Analysis
-
max time kernel
1554s -
max time network
1742s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
16-02-2022 17:24
General
-
Target
all/gcs/Client_Loader.exe
-
Size
1.1MB
-
MD5
4d533e9bf473bffa223d08375406e354
-
SHA1
a476be755207b0a789a7ea291980ddc53318ff1d
-
SHA256
84b42521803e83e1d6633bec4099f443a46898297c2588a04dd4b97797311795
-
SHA512
e20230aa5091e8ff762d7b81c0edde8ab476aa03ed83c2a2bc75b06e3dfebb0aacfde26562c2684368cce72595672f6efa9ca0b489cb09e0394a602564a89980
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
-
Drops file in Windows directory 8 IoCs
-
Modifies data under HKEY_USERS 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\all\gcs\Client_Loader.exe"C:\Users\Admin\AppData\Local\Temp\all\gcs\Client_Loader.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
14ff402962ad21b78ae0b4c43cd1f194
SHA1f8a510eb26666e875a5bdd1cadad40602763ad72
SHA256fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b
SHA512daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
16KB
-
Filesize
16KB
-
Filesize
16KB
-
Filesize
16KB
-
Filesize
4KB
-
Filesize
16KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
16KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
40KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
624KB
-
Filesize
548KB
-
Filesize
584KB
-
Filesize
5.6MB
-
Filesize
1.1MB