Overview
overview
10Static
static
10GDHM_TASBO...ll.bat
windows7-x64
1GDHM_TASBO...ll.bat
windows10-2004-x64
1GDHM_TASBO...32.dll
windows7-x64
1GDHM_TASBO...32.dll
windows10-2004-x64
1GDHM_TASBO...E2.dll
windows7-x64
1GDHM_TASBO...E2.dll
windows10-2004-x64
1GDHM_TASBO...ow.dll
windows7-x64
1GDHM_TASBO...ow.dll
windows10-2004-x64
3GDHM_TASBO...ow.dll
windows7-x64
1GDHM_TASBO...ow.dll
windows10-2004-x64
1GDHM_TASBO...lf.dll
windows7-x64
1GDHM_TASBO...lf.dll
windows10-2004-x64
1GDHM_TASBO...eg.exe
windows7-x64
1GDHM_TASBO...eg.exe
windows10-2004-x64
1GDHM_TASBO...v2.dll
windows7-x64
3GDHM_TASBO...v2.dll
windows10-2004-x64
3GDHM_TASBO...ef.dll
windows7-x64
1GDHM_TASBO...ef.dll
windows10-2004-x64
1GDHM_TASBO...et.ps1
windows7-x64
1GDHM_TASBO...et.ps1
windows10-2004-x64
1GDHM_TASBO...ko.ps1
windows7-x64
1GDHM_TASBO...ko.ps1
windows10-2004-x64
1GDHM_TASBO...ms.ps1
windows7-x64
1GDHM_TASBO...ms.ps1
windows10-2004-x64
1GDHM_TASBO...CN.ps1
windows7-x64
1GDHM_TASBO...CN.ps1
windows10-2004-x64
1GDHM_TASBO...32.dll
windows7-x64
1GDHM_TASBO...32.dll
windows10-2004-x64
1Analysis
-
max time kernel
91s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
15-03-2023 16:07
Behavioral task
behavioral1
Sample
GDHM_TASBOT_v35.6/.GDHM/.GDHM_uninstall.bat
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
GDHM_TASBOT_v35.6/.GDHM/.GDHM_uninstall.bat
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
GDHM_TASBOT_v35.6/.GDHM/tools/backup/msacm32.dll
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
GDHM_TASBOT_v35.6/.GDHM/tools/backup/msacm32.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral5
Sample
GDHM_TASBOT_v35.6/.GDHM/tools/backup/pthreadVCE2.dll
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
GDHM_TASBOT_v35.6/.GDHM/tools/backup/pthreadVCE2.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral7
Sample
GDHM_TASBOT_v35.6/RoastedMarshmellow.dll
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
GDHM_TASBOT_v35.6/RoastedMarshmellow.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
GDHM_TASBOT_v35.6/ToastedMarshmellow.dll
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
GDHM_TASBOT_v35.6/ToastedMarshmellow.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
GDHM_TASBOT_v35.6/chrome_elf.dll
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
GDHM_TASBOT_v35.6/chrome_elf.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
GDHM_TASBOT_v35.6/ffmpeg/ffmpeg.exe
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
GDHM_TASBOT_v35.6/ffmpeg/ffmpeg.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
GDHM_TASBOT_v35.6/libGLESv2.dll
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
GDHM_TASBOT_v35.6/libGLESv2.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
GDHM_TASBOT_v35.6/libcef.dll
Resource
win7-20230220-en
Behavioral task
behavioral18
Sample
GDHM_TASBOT_v35.6/libcef.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
GDHM_TASBOT_v35.6/locales/et.ps1
Resource
win7-20230220-en
Behavioral task
behavioral20
Sample
GDHM_TASBOT_v35.6/locales/et.ps1
Resource
win10v2004-20230220-en
Behavioral task
behavioral21
Sample
GDHM_TASBOT_v35.6/locales/ko.ps1
Resource
win7-20230220-en
Behavioral task
behavioral22
Sample
GDHM_TASBOT_v35.6/locales/ko.ps1
Resource
win10v2004-20230220-en
Behavioral task
behavioral23
Sample
GDHM_TASBOT_v35.6/locales/ms.ps1
Resource
win7-20230220-en
Behavioral task
behavioral24
Sample
GDHM_TASBOT_v35.6/locales/ms.ps1
Resource
win10v2004-20230220-en
Behavioral task
behavioral25
Sample
GDHM_TASBOT_v35.6/locales/zh-CN.ps1
Resource
win7-20230220-en
Behavioral task
behavioral26
Sample
GDHM_TASBOT_v35.6/locales/zh-CN.ps1
Resource
win10v2004-20230220-en
Behavioral task
behavioral27
Sample
GDHM_TASBOT_v35.6/msacm32.dll
Resource
win7-20230220-en
Behavioral task
behavioral28
Sample
GDHM_TASBOT_v35.6/msacm32.dll
Resource
win10v2004-20230220-en
General
-
Target
GDHM_TASBOT_v35.6/ToastedMarshmellow.dll
-
Size
19.8MB
-
MD5
648ec09e3c4cf34bdcad8fd01819c334
-
SHA1
1072d89df45a0e01163dacdbfb646bd677907a43
-
SHA256
d08a952ef2a90adaee882607d4b77c4b4deae9d2d956d274f9c958b13d636311
-
SHA512
16af9b8258ab0258d5d58e88ca0e214f278b518eef5e5164c235ba5957ccb32b7a385b2e6cec57e3fe61a216a524e5608ab4daa164c76c7207a8eaa9549296b2
-
SSDEEP
393216:bJKxYmaj9Ei74yxJZq2F8qa2mgtG98GyuTk7Lg40pEPFVKEelx/6Dyg:UxRajzc6v62oTlCP2JlgDyg
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3872 wrote to memory of 4284 3872 rundll32.exe rundll32.exe PID 3872 wrote to memory of 4284 3872 rundll32.exe rundll32.exe PID 3872 wrote to memory of 4284 3872 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\GDHM_TASBOT_v35.6\ToastedMarshmellow.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\GDHM_TASBOT_v35.6\ToastedMarshmellow.dll,#12⤵PID:4284