Analysis
- max time kernel
151s - max time network
33s - platform
windows7_x64 - resource
win7-20230220-en - resource tags
- submitted
25/04/2023, 12:46
General
- Target GM anti-theft password.exe
- Size 5.4MB
- Sample230425-pzl3pscc21
- SHA256 b02b469a0902282b16e80a46be10ccfafed6a4fce5ec7bc65da0b9764c044ef4
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 3 IoCs
- Drops file in System32 directory 2 IoCs
- Drops file in Program Files directory 9 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\GM anti-theft password.exe"C:\Users\Admin\AppData\Local\Temp\GM anti-theft password.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\drmsoft62b1e\GM anti-theft password.exe"C:\Program Files\drmsoft62b1e\GM anti-theft password.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
GM anti-theft password.exe
GM anti-theft password.exe
GM anti-theft password.exe
GM anti-theft password.exe
E2EECore.2.7.2.dll
memory/1984-87-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/1984-83-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/1984-84-0x0000000000230000-0x0000000000231000-memory.dmp
memory/1984-85-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/1984-86-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/1984-54-0x0000000000230000-0x0000000000231000-memory.dmp
memory/1984-88-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/1984-89-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/1984-91-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/1984-92-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/1984-93-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/1984-94-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/1984-95-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/1984-96-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/1984-97-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/1984-98-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/1984-99-0x0000000000400000-0x00000000004FE000-memory.dmp