download)
watch UPX_Zero UPX packed file binaries (upload)
watch Win32_Trojan_PWS_Net_1_Zero Win32 Trojan PWS .NET Azorult binaries (download)
info bmp_file_format bmp file format binaries (download)
info CAB_file_format CAB archive file binaries (download)
info icon_file_format icon file format binaries (download)
info Is_DotNET_DLL (no description) binaries (download)
info Is_DotNET_EXE (no description) binaries (download)
info IsDLL (no description) binaries (download)
info IsPE32 (no description) binaries (download)
info IsPE32 (no description) binaries (upload)
info IsPE64 (no description) binaries (download)
info Microsoft_Office_File_Zero Microsoft Office File binaries (download)
info mzp_file_format MZP(Delphi) file format binaries (download)
info mzp_file_format MZP(Delphi) file format binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (download)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (download)
info PE_Header_Zero PE File Signature binaries (upload)

Network (23cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl
whois
JP NTT-COMMUNICATIONS-2914 61.213.168.58
http://go.microsoft.com/fwlink/?prd=11324&pver=netfx&sbp=Net48Rel1&plcid=0x409&clcid=0x409&ar=04115.00&sar=amd64&o1=netfx_Patch_x64.msp
whois
US CMCS 104.67.193.97
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
whois
JP NTT-COMMUNICATIONS-2914 61.213.168.58
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl
whois
JP NTT-COMMUNICATIONS-2914 61.213.168.107
http://go.microsoft.com/fwlink/?prd=11324&pver=netfx&sbp=Net48Rel1&plcid=0x409&clcid=0x409&ar=03761.00&sar=amd64&o1=netfx_Full_x64.msi
whois
US COMCAST-20214 23.219.105.7
http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl
whois
JP NTT-COMMUNICATIONS-2914 61.213.168.107
http://go.microsoft.com/fwlink/?LinkId=862008
whois
US COMCAST-20214 23.219.105.7
http://go.microsoft.com/fwlink/?prd=11324&pver=netfx&sbp=Net48Rel1&plcid=0x409&clcid=0x409&ar=03761.00&sar=amd64&o1=netfx_Full.mzz
whois
US AKAMAI-AS 96.7.97.152
http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl
whois
US Akamai International B.V. 23.200.154.12
http://go.microsoft.com/fwlink/?LinkId=249120&clcid=0x409
whois
US COMCAST-20214 23.219.105.7
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
whois
US AKAMAI-AS 23.202.35.72
http://go.microsoft.com/fwlink/?prd=11324&pver=netfx&sbp=Net48Rel1&plcid=0x409&clcid=0x412&ar=03761.00&sar=amd64&o1=NDP48-x86-x64-AllOS-KOR.exe
whois
US AKAMAI-AS 96.7.97.152
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
whois
JP NTT-COMMUNICATIONS-2914 61.213.168.58
https://download.visualstudio.microsoft.com/download/pr/375f6a02-34bc-4b7d-ad8b-957789cf81e8/e4abafc291524af6e2b478f5d4857f0a/netfx_full_x64.msi
whois
US EDGECAST 192.229.232.200
https://download.visualstudio.microsoft.com/download/pr/c2ad65ab-bab3-4d24-ada4-aaf2ff0c1266/2a3f786c480c1122ff3696ba1ad9564b/ndp48-x86-x64-allos-kor.exe
whois
US EDGECAST 192.229.232.200
https://download.visualstudio.microsoft.com/download/pr/9acd2157-dc1e-41fc-9f4d-35d56fc49f6b/c84b7777456bf0dc89c15571ffdb8e49/netfx_full_x64.msi
whois
US EDGECAST 192.229.232.200
https://download.visualstudio.microsoft.com/download/pr/7afca223-55d2-470a-8edc-6a1739ae3252/f3ce41d8623e237d717257d9ae4cec5f/netfx_full_cab.exe
whois
US EDGECAST 192.229.232.200
https://download.visualstudio.microsoft.com/download/pr/887938c3-2a46-4069-a0b1-207035f1dd82/f0771dabc43ba46cfe9e3481840a7944/windows6.1-kb4019990-x64.cab
whois
US EDGECAST 192.229.232.200
https://download.visualstudio.microsoft.com/download/pr/2d6bb6b2-226a-4baa-bdec-798822606ff1/55e5b1321b16ab92f5e8fd2ea9169147/netfx_patch_x64.msp
whois
US EDGECAST 192.229.232.200
download.visualstudio.microsoft.com
whois
US EDGECAST 192.229.232.200
www.microsoft.com
whois
US Akamai International B.V. 23.200.154.12
23.39.217.133
whois
US Linknet-Fastnet ASN 23.39.217.133
192.229.232.200
whois
US EDGECAST 192.229.232.200

Suricata ids

SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)

PE API

IAT(Import Address Table) Library

kernel32.dll
 0x4c22e4 GetACP
 0x4c22e8 GetExitCodeProcess
 0x4c22ec LocalFree
 0x4c22f0 CloseHandle
 0x4c22f4 SizeofResource
 0x4c22f8 VirtualProtect
 0x4c22fc VirtualFree
 0x4c2300 GetFullPathNameW
 0x4c2304 ExitProcess
 0x4c2308 HeapAlloc
 0x4c230c GetCPInfoExW
 0x4c2310 RtlUnwind
 0x4c2314 GetCPInfo
 0x4c2318 GetStdHandle
 0x4c231c GetModuleHandleW
 0x4c2320 FreeLibrary
 0x4c2324 HeapDestroy
 0x4c2328 ReadFile
 0x4c232c CreateProcessW
 0x4c2330 GetLastError
 0x4c2334 GetModuleFileNameW
 0x4c2338 SetLastError
 0x4c233c FindResourceW
 0x4c2340 CreateThread
 0x4c2344 CompareStringW
 0x4c2348 LoadLibraryA
 0x4c234c ResetEvent
 0x4c2350 GetVersion
 0x4c2354 RaiseException
 0x4c2358 FormatMessageW
 0x4c235c SwitchToThread
 0x4c2360 GetExitCodeThread
 0x4c2364 GetCurrentThread
 0x4c2368 LoadLibraryExW
 0x4c236c LockResource
 0x4c2370 GetCurrentThreadId
 0x4c2374 UnhandledExceptionFilter
 0x4c2378 VirtualQuery
 0x4c237c VirtualQueryEx
 0x4c2380 Sleep
 0x4c2384 EnterCriticalSection
 0x4c2388 SetFilePointer
 0x4c238c LoadResource
 0x4c2390 SuspendThread
 0x4c2394 GetTickCount
 0x4c2398 GetFileSize
 0x4c239c GetStartupInfoW
 0x4c23a0 GetFileAttributesW
 0x4c23a4 InitializeCriticalSection
 0x4c23a8 GetThreadPriority
 0x4c23ac SetThreadPriority
 0x4c23b0 GetCurrentProcess
 0x4c23b4 VirtualAlloc
 0x4c23b8 GetSystemInfo
 0x4c23bc GetCommandLineW
 0x4c23c0 LeaveCriticalSection
 0x4c23c4 GetProcAddress
 0x4c23c8 ResumeThread
 0x4c23cc GetVersionExW
 0x4c23d0 VerifyVersionInfoW
 0x4c23d4 HeapCreate
 0x4c23d8 GetWindowsDirectoryW
 0x4c23dc VerSetConditionMask
 0x4c23e0 GetDiskFreeSpaceW
 0x4c23e4 FindFirstFileW
 0x4c23e8 GetUserDefaultUILanguage
 0x4c23ec lstrlenW
 0x4c23f0 QueryPerformanceCounter
 0x4c23f4 SetEndOfFile
 0x4c23f8 HeapFree
 0x4c23fc WideCharToMultiByte
 0x4c2400 FindClose
 0x4c2404 MultiByteToWideChar
 0x4c2408 LoadLibraryW
 0x4c240c SetEvent
 0x4c2410 CreateFileW
 0x4c2414 GetLocaleInfoW
 0x4c2418 GetSystemDirectoryW
 0x4c241c DeleteFileW
 0x4c2420 GetLocalTime
 0x4c2424 GetEnvironmentVariableW
 0x4c2428 WaitForSingleObject
 0x4c242c WriteFile
 0x4c2430 ExitThread
 0x4c2434 DeleteCriticalSection
 0x4c2438 TlsGetValue
 0x4c243c GetDateFormatW
 0x4c2440 SetErrorMode
 0x4c2444 IsValidLocale
 0x4c2448 TlsSetValue
 0x4c244c CreateDirectoryW
 0x4c2450 GetSystemDefaultUILanguage
 0x4c2454 EnumCalendarInfoW
 0x4c2458 LocalAlloc
 0x4c245c GetUserDefaultLangID
 0x4c2460 RemoveDirectoryW
 0x4c2464 CreateEventW
 0x4c2468 SetThreadLocale
 0x4c246c GetThreadLocale
comctl32.dll
 0x4c2474 InitCommonControls
version.dll
 0x4c247c GetFileVersionInfoSizeW
 0x4c2480 VerQueryValueW
 0x4c2484 GetFileVersionInfoW
user32.dll
 0x4c248c CreateWindowExW
 0x4c2490 TranslateMessage
 0x4c2494 CharLowerBuffW
 0x4c2498 CallWindowProcW
 0x4c249c CharUpperW
 0x4c24a0 PeekMessageW
 0x4c24a4 GetSystemMetrics
 0x4c24a8 SetWindowLongW
 0x4c24ac MessageBoxW
 0x4c24b0 DestroyWindow
 0x4c24b4 CharUpperBuffW
 0x4c24b8 CharNextW
 0x4c24bc MsgWaitForMultipleObjects
 0x4c24c0 LoadStringW
 0x4c24c4 ExitWindowsEx
 0x4c24c8 DispatchMessageW
oleaut32.dll
 0x4c24d0 SysAllocStringLen
 0x4c24d4 SafeArrayPtrOfIndex
 0x4c24d8 VariantCopy
 0x4c24dc SafeArrayGetLBound
 0x4c24e0 SafeArrayGetUBound
 0x4c24e4 VariantInit
 0x4c24e8 VariantClear
 0x4c24ec SysFreeString
 0x4c24f0 SysReAllocStringLen
 0x4c24f4 VariantChangeType
 0x4c24f8 SafeArrayCreate
netapi32.dll
 0x4c2500 NetWkstaGetInfo
 0x4c2504 NetApiBufferFree
advapi32.dll
 0x4c250c RegQueryValueExW
 0x4c2510 AdjustTokenPrivileges
 0x4c2514 LookupPrivilegeValueW
 0x4c2518 RegCloseKey
 0x4c251c OpenProcessToken
 0x4c2520 RegOpenKeyExW

EAT(Export Address Table) Library

0x454060 TMethodImplementationIntercept
0x40d0a0 __dbk_fcall_wrapper
0x4be63c dbkFCallWrapperAddr

Similarity measure (PE file only) - Checking for service failure