Analysis
-
max time kernel
195s -
max time network
206s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30-12-2023 10:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
15478642d48681a67374167d173d4f84.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
15478642d48681a67374167d173d4f84.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
15478642d48681a67374167d173d4f84.exe
-
Size
4.9MB
-
MD5
15478642d48681a67374167d173d4f84
-
SHA1
9790217e8b9a2134f2abf451ac68c847dc31c905
-
SHA256
4e1c013bf36b27f78e0fdc7ab5a67bc3f62f33c97f5848daf40df7ec7d842fa4
-
SHA512
4b8c58f0605c562bddddabff542b76a06a65206c90c3bf430752785287fc88afc2a38c7780e1d94650735ec9a0f45ad8d9540e10fd0300734626c867d0ee5819
-
SSDEEP
98304:6jT71ntlY5xzFunCcZ2iH9oFfQPjpw6D8cKuEBQ5Qbg+db778Fm/S3DdK1NPgf6K:i3fCcZZ2VQtbXQ9A5DdK1NPgCWXaYRX7
Score
10/10
Malware Config
Extracted
Family
bitrat
Version
1.38
C2
185.215.113.102:1234
Attributes
-
communication_password
5d55208d3d81a0bf50741250fe5b93d7
-
install_dir
GuiterX
-
install_file
GuiterX.exe
-
tor_process
tor
Signatures
-
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GuiterX = "C:\\Users\\Admin\\AppData\\Local\\GuiterX\\GuiterX.exe퀀" 15478642d48681a67374167d173d4f84.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GuiterX = "C:\\Users\\Admin\\AppData\\Local\\GuiterX\\GuiterX.exeȀ" 15478642d48681a67374167d173d4f84.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GuiterX = "C:\\Users\\Admin\\AppData\\Local\\GuiterX\\GuiterX.exe⬀" 15478642d48681a67374167d173d4f84.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GuiterX = "C:\\Users\\Admin\\AppData\\Local\\GuiterX\\GuiterX.exe팀" 15478642d48681a67374167d173d4f84.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GuiterX = "C:\\Users\\Admin\\AppData\\Local\\GuiterX\\GuiterX.exe" 15478642d48681a67374167d173d4f84.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
pid Process 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe -
Suspicious behavior: RenamesItself 11 IoCs
pid Process 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 3532 15478642d48681a67374167d173d4f84.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3532 15478642d48681a67374167d173d4f84.exe 3532 15478642d48681a67374167d173d4f84.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\15478642d48681a67374167d173d4f84.exe"C:\Users\Admin\AppData\Local\Temp\15478642d48681a67374167d173d4f84.exe"1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3532