4c1fc6a16f378978da7c35f36525a4397a983255020fb709d0ad8cbe3f1e38e5

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04-10-2022 21:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PL/Galaxy.exe
Size

261KB
MD5

637b4e8a4fbef797b42d6979b652a3db
SHA1

3f7c391b86c27b6414c89135d7e04d913ae151c5
SHA256

27b752bc4139c9c12d1caff4bef199e7a25ee6caf06eb9897cf615f9cc9c233d
SHA512

3099e1dde974a395529651f163f6e4e32478657b4530fa1f3d4e39adbb045c5ca3e8e51b35ab524ec0c03cdbaca37eb8a41c3d5b0f3ab96a8461b42c4a60e38f
SSDEEP

1536:II47GyTGCwiSnmQUt0LB1Efs5gJpoBWBtjKM4le7Qc58wsa0rc3roPhQDbTp:IvGyYiSDnt1E05m9p

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

SETUP_~1.EXE

pid process

1232 SETUP_~1.EXE

pid	process
1232	SETUP_~1.EXE

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Galaxy.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	Galaxy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	Galaxy.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

SETUP_~1.EXE

description pid process

Token: SeDebugPrivilege 1232 SETUP_~1.EXE

description	pid	process
Token: SeDebugPrivilege	1232	SETUP_~1.EXE

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

Galaxy.exe

description	pid	process	target process
PID 852 wrote to memory of 1232	852	Galaxy.exe	SETUP_~1.EXE
PID 852 wrote to memory of 1232	852	Galaxy.exe	SETUP_~1.EXE
PID 852 wrote to memory of 1232	852	Galaxy.exe	SETUP_~1.EXE
PID 852 wrote to memory of 1232	852	Galaxy.exe	SETUP_~1.EXE
PID 852 wrote to memory of 1232	852	Galaxy.exe	SETUP_~1.EXE
PID 852 wrote to memory of 1232	852	Galaxy.exe	SETUP_~1.EXE
PID 852 wrote to memory of 1232	852	Galaxy.exe	SETUP_~1.EXE

C:\Users\Admin\AppData\Local\Temp\PL\Galaxy.exe
"C:\Users\Admin\AppData\Local\Temp\PL\Galaxy.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:852

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1232

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
Filesize
95.4MB

MD5
45b8150ef9ebdce4b95ecf7e4205096f

SHA1
d13638049db5ca50562087d0efecb1aa98b26d9a

SHA256
e613c1a65542773875971abbb6e536c84a5e5ff10597785b781ace245c6f59db

SHA512
0bc959cc2b952861c4b4706670e2a69a88d510f0ea83b9338e138f769a890e6a9aac376090331f04100a7671325b4471595b8427a5dc2a8138b7e14f2d061c44

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
Filesize
95.4MB

MD5
45b8150ef9ebdce4b95ecf7e4205096f

SHA1
d13638049db5ca50562087d0efecb1aa98b26d9a

SHA256
e613c1a65542773875971abbb6e536c84a5e5ff10597785b781ace245c6f59db

SHA512
0bc959cc2b952861c4b4706670e2a69a88d510f0ea83b9338e138f769a890e6a9aac376090331f04100a7671325b4471595b8427a5dc2a8138b7e14f2d061c44

Download Submit
memory/1232-54-0x0000000000000000-mapping.dmp

Download
memory/1232-57-0x0000000000930000-0x0000000000938000-memory.dmp

Filesize
32KB

Download
memory/1232-58-0x0000000074E41000-0x0000000074E43000-memory.dmp

Filesize
8KB

Download