99eb5ec80810d9e5d49fe6b70379bddc79879d6416bc1390b2cee6a0349f7312

General

Target

99eb5ec80810d9e5d49fe6b70379bddc79879d6416bc1390b2cee6a0349f7312.exe
Size

18KB
MD5

46c59f32897238bbfc34e14a1f5eb0e9
SHA1

de602b833a4a605833aef6776f1f76cf20a10572
SHA256

99eb5ec80810d9e5d49fe6b70379bddc79879d6416bc1390b2cee6a0349f7312
SHA512

bc064dd5039b6964ae380b0448ad13c1463e032712acbd12d690448f23348200f93f8090fd91d1ddb48688c486724ed78f63a86641d3ee9733d39d9aaa6aa743
SSDEEP

384:8DFMvS0BaZ8BxuRmaQC82YOvV9SNOxrRB:8DkSEc8BgRmTcH

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

vgtdcg.exe

pid process

1324 vgtdcg.exe

pid	process
1324	vgtdcg.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\SysWOW64\vgtdcg.exe	upx
behavioral1/memory/872-55-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/1324-56-0x0000000000400000-0x0000000000417000-memory.dmp	upx
C:\Windows\SysWOW64\vgtdcg.exe	upx
behavioral1/memory/1324-60-0x0000000000400000-0x0000000000417000-memory.dmp	upx

Loads dropped DLL 1 IoCs

Processes:

vgtdcg.exe

pid process

1324 vgtdcg.exe

pid	process
1324	vgtdcg.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vgtdcg.exe

description	ioc	process
File opened (read-only)	\??\F:	vgtdcg.exe
File opened (read-only)	\??\G:	vgtdcg.exe
File opened (read-only)	\??\M:	vgtdcg.exe
File opened (read-only)	\??\E:	vgtdcg.exe
File opened (read-only)	\??\I:	vgtdcg.exe
File opened (read-only)	\??\N:	vgtdcg.exe
File opened (read-only)	\??\R:	vgtdcg.exe
File opened (read-only)	\??\S:	vgtdcg.exe
File opened (read-only)	\??\V:	vgtdcg.exe
File opened (read-only)	\??\W:	vgtdcg.exe
File opened (read-only)	\??\J:	vgtdcg.exe
File opened (read-only)	\??\K:	vgtdcg.exe
File opened (read-only)	\??\U:	vgtdcg.exe
File opened (read-only)	\??\Z:	vgtdcg.exe
File opened (read-only)	\??\H:	vgtdcg.exe
File opened (read-only)	\??\L:	vgtdcg.exe
File opened (read-only)	\??\O:	vgtdcg.exe
File opened (read-only)	\??\P:	vgtdcg.exe
File opened (read-only)	\??\Q:	vgtdcg.exe
File opened (read-only)	\??\T:	vgtdcg.exe
File opened (read-only)	\??\X:	vgtdcg.exe
File opened (read-only)	\??\Y:	vgtdcg.exe

Drops file in System32 directory 3 IoCs

Processes:

99eb5ec80810d9e5d49fe6b70379bddc79879d6416bc1390b2cee6a0349f7312.exevgtdcg.exe

description	ioc	process
File created	C:\Windows\SysWOW64\vgtdcg.exe	99eb5ec80810d9e5d49fe6b70379bddc79879d6416bc1390b2cee6a0349f7312.exe
File opened for modification	C:\Windows\SysWOW64\vgtdcg.exe	99eb5ec80810d9e5d49fe6b70379bddc79879d6416bc1390b2cee6a0349f7312.exe
File created	C:\Windows\SysWOW64\gei33.dll	vgtdcg.exe

Drops file in Program Files directory 2 IoCs

Processes:

vgtdcg.exe

description ioc process

File created C:\Program Files\7-Zip\lpk.dll vgtdcg.exe
File opened for modification C:\Program Files\7-Zip\lpk.dll vgtdcg.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

99eb5ec80810d9e5d49fe6b70379bddc79879d6416bc1390b2cee6a0349f7312.exe

pid process

872 99eb5ec80810d9e5d49fe6b70379bddc79879d6416bc1390b2cee6a0349f7312.exe

description	ioc	process
File created	C:\Program Files\7-Zip\lpk.dll	vgtdcg.exe
File opened for modification	C:\Program Files\7-Zip\lpk.dll	vgtdcg.exe

pid	process
872	99eb5ec80810d9e5d49fe6b70379bddc79879d6416bc1390b2cee6a0349f7312.exe

C:\Users\Admin\AppData\Local\Temp\99eb5ec80810d9e5d49fe6b70379bddc79879d6416bc1390b2cee6a0349f7312.exe
"C:\Users\Admin\AppData\Local\Temp\99eb5ec80810d9e5d49fe6b70379bddc79879d6416bc1390b2cee6a0349f7312.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
PID:872

C:\Windows\SysWOW64\vgtdcg.exe
C:\Windows\SysWOW64\vgtdcg.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
PID:1324

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\vgtdcg.exe
Filesize
18KB

MD5
46c59f32897238bbfc34e14a1f5eb0e9

SHA1
de602b833a4a605833aef6776f1f76cf20a10572

SHA256
99eb5ec80810d9e5d49fe6b70379bddc79879d6416bc1390b2cee6a0349f7312

SHA512
bc064dd5039b6964ae380b0448ad13c1463e032712acbd12d690448f23348200f93f8090fd91d1ddb48688c486724ed78f63a86641d3ee9733d39d9aaa6aa743

Download Submit
C:\Windows\SysWOW64\vgtdcg.exe
Filesize
18KB

MD5
46c59f32897238bbfc34e14a1f5eb0e9

SHA1
de602b833a4a605833aef6776f1f76cf20a10572

SHA256
99eb5ec80810d9e5d49fe6b70379bddc79879d6416bc1390b2cee6a0349f7312

SHA512
bc064dd5039b6964ae380b0448ad13c1463e032712acbd12d690448f23348200f93f8090fd91d1ddb48688c486724ed78f63a86641d3ee9733d39d9aaa6aa743

Download Submit
\Windows\SysWOW64\gei33.dll
Filesize
28KB

MD5
5e2304f296aebf689a579c15984a789a

SHA1
0151a407d1efb45666d5ddba4f2121757c4df3dc

SHA256
cea63aab8d471579c7e9ff1b9efe67bcabcb0020947105fb15374e69da46e126

SHA512
4470cafdbc72e88561984819e50ccb4fa68fdd1d35d7c76d6a34ccb3e47099d21a42888674a36185af2825aedd904d381870f4ce78c9b1e3a45d223fb4470404

Download Submit
memory/872-55-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1324-56-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1324-59-0x0000000076191000-0x0000000076193000-memory.dmp

Filesize
8KB

Download
memory/1324-60-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads