e5d635f480c9ceb724441a3bd09220ff1cb15d46fa13bb7d8ae6acb7eb347956

General

Target

181d489cb509010138daad808c9cc74d.exe
Size

1.8MB
MD5

181d489cb509010138daad808c9cc74d
SHA1

5b6f103a72d54440bfe614fc9f97cc5f4bc84c5c
SHA256

e5d635f480c9ceb724441a3bd09220ff1cb15d46fa13bb7d8ae6acb7eb347956
SHA512

b65a4734584e5593b70bd87d037b868356c02ca4431ef7b8308df9078866573a1f318983dfc2480d4017142abcc29c153d5820c5fb4151b94f838ab091d232fa
SSDEEP

49152:kNaX98Adc4IJX0rdldc4IJX0rdU4IJX0rdldRldc4IJt:0SqAq4Iedlq4IedU4Iedl7lq4In

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2192	gcgei.exe

Loads dropped DLL 2 IoCs

pid	Process
3060	181d489cb509010138daad808c9cc74d.exe
3060	181d489cb509010138daad808c9cc74d.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3060-0-0x0000000000400000-0x00000000005DC000-memory.dmp	upx
behavioral1/files/0x000a000000015df1-4.dat	upx
behavioral1/memory/3060-11-0x0000000000400000-0x00000000005DC000-memory.dmp	upx
behavioral1/memory/2192-13-0x0000000000400000-0x00000000005DC000-memory.dmp	upx
behavioral1/memory/3060-10-0x0000000002530000-0x000000000270C000-memory.dmp	upx
behavioral1/files/0x000a000000015df1-9.dat	upx
behavioral1/files/0x000a000000015df1-12.dat	upx
behavioral1/files/0x000a000000015df1-6.dat	upx
behavioral1/memory/2192-18-0x0000000000400000-0x00000000005DC000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 20 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings	gcgei.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f4225481e03947bc34db131e946b44c8dd50000	gcgei.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	gcgei.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000	gcgei.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	gcgei.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy	gcgei.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	gcgei.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	gcgei.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	gcgei.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	gcgei.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	gcgei.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	gcgei.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	gcgei.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	gcgei.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}"	gcgei.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}"	gcgei.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	gcgei.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	gcgei.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	gcgei.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\TV_TopViewVersion = "0"	gcgei.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3060	181d489cb509010138daad808c9cc74d.exe
3060	181d489cb509010138daad808c9cc74d.exe
2192	gcgei.exe
2192	gcgei.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2192	gcgei.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
476	Process not Found
476	Process not Found

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2192	gcgei.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 2192	3060	181d489cb509010138daad808c9cc74d.exe	28
PID 3060 wrote to memory of 2192	3060	181d489cb509010138daad808c9cc74d.exe	28
PID 3060 wrote to memory of 2192	3060	181d489cb509010138daad808c9cc74d.exe	28
PID 3060 wrote to memory of 2192	3060	181d489cb509010138daad808c9cc74d.exe	28

C:\Users\Admin\AppData\Local\Temp\181d489cb509010138daad808c9cc74d.exe
"C:\Users\Admin\AppData\Local\Temp\181d489cb509010138daad808c9cc74d.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Users\Admin\AppData\Local\Temp\gcgei.exe
  C:\Users\Admin\AppData\Local\Temp\gcgei.exe -run C:\Users\Admin\AppData\Local\Temp\181d489cb509010138daad808c9cc74d.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gcgei.exe

Filesize
1.1MB

MD5
b2c9180b5badaf412d7c4654fb58d4ba

SHA1
0aa47dc4b38cfa7829122e29ac6235268430d590

SHA256
208343548a862f47256d47d7fafd19753b7f25d4912f9b0e26e58e9247ceb45e

SHA512
b6cefcbe39d0f163dfd0bbd0f6ae1a40acd0b406c565cca945fe74e2bfcedc8c321b9a57caa8e9521d0a3e2b58935f355802fd7c8563c5e8d3b084b216656472

Download Submit
C:\Users\Admin\AppData\Local\Temp\gcgei.exe

Filesize
1024KB

MD5
8caedf90b173d2014d6e186f889eaa0b

SHA1
54e0058e8ade493973d9187702e6dc52acee359f

SHA256
cb1246b432a96dddc62d74dc0329e744e25fd01fab51f22d2585ba57e6f21e44

SHA512
a651117360040d5b526db697720c8fde0bd66b638197359c33f15efe82a407e8f50d92e5f9ddcb784119d78ff7583300677b72283f23caf53864e826e63dfa9c

Download Submit
\Users\Admin\AppData\Local\Temp\gcgei.exe

Filesize
1.5MB

MD5
e5ac95cd1eba6351aceb1ec70dbbe604

SHA1
939c2cabb1b9b112f3393a140150cfc93e4057ce

SHA256
2ef42f208f8517a9e83e4b5bc8d253d4ca0dd7c4635fa966208725b3878917bd

SHA512
0a1a918d55ffb94ce15ea68cd7cfdc2039fd7966cb6dcd1dd3d91f3cead45d0af600ff9ac7b403e7fa1352da3846ece1b8e2e0f20ececab69addd2808ca66d00

Download Submit
\Users\Admin\AppData\Local\Temp\gcgei.exe

Filesize
1.0MB

MD5
36938db9c2a0d53456af1ea35b389276

SHA1
67f42b653ba154cbfe82878c25b32dce65f26b41

SHA256
38bda7f7b006460b8c6bdb913f27bc02582273d6b065c95462c65b587710ddb0

SHA512
6f95e2c9ab69f1947183d14f6a5847057768ab9281133b6df4af9eecb064483a9b106c1ddb9eb7908d76e71df344e66dbbe73fe2ab5db583f7c06259bdf27bc0

Download Submit
memory/2192-13-0x0000000000400000-0x00000000005DC000-memory.dmp

Filesize
1.9MB

Download
memory/2192-16-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2192-17-0x0000000004B40000-0x0000000004B42000-memory.dmp

Filesize
8KB

Download
memory/2192-18-0x0000000000400000-0x00000000005DC000-memory.dmp

Filesize
1.9MB

Download
memory/3060-0-0x0000000000400000-0x00000000005DC000-memory.dmp

Filesize
1.9MB

Download
memory/3060-11-0x0000000000400000-0x00000000005DC000-memory.dmp

Filesize
1.9MB

Download
memory/3060-10-0x0000000002530000-0x000000000270C000-memory.dmp

Filesize
1.9MB

Download

Analysis

Sharing