Analysis
-
max time kernel
121s -
max time network
146s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
09-03-2022 14:43
Static task
static1
Behavioral task
behavioral1
Sample
GdtBpFKY.exe
Resource
win7-en-20211208
0 signatures
0 seconds
General
-
Target
GdtBpFKY.exe
-
Size
140KB
-
MD5
bfac768f9ad7d29ec91a0288f4b5f479
-
SHA1
ff3240c04aa6778dfc4fa2c2eec505c0fb52acac
-
SHA256
950da158619b3a37e4c0f0be34c39482afdce6d8aa92703ea9cf5ddd487049e9
-
SHA512
6fa181b5aa88216d49e24576cff35cd5ce4f1ed11d3ec3d6539125d699c421f79dc755b4383e6d6ccf1657d21ee4aa9364f6785ef870e2863b93fa3885f07289
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1192-58-0x0000000000400000-0x0000000000444000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
Processes:
GdtBpFKY.exedescription ioc process File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe GdtBpFKY.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe GdtBpFKY.exe File opened for modification C:\Program Files (x86)\Microsoft\pxC948.tmp GdtBpFKY.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
GdtBpFKY.exepid process 1192 GdtBpFKY.exe -
Suspicious behavior: MapViewOfSection 20 IoCs
Processes:
GdtBpFKY.exepid process 1192 GdtBpFKY.exe 1192 GdtBpFKY.exe 1192 GdtBpFKY.exe 1192 GdtBpFKY.exe 1192 GdtBpFKY.exe 1192 GdtBpFKY.exe 1192 GdtBpFKY.exe 1192 GdtBpFKY.exe 1192 GdtBpFKY.exe 1192 GdtBpFKY.exe 1192 GdtBpFKY.exe 1192 GdtBpFKY.exe 1192 GdtBpFKY.exe 1192 GdtBpFKY.exe 1192 GdtBpFKY.exe 1192 GdtBpFKY.exe 1192 GdtBpFKY.exe 1192 GdtBpFKY.exe 1192 GdtBpFKY.exe 1192 GdtBpFKY.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
GdtBpFKY.exedescription pid process Token: SeDebugPrivilege 1192 GdtBpFKY.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
GdtBpFKY.exedescription pid process target process PID 1192 wrote to memory of 368 1192 GdtBpFKY.exe wininit.exe PID 1192 wrote to memory of 368 1192 GdtBpFKY.exe wininit.exe PID 1192 wrote to memory of 368 1192 GdtBpFKY.exe wininit.exe PID 1192 wrote to memory of 368 1192 GdtBpFKY.exe wininit.exe PID 1192 wrote to memory of 368 1192 GdtBpFKY.exe wininit.exe PID 1192 wrote to memory of 368 1192 GdtBpFKY.exe wininit.exe PID 1192 wrote to memory of 368 1192 GdtBpFKY.exe wininit.exe PID 1192 wrote to memory of 376 1192 GdtBpFKY.exe csrss.exe PID 1192 wrote to memory of 376 1192 GdtBpFKY.exe csrss.exe PID 1192 wrote to memory of 376 1192 GdtBpFKY.exe csrss.exe PID 1192 wrote to memory of 376 1192 GdtBpFKY.exe csrss.exe PID 1192 wrote to memory of 376 1192 GdtBpFKY.exe csrss.exe PID 1192 wrote to memory of 376 1192 GdtBpFKY.exe csrss.exe PID 1192 wrote to memory of 376 1192 GdtBpFKY.exe csrss.exe PID 1192 wrote to memory of 416 1192 GdtBpFKY.exe winlogon.exe PID 1192 wrote to memory of 416 1192 GdtBpFKY.exe winlogon.exe PID 1192 wrote to memory of 416 1192 GdtBpFKY.exe winlogon.exe PID 1192 wrote to memory of 416 1192 GdtBpFKY.exe winlogon.exe PID 1192 wrote to memory of 416 1192 GdtBpFKY.exe winlogon.exe PID 1192 wrote to memory of 416 1192 GdtBpFKY.exe winlogon.exe PID 1192 wrote to memory of 416 1192 GdtBpFKY.exe winlogon.exe PID 1192 wrote to memory of 460 1192 GdtBpFKY.exe services.exe PID 1192 wrote to memory of 460 1192 GdtBpFKY.exe services.exe PID 1192 wrote to memory of 460 1192 GdtBpFKY.exe services.exe PID 1192 wrote to memory of 460 1192 GdtBpFKY.exe services.exe PID 1192 wrote to memory of 460 1192 GdtBpFKY.exe services.exe PID 1192 wrote to memory of 460 1192 GdtBpFKY.exe services.exe PID 1192 wrote to memory of 460 1192 GdtBpFKY.exe services.exe PID 1192 wrote to memory of 476 1192 GdtBpFKY.exe lsass.exe PID 1192 wrote to memory of 476 1192 GdtBpFKY.exe lsass.exe PID 1192 wrote to memory of 476 1192 GdtBpFKY.exe lsass.exe PID 1192 wrote to memory of 476 1192 GdtBpFKY.exe lsass.exe PID 1192 wrote to memory of 476 1192 GdtBpFKY.exe lsass.exe PID 1192 wrote to memory of 476 1192 GdtBpFKY.exe lsass.exe PID 1192 wrote to memory of 476 1192 GdtBpFKY.exe lsass.exe PID 1192 wrote to memory of 484 1192 GdtBpFKY.exe lsm.exe PID 1192 wrote to memory of 484 1192 GdtBpFKY.exe lsm.exe PID 1192 wrote to memory of 484 1192 GdtBpFKY.exe lsm.exe PID 1192 wrote to memory of 484 1192 GdtBpFKY.exe lsm.exe PID 1192 wrote to memory of 484 1192 GdtBpFKY.exe lsm.exe PID 1192 wrote to memory of 484 1192 GdtBpFKY.exe lsm.exe PID 1192 wrote to memory of 484 1192 GdtBpFKY.exe lsm.exe PID 1192 wrote to memory of 596 1192 GdtBpFKY.exe svchost.exe PID 1192 wrote to memory of 596 1192 GdtBpFKY.exe svchost.exe PID 1192 wrote to memory of 596 1192 GdtBpFKY.exe svchost.exe PID 1192 wrote to memory of 596 1192 GdtBpFKY.exe svchost.exe PID 1192 wrote to memory of 596 1192 GdtBpFKY.exe svchost.exe PID 1192 wrote to memory of 596 1192 GdtBpFKY.exe svchost.exe PID 1192 wrote to memory of 596 1192 GdtBpFKY.exe svchost.exe PID 1192 wrote to memory of 676 1192 GdtBpFKY.exe svchost.exe PID 1192 wrote to memory of 676 1192 GdtBpFKY.exe svchost.exe PID 1192 wrote to memory of 676 1192 GdtBpFKY.exe svchost.exe PID 1192 wrote to memory of 676 1192 GdtBpFKY.exe svchost.exe PID 1192 wrote to memory of 676 1192 GdtBpFKY.exe svchost.exe PID 1192 wrote to memory of 676 1192 GdtBpFKY.exe svchost.exe PID 1192 wrote to memory of 676 1192 GdtBpFKY.exe svchost.exe PID 1192 wrote to memory of 756 1192 GdtBpFKY.exe svchost.exe PID 1192 wrote to memory of 756 1192 GdtBpFKY.exe svchost.exe PID 1192 wrote to memory of 756 1192 GdtBpFKY.exe svchost.exe PID 1192 wrote to memory of 756 1192 GdtBpFKY.exe svchost.exe PID 1192 wrote to memory of 756 1192 GdtBpFKY.exe svchost.exe PID 1192 wrote to memory of 756 1192 GdtBpFKY.exe svchost.exe PID 1192 wrote to memory of 756 1192 GdtBpFKY.exe svchost.exe PID 1192 wrote to memory of 820 1192 GdtBpFKY.exe svchost.exe
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵
-
C:\Windows\system32\wininit.exewininit.exe3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\GdtBpFKY.exe"C:\Users\Admin\AppData\Local\Temp\GdtBpFKY.exe"2⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe1⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1192-55-0x0000000075831000-0x0000000075833000-memory.dmpFilesize
8KB
-
memory/1192-56-0x0000000077530000-0x00000000776B0000-memory.dmpFilesize
1.5MB
-
memory/1192-57-0x0000000000210000-0x000000000021F000-memory.dmpFilesize
60KB
-
memory/1192-58-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB