Analysis

  • max time kernel
    138s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-03-2023 16:07

General

  • Target

    GDHM_TASBOT_v35.6/.GDHM/.GDHM_uninstall.bat

  • Size

    2KB

  • MD5

    2a6ed9dcdc9f8be9f0173124590b3335

  • SHA1

    5b55581b8328f4249785328e0ce8410d582f877a

  • SHA256

    e9bfaecdc031524c25d7a981b3922a493c863380e1b0b34c77c5826b8f10b849

  • SHA512

    b0c75206d2ff101d87f1106aabe7b4907304d56d01e8c16f2f4974a6fefda6f59a952563354c84b700af9f89093eb683c15af17afa6f0cb76775b514abe5a930

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\GDHM_TASBOT_v35.6\.GDHM\.GDHM_uninstall.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3068
    • C:\Windows\system32\reg.exe
      reg delete HKEY_CLASSES_ROOT\gdhm\ /f
      2⤵
        PID:3032
      • C:\Windows\system32\reg.exe
        reg delete HKEY_CLASSES_ROOT\gdhm\shell\ /f
        2⤵
          PID:1892
        • C:\Windows\system32\reg.exe
          reg delete HKEY_CLASSES_ROOT\gdhm\shell\open\ /f
          2⤵
            PID:3396
          • C:\Windows\system32\reg.exe
            reg delete HKEY_CLASSES_ROOT\gdhm\shell\open\command\ /f
            2⤵
              PID:1340

          Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads