File name:

SmartBridgeLauncher.exe

Full analysis: https://app.any.run/tasks/4bec42f8-b5e6-4520-91ee-9a2516e765d7
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: October 20, 2024, 11:22:44
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
loader
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

BD16EEB3F957029428186118C8C45D45

SHA1:

A6E27706A7163B2D97288DCF4C58640FC2561DB2

SHA256:

D6FA3E7294CAB1E6D50228CAA8C459A80A410C5A21F5D27CE3255091690C8B55

SSDEEP:

1536:pYGr1mFxQIAf0PJGPyapNV/fCQ5FZJHPom6WS8Dllzjom6WS8DlY1VPx0:/rYzUfe0fCQ5FbPBX7DLBX7Di1Jx0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • SmartBridge.exe (PID: 4476)

  • SUSPICIOUS

    • Potential Corporate Privacy Violation

      • SmartBridgeLauncher.exe (PID: 5328)

    • Process requests binary or script from the Internet

      • SmartBridgeLauncher.exe (PID: 5328)

    • Connects to unusual port

      • SmartBridgeLauncher.exe (PID: 5328)
      • Updater.exe (PID: 4316)
      • SmartBridge.exe (PID: 4476)

    • Executable content was dropped or overwritten

      • SmartBridgeLauncher.exe (PID: 5328)
      • SmartBridge.exe (PID: 4476)

    • Reads security settings of Internet Explorer

      • SmartBridgeLauncher.exe (PID: 5328)
      • Updater.exe (PID: 4316)

    • Malware-specific behavior: drops SQLite library (may be used to steal credentials)

      • SmartBridge.exe (PID: 4476)

  • INFO

    • Reads the computer name

      • SmartBridgeLauncher.exe (PID: 5328)
      • Updater.exe (PID: 4316)
      • SmartBridge.exe (PID: 4476)

    • Disables trace logs

      • SmartBridgeLauncher.exe (PID: 5328)
      • Updater.exe (PID: 4316)
      • SmartBridge.exe (PID: 4476)

    • Checks supported languages

      • SmartBridgeLauncher.exe (PID: 5328)
      • Updater.exe (PID: 4316)
      • SmartBridge.exe (PID: 4476)

    • Reads the machine GUID from the registry

      • SmartBridgeLauncher.exe (PID: 5328)
      • Updater.exe (PID: 4316)
      • SmartBridge.exe (PID: 4476)

    • Checks proxy server information

      • SmartBridgeLauncher.exe (PID: 5328)
      • Updater.exe (PID: 4316)
      • SmartBridge.exe (PID: 4476)

    • Reads the software policy settings

      • SmartBridgeLauncher.exe (PID: 5328)
      • Updater.exe (PID: 4316)
      • SmartBridge.exe (PID: 4476)

    • The process uses the downloaded file

      • SmartBridgeLauncher.exe (PID: 5328)
      • Updater.exe (PID: 4316)

    • Process checks computer location settings

      • SmartBridgeLauncher.exe (PID: 5328)
      • Updater.exe (PID: 4316)

    • Create files in a temporary directory

      • SmartBridge.exe (PID: 4476)

    • Sends debugging messages

      • SmartBridge.exe (PID: 4476)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2049:04:13 20:49:54+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 48
CodeSize: 47616
InitializedDataSize: 10752
UninitializedDataSize: -
EntryPoint: 0xd8b6
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.7.64
ProductVersionNumber: 1.0.7.64
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: Client Version=1.0764, Part Code=7, Registry Main Key=Software\SmartBridge, Regstry Main UUID Key=Software\SmartBridge_UUID, Basic URL Head=https://api.smartbridge.co.kr:1004/, Basic AD Config URL=start.php
CompanyName: Topstore
FileDescription: SmartBridge Launcher
FileVersion: 1.0.7.64
InternalName: SmartBridgeLauncher.exe
LegalCopyright: Topstore, All rights reserved.
LegalTrademarks: -
OriginalFileName: SmartBridgeLauncher.exe
ProductName: SmartBridge
ProductVersion: 1.0.7.64
AssemblyVersion: 1.0.7.64
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
123
Monitored processes
3
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start smartbridgelauncher.exe updater.exe smartbridge.exe

Process information

PID
CMD
Path
Indicators
Parent process
4316"C:\Users\admin\Desktop\Updater.exe" /iC:\Users\admin\Desktop\Updater.exe
SmartBridgeLauncher.exe
User:
admin
Company:
Topstore
Integrity Level:
MEDIUM
Description:
SmartBridge.Updater
Exit code:
0
Version:
1.0.7.64
Modules
Images
c:\users\admin\desktop\updater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
4476"C:\Users\admin\Desktop\SmartBridge.exe" /iC:\Users\admin\Desktop\SmartBridge.exe
Updater.exe
User:
admin
Company:
Topstore
Integrity Level:
MEDIUM
Description:
SmartBridge
Exit code:
4294967295
Version:
1.0.7.64
Modules
Images
c:\users\admin\desktop\smartbridge.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
5328"C:\Users\admin\Desktop\SmartBridgeLauncher.exe" C:\Users\admin\Desktop\SmartBridgeLauncher.exe
explorer.exe
User:
admin
Company:
Topstore
Integrity Level:
MEDIUM
Description:
SmartBridge Launcher
Exit code:
0
Version:
1.0.7.64
Modules
Images
c:\users\admin\desktop\smartbridgelauncher.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Total events
33 487
Read events
33 433
Write events
54
Delete events
0

Modification events

(PID) Process:(5328) SmartBridgeLauncher.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SmartBridgeLauncher_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(5328) SmartBridgeLauncher.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SmartBridgeLauncher_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(5328) SmartBridgeLauncher.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SmartBridgeLauncher_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(5328) SmartBridgeLauncher.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SmartBridgeLauncher_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(5328) SmartBridgeLauncher.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SmartBridgeLauncher_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(5328) SmartBridgeLauncher.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SmartBridgeLauncher_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(5328) SmartBridgeLauncher.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SmartBridgeLauncher_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(5328) SmartBridgeLauncher.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SmartBridgeLauncher_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(5328) SmartBridgeLauncher.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SmartBridgeLauncher_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(5328) SmartBridgeLauncher.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SmartBridgeLauncher_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
3
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
4476SmartBridge.exeC:\Users\admin\AppData\Local\Temp\Costura\0ED49870D250E64F245081CFB61DDE2D\32\sqlite.interop.dllexecutable
MD5:8BE215ABF1F36AA3D23555A671E7E3BE
SHA256:83F332EA9535814F18BE4EE768682ECC7720794AEDC30659EB165E46257A7CAE
5328SmartBridgeLauncher.exeC:\Users\admin\Desktop\SmartBridgeLauncher.exeexecutable
MD5:BD16EEB3F957029428186118C8C45D45
SHA256:D6FA3E7294CAB1E6D50228CAA8C459A80A410C5A21F5D27CE3255091690C8B55
5328SmartBridgeLauncher.exeC:\Users\admin\Desktop\unins000.msgbinary
MD5:AF27788F6DD6C4233FAA1BCDC16579A3
SHA256:4A780C96EEDF18511D3DFF5A5C0F1FCF6DEAEBD22A1C827EBC6868637286DBB1
5328SmartBridgeLauncher.exeC:\Users\admin\Desktop\old_version\SmartBridgeLauncher.exeexecutable
MD5:BD16EEB3F957029428186118C8C45D45
SHA256:D6FA3E7294CAB1E6D50228CAA8C459A80A410C5A21F5D27CE3255091690C8B55
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
28
DNS requests
13
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6944
svchost.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6944
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5328
SmartBridgeLauncher.exe
GET
200
2.21.20.150:80
http://www.msftncsi.com/ncsi.txt
unknown
—
—
whitelisted
5328
SmartBridgeLauncher.exe
GET
200
3.160.150.97:80
http://assets.smartbridge.co.kr/update/PartCode7/1.0764/Updater.exe
unknown
—
—
—
5328
SmartBridgeLauncher.exe
GET
200
2.21.20.150:80
http://www.msftncsi.com/ncsi.txt
unknown
—
—
whitelisted
5328
SmartBridgeLauncher.exe
GET
200
3.160.150.97:80
http://assets.smartbridge.co.kr/update/PartCode7/1.0764/unins000.msg
unknown
—
—
—
5328
SmartBridgeLauncher.exe
GET
200
3.160.150.97:80
http://assets.smartbridge.co.kr/update/PartCode7/1.0764/SmartBridgeLauncher.exe
unknown
—
—
—
5328
SmartBridgeLauncher.exe
GET
200
3.160.150.97:80
http://assets.smartbridge.co.kr/update/PartCode7/1.0764/SmartBridge.exe
unknown
—
—
—
4316
Updater.exe
GET
200
88.221.110.147:80
http://www.msftncsi.com/ncsi.txt
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
6944
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5488
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5328
SmartBridgeLauncher.exe
2.21.20.150:80
www.msftncsi.com
Akamai International B.V.
DE
whitelisted
6944
svchost.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5328
SmartBridgeLauncher.exe
52.78.18.16:1004
api.smartbridge.co.kr
AMAZON-02
KR
unknown
6944
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5488
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 20.73.194.208
  • 51.104.136.2
  • 40.127.240.158
whitelisted
google.com
  • 142.250.186.142
whitelisted
www.msftncsi.com
  • 2.21.20.150
  • 2.21.20.140
  • 88.221.110.147
  • 88.221.110.216
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.176
  • 23.48.23.147
  • 23.48.23.173
whitelisted
api.smartbridge.co.kr
  • 52.78.18.16
  • 3.38.239.84
unknown
www.microsoft.com
  • 184.30.21.171
whitelisted
assets.smartbridge.co.kr
  • 3.160.150.97
  • 3.160.150.108
  • 3.160.150.42
  • 3.160.150.53
unknown
enliple-smartbridge.s3.ap-northeast-2.amazonaws.com
  • 3.5.141.103
  • 52.219.204.42
  • 3.5.140.169
  • 3.5.184.206
  • 52.219.148.90
  • 3.5.186.220
  • 3.5.184.213
  • 3.5.141.22
shared
self.events.data.microsoft.com
  • 20.42.65.93
whitelisted

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET POLICY Executable served from Amazon S3
—
—
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
—
—
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
—
—
Potentially Bad Traffic
ET POLICY Executable served from Amazon S3
3 ETPRO signatures available at the full report
Process
Message
SmartBridge.exe
Verify completed in 0 milliseconds, total of 1 times in 0 milliseconds.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
SmartBridgeLauncher.exe