Analysis
-
max time kernel
131s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
09-03-2022 14:47
Static task
static1
Behavioral task
behavioral1
Sample
GdtBpFKY.exe
Resource
win7-20220223-en
windows7_x64
0 signatures
0 seconds
General
-
Target
GdtBpFKY.exe
-
Size
140KB
-
MD5
bfac768f9ad7d29ec91a0288f4b5f479
-
SHA1
ff3240c04aa6778dfc4fa2c2eec505c0fb52acac
-
SHA256
950da158619b3a37e4c0f0be34c39482afdce6d8aa92703ea9cf5ddd487049e9
-
SHA512
6fa181b5aa88216d49e24576cff35cd5ce4f1ed11d3ec3d6539125d699c421f79dc755b4383e6d6ccf1657d21ee4aa9364f6785ef870e2863b93fa3885f07289
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 4 IoCs
Processes:
GdtBpFKY.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List GdtBpFKY.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile GdtBpFKY.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications GdtBpFKY.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\GdtBpFKY.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\GdtBpFKY.exe:*:enabled:@shell32.dll,-1" GdtBpFKY.exe -
suricata: ET MALWARE Known Hostile Domain ilo.brenz .pl Lookup
suricata: ET MALWARE Known Hostile Domain ilo.brenz .pl Lookup
-
Processes:
resource yara_rule behavioral2/memory/1996-136-0x0000000000400000-0x0000000000444000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
Processes:
GdtBpFKY.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\px4524.tmp GdtBpFKY.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe GdtBpFKY.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe GdtBpFKY.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2984 1996 WerFault.exe GdtBpFKY.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
GdtBpFKY.exepid process 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe -
Suspicious behavior: MapViewOfSection 64 IoCs
Processes:
GdtBpFKY.exepid process 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe 1996 GdtBpFKY.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
GdtBpFKY.exedescription pid process Token: SeDebugPrivilege 1996 GdtBpFKY.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
GdtBpFKY.exedescription pid process target process PID 1996 wrote to memory of 616 1996 GdtBpFKY.exe winlogon.exe PID 1996 wrote to memory of 616 1996 GdtBpFKY.exe winlogon.exe PID 1996 wrote to memory of 616 1996 GdtBpFKY.exe winlogon.exe PID 1996 wrote to memory of 616 1996 GdtBpFKY.exe winlogon.exe PID 1996 wrote to memory of 616 1996 GdtBpFKY.exe winlogon.exe PID 1996 wrote to memory of 616 1996 GdtBpFKY.exe winlogon.exe PID 1996 wrote to memory of 676 1996 GdtBpFKY.exe lsass.exe PID 1996 wrote to memory of 676 1996 GdtBpFKY.exe lsass.exe PID 1996 wrote to memory of 676 1996 GdtBpFKY.exe lsass.exe PID 1996 wrote to memory of 676 1996 GdtBpFKY.exe lsass.exe PID 1996 wrote to memory of 676 1996 GdtBpFKY.exe lsass.exe PID 1996 wrote to memory of 676 1996 GdtBpFKY.exe lsass.exe PID 1996 wrote to memory of 764 1996 GdtBpFKY.exe fontdrvhost.exe PID 1996 wrote to memory of 764 1996 GdtBpFKY.exe fontdrvhost.exe PID 1996 wrote to memory of 764 1996 GdtBpFKY.exe fontdrvhost.exe PID 1996 wrote to memory of 764 1996 GdtBpFKY.exe fontdrvhost.exe PID 1996 wrote to memory of 764 1996 GdtBpFKY.exe fontdrvhost.exe PID 1996 wrote to memory of 764 1996 GdtBpFKY.exe fontdrvhost.exe PID 1996 wrote to memory of 772 1996 GdtBpFKY.exe fontdrvhost.exe PID 1996 wrote to memory of 772 1996 GdtBpFKY.exe fontdrvhost.exe PID 1996 wrote to memory of 772 1996 GdtBpFKY.exe fontdrvhost.exe PID 1996 wrote to memory of 772 1996 GdtBpFKY.exe fontdrvhost.exe PID 1996 wrote to memory of 772 1996 GdtBpFKY.exe fontdrvhost.exe PID 1996 wrote to memory of 772 1996 GdtBpFKY.exe fontdrvhost.exe PID 1996 wrote to memory of 788 1996 GdtBpFKY.exe svchost.exe PID 1996 wrote to memory of 788 1996 GdtBpFKY.exe svchost.exe PID 1996 wrote to memory of 788 1996 GdtBpFKY.exe svchost.exe PID 1996 wrote to memory of 788 1996 GdtBpFKY.exe svchost.exe PID 1996 wrote to memory of 788 1996 GdtBpFKY.exe svchost.exe PID 1996 wrote to memory of 788 1996 GdtBpFKY.exe svchost.exe PID 1996 wrote to memory of 904 1996 GdtBpFKY.exe svchost.exe PID 1996 wrote to memory of 904 1996 GdtBpFKY.exe svchost.exe PID 1996 wrote to memory of 904 1996 GdtBpFKY.exe svchost.exe PID 1996 wrote to memory of 904 1996 GdtBpFKY.exe svchost.exe PID 1996 wrote to memory of 904 1996 GdtBpFKY.exe svchost.exe PID 1996 wrote to memory of 904 1996 GdtBpFKY.exe svchost.exe PID 1996 wrote to memory of 948 1996 GdtBpFKY.exe svchost.exe PID 1996 wrote to memory of 948 1996 GdtBpFKY.exe svchost.exe PID 1996 wrote to memory of 948 1996 GdtBpFKY.exe svchost.exe PID 1996 wrote to memory of 948 1996 GdtBpFKY.exe svchost.exe PID 1996 wrote to memory of 948 1996 GdtBpFKY.exe svchost.exe PID 1996 wrote to memory of 948 1996 GdtBpFKY.exe svchost.exe PID 1996 wrote to memory of 1020 1996 GdtBpFKY.exe dwm.exe PID 1996 wrote to memory of 1020 1996 GdtBpFKY.exe dwm.exe PID 1996 wrote to memory of 1020 1996 GdtBpFKY.exe dwm.exe PID 1996 wrote to memory of 1020 1996 GdtBpFKY.exe dwm.exe PID 1996 wrote to memory of 1020 1996 GdtBpFKY.exe dwm.exe PID 1996 wrote to memory of 1020 1996 GdtBpFKY.exe dwm.exe PID 1996 wrote to memory of 444 1996 GdtBpFKY.exe svchost.exe PID 1996 wrote to memory of 444 1996 GdtBpFKY.exe svchost.exe PID 1996 wrote to memory of 444 1996 GdtBpFKY.exe svchost.exe PID 1996 wrote to memory of 444 1996 GdtBpFKY.exe svchost.exe PID 1996 wrote to memory of 444 1996 GdtBpFKY.exe svchost.exe PID 1996 wrote to memory of 444 1996 GdtBpFKY.exe svchost.exe PID 1996 wrote to memory of 732 1996 GdtBpFKY.exe svchost.exe PID 1996 wrote to memory of 732 1996 GdtBpFKY.exe svchost.exe PID 1996 wrote to memory of 732 1996 GdtBpFKY.exe svchost.exe PID 1996 wrote to memory of 732 1996 GdtBpFKY.exe svchost.exe PID 1996 wrote to memory of 732 1996 GdtBpFKY.exe svchost.exe PID 1996 wrote to memory of 732 1996 GdtBpFKY.exe svchost.exe PID 1996 wrote to memory of 656 1996 GdtBpFKY.exe svchost.exe PID 1996 wrote to memory of 656 1996 GdtBpFKY.exe svchost.exe PID 1996 wrote to memory of 656 1996 GdtBpFKY.exe svchost.exe PID 1996 wrote to memory of 656 1996 GdtBpFKY.exe svchost.exe
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:676
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:616
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"2⤵PID:772
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:1020
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:948
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p1⤵PID:904
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵PID:788
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca2⤵PID:3308
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:3372
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:3204
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:4136
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding2⤵PID:3420
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:2376
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:3692
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca2⤵PID:3452
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:444
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p1⤵PID:732
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:656
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:764
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:1044
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵PID:1144
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe2⤵PID:452
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵PID:2412
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1168
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1224
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵PID:1288
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1468
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1612
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵PID:1712
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵PID:1956
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:2020
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵PID:2072
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:2260
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2536
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵PID:2716
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2736
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2700
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\GdtBpFKY.exe"C:\Users\Admin\AppData\Local\Temp\GdtBpFKY.exe"2⤵
- Modifies firewall policy service
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 5723⤵
- Program crash
PID:2984
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:2660
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵PID:3816
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵PID:3416
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵PID:4540
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:4128
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:2340
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:5036
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵PID:2664
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵PID:2652
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:2644
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2528
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2288
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2268
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p1⤵PID:2220
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:2148
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:1504
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:2028
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1968
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵PID:1832
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1788
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s FontCache1⤵PID:1632
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1560
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1540
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1448
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1412
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1304
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:1116
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1996 -ip 19961⤵PID:2548
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1996-130-0x0000000077A30000-0x0000000077BD3000-memory.dmpFilesize
1.6MB
-
memory/1996-131-0x0000000077A30000-0x0000000077BD3000-memory.dmpFilesize
1.6MB
-
memory/1996-132-0x0000000077A30000-0x0000000077BD3000-memory.dmpFilesize
1.6MB
-
memory/1996-133-0x0000000077A30000-0x0000000077BD3000-memory.dmpFilesize
1.6MB
-
memory/1996-134-0x0000000077A30000-0x0000000077BD3000-memory.dmpFilesize
1.6MB
-
memory/1996-135-0x00000000004A0000-0x00000000004AF000-memory.dmpFilesize
60KB
-
memory/1996-136-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB