Overview
overview
10Static
static
10GDHM_TASBO...ll.bat
windows7-x64
1GDHM_TASBO...ll.bat
windows10-2004-x64
1GDHM_TASBO...32.dll
windows7-x64
1GDHM_TASBO...32.dll
windows10-2004-x64
1GDHM_TASBO...E2.dll
windows7-x64
1GDHM_TASBO...E2.dll
windows10-2004-x64
1GDHM_TASBO...ow.dll
windows7-x64
1GDHM_TASBO...ow.dll
windows10-2004-x64
3GDHM_TASBO...ow.dll
windows7-x64
1GDHM_TASBO...ow.dll
windows10-2004-x64
1GDHM_TASBO...lf.dll
windows7-x64
1GDHM_TASBO...lf.dll
windows10-2004-x64
1GDHM_TASBO...eg.exe
windows7-x64
1GDHM_TASBO...eg.exe
windows10-2004-x64
1GDHM_TASBO...v2.dll
windows7-x64
3GDHM_TASBO...v2.dll
windows10-2004-x64
3GDHM_TASBO...ef.dll
windows7-x64
1GDHM_TASBO...ef.dll
windows10-2004-x64
1GDHM_TASBO...et.ps1
windows7-x64
1GDHM_TASBO...et.ps1
windows10-2004-x64
1GDHM_TASBO...ko.ps1
windows7-x64
1GDHM_TASBO...ko.ps1
windows10-2004-x64
1GDHM_TASBO...ms.ps1
windows7-x64
1GDHM_TASBO...ms.ps1
windows10-2004-x64
1GDHM_TASBO...CN.ps1
windows7-x64
1GDHM_TASBO...CN.ps1
windows10-2004-x64
1GDHM_TASBO...32.dll
windows7-x64
1GDHM_TASBO...32.dll
windows10-2004-x64
1Analysis
-
max time kernel
124s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
15-03-2023 16:07
Behavioral task
behavioral1
Sample
GDHM_TASBOT_v35.6/.GDHM/.GDHM_uninstall.bat
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
GDHM_TASBOT_v35.6/.GDHM/.GDHM_uninstall.bat
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
GDHM_TASBOT_v35.6/.GDHM/tools/backup/msacm32.dll
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
GDHM_TASBOT_v35.6/.GDHM/tools/backup/msacm32.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral5
Sample
GDHM_TASBOT_v35.6/.GDHM/tools/backup/pthreadVCE2.dll
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
GDHM_TASBOT_v35.6/.GDHM/tools/backup/pthreadVCE2.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral7
Sample
GDHM_TASBOT_v35.6/RoastedMarshmellow.dll
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
GDHM_TASBOT_v35.6/RoastedMarshmellow.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
GDHM_TASBOT_v35.6/ToastedMarshmellow.dll
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
GDHM_TASBOT_v35.6/ToastedMarshmellow.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
GDHM_TASBOT_v35.6/chrome_elf.dll
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
GDHM_TASBOT_v35.6/chrome_elf.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
GDHM_TASBOT_v35.6/ffmpeg/ffmpeg.exe
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
GDHM_TASBOT_v35.6/ffmpeg/ffmpeg.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
GDHM_TASBOT_v35.6/libGLESv2.dll
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
GDHM_TASBOT_v35.6/libGLESv2.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
GDHM_TASBOT_v35.6/libcef.dll
Resource
win7-20230220-en
Behavioral task
behavioral18
Sample
GDHM_TASBOT_v35.6/libcef.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
GDHM_TASBOT_v35.6/locales/et.ps1
Resource
win7-20230220-en
Behavioral task
behavioral20
Sample
GDHM_TASBOT_v35.6/locales/et.ps1
Resource
win10v2004-20230220-en
Behavioral task
behavioral21
Sample
GDHM_TASBOT_v35.6/locales/ko.ps1
Resource
win7-20230220-en
Behavioral task
behavioral22
Sample
GDHM_TASBOT_v35.6/locales/ko.ps1
Resource
win10v2004-20230220-en
Behavioral task
behavioral23
Sample
GDHM_TASBOT_v35.6/locales/ms.ps1
Resource
win7-20230220-en
Behavioral task
behavioral24
Sample
GDHM_TASBOT_v35.6/locales/ms.ps1
Resource
win10v2004-20230220-en
Behavioral task
behavioral25
Sample
GDHM_TASBOT_v35.6/locales/zh-CN.ps1
Resource
win7-20230220-en
Behavioral task
behavioral26
Sample
GDHM_TASBOT_v35.6/locales/zh-CN.ps1
Resource
win10v2004-20230220-en
Behavioral task
behavioral27
Sample
GDHM_TASBOT_v35.6/msacm32.dll
Resource
win7-20230220-en
Behavioral task
behavioral28
Sample
GDHM_TASBOT_v35.6/msacm32.dll
Resource
win10v2004-20230220-en
General
-
Target
GDHM_TASBOT_v35.6/locales/ko.ps1
-
Size
411KB
-
MD5
2df4adea8149d9ffc8566c49e26e3b78
-
SHA1
481d0dd6d0c1e0667565b7d26cf37c986e1fe0f7
-
SHA256
0e4af5f37a96ab590fe8e93f91d494dddcf9ea32dd79d97cb6d246f6e8227070
-
SHA512
6d705512c21149c2750e68cc6444e5a89301f61f47e4171ae7e99f6e4e0c6de1956e810b94ef47ff5791e29e35885c7486371d07dff5fa00273378ba50afd05e
-
SSDEEP
12288:3DlFeJgJKh0nZaCt8OhHJAXX25R7X98gtDq7hUo3Z5:TLZhJD5T8DZ5
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 1900 powershell.exe 1900 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1900 powershell.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b25ffqbz.1l4.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/1900-142-0x000002DC6C800000-0x000002DC6C822000-memory.dmpFilesize
136KB
-
memory/1900-143-0x000002DC6BD40000-0x000002DC6BD50000-memory.dmpFilesize
64KB
-
memory/1900-144-0x000002DC6BD40000-0x000002DC6BD50000-memory.dmpFilesize
64KB
-
memory/1900-145-0x000002DC6BD40000-0x000002DC6BD50000-memory.dmpFilesize
64KB