1716d29f5b2ce57ebd18754b4a69fb34e33811e981cf48a69e4051c20c63b96b | Triage

Analysis

max time kernel
28s
max time network
34s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
01/07/2023, 14:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

GainStager.exe
Size

7.5MB
MD5

c9978aeeb0fd4836e0dea3b7863b81a9
SHA1

853e5761f952aae8ffd9c535b2c57b01110a4492
SHA256

1716d29f5b2ce57ebd18754b4a69fb34e33811e981cf48a69e4051c20c63b96b
SHA512

d47f74eaf6e6b820c188c13a04772bc637086709fe2540e07d1d2aa1198e32f2cbda66548d177e23e59029812b4a01a866bc2cbb1ac9fa2f99562119fe72a445
SSDEEP

196608:heqOlcnenx6fI5Gl0ZOSoJr/jMSyqPfbS5Fd2MmcQCw:heqOynenx6QNjGaq3u5F4MmcK

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\VST3\GainStager.vst3	GainStager.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\GainStager.exe
"C:\Users\Admin\AppData\Local\Temp\GainStager.exe"
1⤵
- Drops file in Program Files directory
PID:1456

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads