10273efcac023d59fc68901d4d4fcf3ca59858fbca92ffb81243ccd49784218d | Triage

Analysis

max time kernel
12s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
15-03-2023 16:07

Sharing

Report Analysis Logs

General

Target

GDHM_TASBOT_v35.6/locales/ko.ps1
Size

411KB
MD5

2df4adea8149d9ffc8566c49e26e3b78
SHA1

481d0dd6d0c1e0667565b7d26cf37c986e1fe0f7
SHA256

0e4af5f37a96ab590fe8e93f91d494dddcf9ea32dd79d97cb6d246f6e8227070
SHA512

6d705512c21149c2750e68cc6444e5a89301f61f47e4171ae7e99f6e4e0c6de1956e810b94ef47ff5791e29e35885c7486371d07dff5fa00273378ba50afd05e
SSDEEP

12288:3DlFeJgJKh0nZaCt8OhHJAXX25R7X98gtDq7hUo3Z5:TLZhJD5T8DZ5

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1680 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1680 powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\GDHM_TASBOT_v35.6\locales\ko.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1680

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1680-58-0x000000001B2B0000-0x000000001B592000-memory.dmp

Filesize
2.9MB

Download
memory/1680-59-0x0000000001FB0000-0x0000000001FB8000-memory.dmp

Filesize
32KB

Download
memory/1680-60-0x0000000002614000-0x0000000002617000-memory.dmp

Filesize
12KB

Download
memory/1680-61-0x000000000261B000-0x0000000002652000-memory.dmp

Filesize
220KB

Download