b02b469a0902282b16e80a46be10ccfafed6a4fce5ec7bc65da0b9764c044ef4

Analysis

max time kernel
150s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
25/04/2023, 12:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GM anti-theft password.exe
Size 5.4MB
Sample230425-pzl3pscc21
SHA256 b02b469a0902282b16e80a46be10ccfafed6a4fce5ec7bc65da0b9764c044ef4
MD5 d6a589775b1912e0c493dbbc6897035b
SHA1 b1361410557c0e6bac475c9c427778b76c3e6c02
SHA512 3e007515185856f823c166fac333bcac00b8fafb65bd3888887f37f3ae1a96c5286d2244aa39c79c59e48e7cc810be5dfa9b785075ffde8f2ea269ed43d95386
SSDEEP 98304:SPi54uPkEWAQrW5kSW6zdyi7qqVaeMNUITJbZiOFk224Iop3p5dA776XBnVsKn:kwAEW0C65/laea1lZiOS2Kop1A72lVsy
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	GM anti-theft password.exe

Executes dropped EXE 1 IoCs

pid	Process
3444	GM anti-theft password.exe

Loads dropped DLL 1 IoCs

pid	Process
3444	GM anti-theft password.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\libeay32.dll	GM anti-theft password.exe
File created	C:\Windows\SysWOW64\ssleay32.dll	GM anti-theft password.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\drmsoft62b1e\	GM anti-theft password.exe
File opened for modification	C:\Program Files\drmsoft62b1e\GM anti-theft password.exe	GM anti-theft password.exe
File created	C:\Program Files\drmsoft62b1e\ssleay32.dll	GM anti-theft password.exe
File opened for modification	C:\Program Files\drmsoft62b1e\ssleay32.dll	GM anti-theft password.exe
File created	C:\Program Files\drmsoft62b1e\drm.tmp	GM anti-theft password.exe
File opened for modification	C:\Program Files\drmsoft62b1e\drm.tmp	GM anti-theft password.exe
File created	C:\Program Files\drmsoft62b1e\GM anti-theft password.exe	GM anti-theft password.exe
File created	C:\Program Files\drmsoft62b1e\libeay32.dll	GM anti-theft password.exe
File opened for modification	C:\Program Files\drmsoft62b1e\libeay32.dll	GM anti-theft password.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	GM anti-theft password.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4812	GM anti-theft password.exe
4812	GM anti-theft password.exe
3444	GM anti-theft password.exe
3444	GM anti-theft password.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 3444	4812	GM anti-theft password.exe	85
PID 4812 wrote to memory of 3444	4812	GM anti-theft password.exe	85
PID 4812 wrote to memory of 3444	4812	GM anti-theft password.exe	85

C:\Users\Admin\AppData\Local\Temp\GM anti-theft password.exe
"C:\Users\Admin\AppData\Local\Temp\GM anti-theft password.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Program Files\drmsoft62b1e\GM anti-theft password.exe
  "C:\Program Files\drmsoft62b1e\GM anti-theft password.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  PID:3444

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GM anti-theft password.exe

Path C:\Program Files\drmsoft62b1e\GM anti-theft password.exe
Size 5.4MB
SHA256 dd0ec925f314210edfffb5638487233cbed59aabcf085d2d372527124ebc759e
MD5 b9f5126557c1e87d2927c6cc43c0ea52
SHA1 f0cb5ba72effa8b135e88cd745f6f622ce916d6d
SHA512 2355e52a86aa1d656ec4a1d1742d5b721375d26ce384ae4c7d94f14b7265d8f5d7a0721f8fe055a6a5d6c32b72c12af72d997c5103fe41e49f65b5656e79606d
SSDEEP 98304:F251mABibwQAyFAbJzVzArOSqeDalc6d+EW:qmAkbwQubJJc9BDalmEW
MD5 SHA1 SHA512 SSDEEP

Submit Download

GM anti-theft password.exe

Path C:\Program Files\drmsoft62b1e\GM anti-theft password.exe
Size 5.4MB
SHA256 dd0ec925f314210edfffb5638487233cbed59aabcf085d2d372527124ebc759e
MD5 b9f5126557c1e87d2927c6cc43c0ea52
SHA1 f0cb5ba72effa8b135e88cd745f6f622ce916d6d
SHA512 2355e52a86aa1d656ec4a1d1742d5b721375d26ce384ae4c7d94f14b7265d8f5d7a0721f8fe055a6a5d6c32b72c12af72d997c5103fe41e49f65b5656e79606d
SSDEEP 98304:F251mABibwQAyFAbJzVzArOSqeDalc6d+EW:qmAkbwQubJJc9BDalmEW
MD5 SHA1 SHA512 SSDEEP

Submit Download

GM anti-theft password.exe

Path C:\Program Files\drmsoft62b1e\GM anti-theft password.exe
Size 5.4MB
SHA256 dd0ec925f314210edfffb5638487233cbed59aabcf085d2d372527124ebc759e
MD5 b9f5126557c1e87d2927c6cc43c0ea52
SHA1 f0cb5ba72effa8b135e88cd745f6f622ce916d6d
SHA512 2355e52a86aa1d656ec4a1d1742d5b721375d26ce384ae4c7d94f14b7265d8f5d7a0721f8fe055a6a5d6c32b72c12af72d997c5103fe41e49f65b5656e79606d
SSDEEP 98304:F251mABibwQAyFAbJzVzArOSqeDalc6d+EW:qmAkbwQubJJc9BDalmEW
MD5 SHA1 SHA512 SSDEEP

Submit Download

E2EECore.2.7.2.dll

Path C:\Users\Admin\AppData\Local\Temp\E2EECore.2.7.2.dll
Size 8.4MB
SHA256 982a177924762f270b36fe34c7d6847392b48ae53151dc2011078dceef487a53
MD5 8b6c94bbdbfb213e94a5dcb4fac28ce3
SHA1 b56102ca4f03556f387f8b30e2b404efabe0cb65
SHA512 9d6d63b5d8cf7a978d7e91126d7a343c2f7acd00022da9d692f63e50835fdd84a59a93328564f10622f2b1f6adfd7febdd98b8ddb294d0754ed45cc9c165d25a
SSDEEP 98304:z0PpiCcXz5iqFaFxZkyE2kCeQ+LDSBRAN9ijNnQobT9wdxd+tNrspBAUZLh7ZV/T:QyDBaFxZNb+LwRAN9w1X9wdxrpV9/J
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4812-218-0x0000000000400000-0x00000000004FE000-memory.dmp

Download

memory/4812-213-0x0000000000400000-0x00000000004FE000-memory.dmp

Download

memory/4812-214-0x0000000002230000-0x0000000002231000-memory.dmp

Download

memory/4812-215-0x0000000000400000-0x00000000004FE000-memory.dmp

Download

memory/4812-216-0x0000000000400000-0x00000000004FE000-memory.dmp

Download

memory/4812-217-0x0000000000400000-0x00000000004FE000-memory.dmp

Download

memory/4812-133-0x0000000002230000-0x0000000002231000-memory.dmp

Download

memory/4812-219-0x0000000000400000-0x00000000004FE000-memory.dmp

Download

memory/4812-221-0x0000000000400000-0x00000000004FE000-memory.dmp

Download

memory/4812-222-0x0000000000400000-0x00000000004FE000-memory.dmp

Download

memory/4812-223-0x0000000000400000-0x00000000004FE000-memory.dmp

Download

memory/4812-224-0x0000000000400000-0x00000000004FE000-memory.dmp

Download

memory/4812-225-0x0000000000400000-0x00000000004FE000-memory.dmp

Download

memory/4812-226-0x0000000000400000-0x00000000004FE000-memory.dmp

Download

memory/4812-227-0x0000000000400000-0x00000000004FE000-memory.dmp

Download

memory/4812-228-0x0000000000400000-0x00000000004FE000-memory.dmp

Download