0970966134c9cc99e8bc48ed319e2199fc1c985bc1a62bb58a3bbf2f21862ae2

Analysis

max time kernel
149s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 15:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

g2ax_customer_combined_dll_core_win32_x86_1702.exe/g2ax_customer_combined_dll_core_win32_x86_1702.exe
Size

3.4MB
MD5

47dd7fd5a31e542a33370735ee773b70
SHA1

69f7ea69774d8d092f9c99f477ce413c7d012c69
SHA256

a5c4f0f95a4c39b8be185a9c92c4496a9aaf95dfa4742626089fac050cb260ab
SHA512

db8582323aded3ae442f2c113c0d8a8f367f670e7b546ea0de64b90fb75fb0ec94586bb1362d03fa093baffb6f753398b43ec4421fd51c48f0c1162f48f76e22
SSDEEP

98304:9F+gOav+DsMSsP/j48tpg+iESjTaGe4OW:9F+gpv+DPP/k+k/aho

Score

7^/10

evasion spyware stealer trojan upx

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3800-0-0x0000000000400000-0x00000000021EA000-memory.dmp	upx
behavioral2/memory/3800-45-0x0000000000400000-0x00000000021EA000-memory.dmp	upx

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	g2ax_customer_combined_dll_core_win32_x86_1702.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	g2ax_installer_customer.exe

Executes dropped EXE 5 IoCs

pid	Process
396	g2ax_installer_customer.exe
5052	g2ax_service.exe
1500	g2ax_comm_customer.exe
724	g2ax_system_customer.exe
2260	g2ax_user_customer.exe

Loads dropped DLL 5 IoCs

pid	Process
396	g2ax_installer_customer.exe
5052	g2ax_service.exe
1500	g2ax_comm_customer.exe
724	g2ax_system_customer.exe
2260	g2ax_user_customer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1500	g2ax_comm_customer.exe
1500	g2ax_comm_customer.exe
724	g2ax_system_customer.exe
724	g2ax_system_customer.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeBackupPrivilege	2260	g2ax_user_customer.exe
Token: SeBackupPrivilege	2260	g2ax_user_customer.exe
Token: SeBackupPrivilege	2260	g2ax_user_customer.exe
Token: SeBackupPrivilege	2260	g2ax_user_customer.exe
Token: SeBackupPrivilege	2260	g2ax_user_customer.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe
2260	g2ax_user_customer.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3800 wrote to memory of 396	3800	g2ax_customer_combined_dll_core_win32_x86_1702.exe	82
PID 3800 wrote to memory of 396	3800	g2ax_customer_combined_dll_core_win32_x86_1702.exe	82
PID 3800 wrote to memory of 396	3800	g2ax_customer_combined_dll_core_win32_x86_1702.exe	82
PID 396 wrote to memory of 5052	396	g2ax_installer_customer.exe	83
PID 396 wrote to memory of 5052	396	g2ax_installer_customer.exe	83
PID 396 wrote to memory of 5052	396	g2ax_installer_customer.exe	83
PID 5052 wrote to memory of 1500	5052	g2ax_service.exe	85
PID 5052 wrote to memory of 1500	5052	g2ax_service.exe	85
PID 5052 wrote to memory of 1500	5052	g2ax_service.exe	85
PID 1500 wrote to memory of 724	1500	g2ax_comm_customer.exe	89
PID 1500 wrote to memory of 724	1500	g2ax_comm_customer.exe	89
PID 1500 wrote to memory of 724	1500	g2ax_comm_customer.exe	89
PID 1500 wrote to memory of 2260	1500	g2ax_comm_customer.exe	90
PID 1500 wrote to memory of 2260	1500	g2ax_comm_customer.exe	90
PID 1500 wrote to memory of 2260	1500	g2ax_comm_customer.exe	90

C:\Users\Admin\AppData\Local\Temp\g2ax_customer_combined_dll_core_win32_x86_1702.exe\g2ax_customer_combined_dll_core_win32_x86_1702.exe
"C:\Users\Admin\AppData\Local\Temp\g2ax_customer_combined_dll_core_win32_x86_1702.exe\g2ax_customer_combined_dll_core_win32_x86_1702.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:3800
- C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1702\g2aD3F9.tmp\g2ax_installer_customer.exe
  "C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1702\g2aD3F9.tmp\g2ax_installer_customer.exe " "/LoaderPath C:\Users\Admin\AppData\Local\Temp\g2ax_customer_combined_dll_core_win32_x86_1702.exe\g2ax_customer_combined_dll_core_win32_x86_1702.exe" "/LogPath C:\Users\Admin\AppData\Local\Temp\LogMeInLogs\GoToAssist Remote Support Customer\1702\20231016_092019\" "/RestartReason Start"
  2⤵
  - Checks whether UAC is enabled
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:396
- - C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1702\g2aD3F9.tmp\g2ax_service.exe
    "C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1702\g2aD3F9.tmp\g2ax_service.exe" "Start=start_session&LoaderPath=C:\Users\Admin\AppData\Local\Temp\g2ax_customer_combined_dll_core_win32_x86_1702.exe\g2ax_customer_combined_dll_core_win32_x86_1702.exe&LogPath=C:\Users\Admin\AppData\Local\Temp\LogMeInLogs\GoToAssist Remote Support Customer\1702\20231016_092019\&ResourceDll=g2ax_customer_resource_win32_x86_en_US.dll&RestartReason=Start"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:5052
  - - C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1702\g2aD3F9.tmp\g2ax_comm_customer.exe
      "C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1702\g2aD3F9.tmp\g2ax_comm_customer.exe" "LoaderPath=C:\Users\Admin\AppData\Local\Temp\g2ax_customer_combined_dll_core_win32_x86_1702.exe\g2ax_customer_combined_dll_core_win32_x86_1702.exe&LogName=C:\Users\Admin\AppData\Local\Temp\LogMeInLogs\GoToAssist Remote Support Customer\1702\20231016_092019\GoToAssist Remote Support Customer.LOG&LogPath=C:\Users\Admin\AppData\Local\Temp\LogMeInLogs\GoToAssist Remote Support Customer\1702\20231016_092019\&ResourceDll=g2ax_customer_resource_win32_x86_en_US.dll&RestartReason=Start&Start=start_session&StartID={A0C8A51A-656E-4752-A7A1-51E0A4B9C872}&UniqueId=5052"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1500
    - - C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1702\g2aD3F9.tmp\g2ax_system_customer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1702\g2aD3F9.tmp\g2ax_system_customer.exe" "StartID={6F67A8FB-734D-4D5A-969D-23256C524F2C}&ResourceDll=g2ax_customer_resource_win32_x86_en_US.dll&Debug=Off&Stat=On&StatDb=On&Index=0"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:724
    - - C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1702\g2aD3F9.tmp\g2ax_user_customer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1702\g2aD3F9.tmp\g2ax_user_customer.exe" "StartID={3968F4AF-486D-4109-937D-DE909EE62224}&ResourceDll=g2ax_customer_resource_win32_x86_en_US.dll&Debug=Off&Stat=Off&StatDb=Off&Index=0"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1702\g2aD3F9.tmp\g2ax_combined_customer.dll

Filesize
9.0MB

MD5
964be191e1c43fc58c4ac16c52813d1e

SHA1
c2d3989d189e69aa5fa5d58d8987440b8a1250a6

SHA256
4132e3cb933b77687e959b2dc793072508c72e3b30e0cb9269d898be3a5d1cf9

SHA512
dfce2387ce74549a82422c98f07582417b7d9c7cc6d0014740c9602b37b5411cb9f0025bd92d762aa1c80b3f38620f959bc97dedf12cf0d6c0c1d7fcc22171ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1702\g2aD3F9.tmp\g2ax_combined_customer.dll

Filesize
9.0MB

MD5
964be191e1c43fc58c4ac16c52813d1e

SHA1
c2d3989d189e69aa5fa5d58d8987440b8a1250a6

SHA256
4132e3cb933b77687e959b2dc793072508c72e3b30e0cb9269d898be3a5d1cf9

SHA512
dfce2387ce74549a82422c98f07582417b7d9c7cc6d0014740c9602b37b5411cb9f0025bd92d762aa1c80b3f38620f959bc97dedf12cf0d6c0c1d7fcc22171ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1702\g2aD3F9.tmp\g2ax_combined_customer.dll

Filesize
9.0MB

MD5
964be191e1c43fc58c4ac16c52813d1e

SHA1
c2d3989d189e69aa5fa5d58d8987440b8a1250a6

SHA256
4132e3cb933b77687e959b2dc793072508c72e3b30e0cb9269d898be3a5d1cf9

SHA512
dfce2387ce74549a82422c98f07582417b7d9c7cc6d0014740c9602b37b5411cb9f0025bd92d762aa1c80b3f38620f959bc97dedf12cf0d6c0c1d7fcc22171ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1702\g2aD3F9.tmp\g2ax_combined_customer.dll

Filesize
9.0MB

MD5
964be191e1c43fc58c4ac16c52813d1e

SHA1
c2d3989d189e69aa5fa5d58d8987440b8a1250a6

SHA256
4132e3cb933b77687e959b2dc793072508c72e3b30e0cb9269d898be3a5d1cf9

SHA512
dfce2387ce74549a82422c98f07582417b7d9c7cc6d0014740c9602b37b5411cb9f0025bd92d762aa1c80b3f38620f959bc97dedf12cf0d6c0c1d7fcc22171ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1702\g2aD3F9.tmp\g2ax_combined_customer.dll

Filesize
9.0MB

MD5
964be191e1c43fc58c4ac16c52813d1e

SHA1
c2d3989d189e69aa5fa5d58d8987440b8a1250a6

SHA256
4132e3cb933b77687e959b2dc793072508c72e3b30e0cb9269d898be3a5d1cf9

SHA512
dfce2387ce74549a82422c98f07582417b7d9c7cc6d0014740c9602b37b5411cb9f0025bd92d762aa1c80b3f38620f959bc97dedf12cf0d6c0c1d7fcc22171ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1702\g2aD3F9.tmp\g2ax_combined_customer.dll

Filesize
9.0MB

MD5
964be191e1c43fc58c4ac16c52813d1e

SHA1
c2d3989d189e69aa5fa5d58d8987440b8a1250a6

SHA256
4132e3cb933b77687e959b2dc793072508c72e3b30e0cb9269d898be3a5d1cf9

SHA512
dfce2387ce74549a82422c98f07582417b7d9c7cc6d0014740c9602b37b5411cb9f0025bd92d762aa1c80b3f38620f959bc97dedf12cf0d6c0c1d7fcc22171ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1702\g2aD3F9.tmp\g2ax_comm_customer.exe

Filesize
600KB

MD5
15c57e910e06ea93d4e656caf03572f6

SHA1
4e9a3d244ce5e49bfb3edfd6ef46a705e70620ca

SHA256
ffba9b24bf1a767cb93e825f610848b66e5f5b4c03c1a519acb63cc5db4d0f06

SHA512
e18fe7323def774af969dd197c42e5c97432a0ec67f530187162d5dbc2bb45844cafc70fba8f62ad3b85a27ac0c6f19d1d614504f2f277eb32fe3367c3af46b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1702\g2aD3F9.tmp\g2ax_customer_resource_win32_x86_en_US.dll

Filesize
2.7MB

MD5
27762d80c021793b1d3713fdb88614c8

SHA1
043876b9f63a3c17dff9ff7515500e35794b8513

SHA256
996dfbc2e8ea4391218a4cb27900ebfdc5801b5ee200e499b687a5903b7f7d5b

SHA512
dfd3a727a7ee9ebd79cfbf6018836d1b77edc58ca394c13767cf56cda3758f315ae8592ff02714f271c0e8dbdb2cb9e5c3146231274dcaa5872da3e133cf52e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1702\g2aD3F9.tmp\g2ax_installer_customer.exe

Filesize
600KB

MD5
15c57e910e06ea93d4e656caf03572f6

SHA1
4e9a3d244ce5e49bfb3edfd6ef46a705e70620ca

SHA256
ffba9b24bf1a767cb93e825f610848b66e5f5b4c03c1a519acb63cc5db4d0f06

SHA512
e18fe7323def774af969dd197c42e5c97432a0ec67f530187162d5dbc2bb45844cafc70fba8f62ad3b85a27ac0c6f19d1d614504f2f277eb32fe3367c3af46b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1702\g2aD3F9.tmp\g2ax_installer_customer.exe

Filesize
600KB

MD5
15c57e910e06ea93d4e656caf03572f6

SHA1
4e9a3d244ce5e49bfb3edfd6ef46a705e70620ca

SHA256
ffba9b24bf1a767cb93e825f610848b66e5f5b4c03c1a519acb63cc5db4d0f06

SHA512
e18fe7323def774af969dd197c42e5c97432a0ec67f530187162d5dbc2bb45844cafc70fba8f62ad3b85a27ac0c6f19d1d614504f2f277eb32fe3367c3af46b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1702\g2aD3F9.tmp\g2ax_installer_customer_admin.exe

Filesize
600KB

MD5
a0a484d638133fbd4a93dea4ec110162

SHA1
df3ca26da53addd894f0bf5dfac8f505ba1807af

SHA256
558a9e31b8c8269afe4a20e52367fc70f2487412a8a28bf5959c1bd10b53891d

SHA512
69b35ab8a860514ab520f1783a822be0be63bd940802c3649790c4ecc0599a404420d0efed204127df2a98eefee9ec3498f5c8d7bc9ce9102d4996de51d0f3f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1702\g2aD3F9.tmp\g2ax_service.exe

Filesize
600KB

MD5
15c57e910e06ea93d4e656caf03572f6

SHA1
4e9a3d244ce5e49bfb3edfd6ef46a705e70620ca

SHA256
ffba9b24bf1a767cb93e825f610848b66e5f5b4c03c1a519acb63cc5db4d0f06

SHA512
e18fe7323def774af969dd197c42e5c97432a0ec67f530187162d5dbc2bb45844cafc70fba8f62ad3b85a27ac0c6f19d1d614504f2f277eb32fe3367c3af46b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1702\g2aD3F9.tmp\g2ax_system_customer.exe

Filesize
600KB

MD5
15c57e910e06ea93d4e656caf03572f6

SHA1
4e9a3d244ce5e49bfb3edfd6ef46a705e70620ca

SHA256
ffba9b24bf1a767cb93e825f610848b66e5f5b4c03c1a519acb63cc5db4d0f06

SHA512
e18fe7323def774af969dd197c42e5c97432a0ec67f530187162d5dbc2bb45844cafc70fba8f62ad3b85a27ac0c6f19d1d614504f2f277eb32fe3367c3af46b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1702\g2aD3F9.tmp\g2ax_user_customer.exe

Filesize
600KB

MD5
15c57e910e06ea93d4e656caf03572f6

SHA1
4e9a3d244ce5e49bfb3edfd6ef46a705e70620ca

SHA256
ffba9b24bf1a767cb93e825f610848b66e5f5b4c03c1a519acb63cc5db4d0f06

SHA512
e18fe7323def774af969dd197c42e5c97432a0ec67f530187162d5dbc2bb45844cafc70fba8f62ad3b85a27ac0c6f19d1d614504f2f277eb32fe3367c3af46b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1702\g2aD3F9.tmp\g2ax_user_customer.exe

Filesize
600KB

MD5
15c57e910e06ea93d4e656caf03572f6

SHA1
4e9a3d244ce5e49bfb3edfd6ef46a705e70620ca

SHA256
ffba9b24bf1a767cb93e825f610848b66e5f5b4c03c1a519acb63cc5db4d0f06

SHA512
e18fe7323def774af969dd197c42e5c97432a0ec67f530187162d5dbc2bb45844cafc70fba8f62ad3b85a27ac0c6f19d1d614504f2f277eb32fe3367c3af46b5

Download Submit
memory/3800-0-0x0000000000400000-0x00000000021EA000-memory.dmp

Filesize
29.9MB

Download
memory/3800-45-0x0000000000400000-0x00000000021EA000-memory.dmp

Filesize
29.9MB

Download