3bf7b10d9960ff916bf58592dd1981fbe6a3be73c1cf9e57d564402652a18b62

Analysis

max time kernel
141s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 11:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

16a75bacfd82a05161928b7c5418b23f.exe
Size

363KB
MD5

16a75bacfd82a05161928b7c5418b23f
SHA1

49017ad75509a76480c8b61a49d7f5bb67bb5a72
SHA256

3bf7b10d9960ff916bf58592dd1981fbe6a3be73c1cf9e57d564402652a18b62
SHA512

362d9ec783508e55d90cf27e45b72cb10c5f168021293f37871d45a0d49bfb45a509b0f94597526b284f6bac879d7970d24c50905daf7e5e8785fd6b6a3bf42e
SSDEEP

6144:QRMeGsWuyp2TgwtwSDGYwgGjgx2GKLfXL7wNzv9q8Woq62a2yulov7rrkcaAiIEo:Vc912gaf7ENzilydnE/VC

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2936	0.exe
2932	Gtool.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\0.exe	16a75bacfd82a05161928b7c5418b23f.exe
File created	C:\Windows\Gtool.exe	0.exe
File opened for modification	C:\Windows\Gtool.exe	0.exe
File opened for modification	C:\Windows\0.exe	0.exe
File created	C:\Windows\uninstal.bat	0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 2936	1372	16a75bacfd82a05161928b7c5418b23f.exe	16
PID 1372 wrote to memory of 2936	1372	16a75bacfd82a05161928b7c5418b23f.exe	16
PID 1372 wrote to memory of 2936	1372	16a75bacfd82a05161928b7c5418b23f.exe	16
PID 1372 wrote to memory of 2936	1372	16a75bacfd82a05161928b7c5418b23f.exe	16
PID 2932 wrote to memory of 2548	2932	Gtool.exe	29
PID 2932 wrote to memory of 2548	2932	Gtool.exe	29
PID 2932 wrote to memory of 2548	2932	Gtool.exe	29
PID 2932 wrote to memory of 2548	2932	Gtool.exe	29
PID 2936 wrote to memory of 2708	2936	0.exe	32
PID 2936 wrote to memory of 2708	2936	0.exe	32
PID 2936 wrote to memory of 2708	2936	0.exe	32
PID 2936 wrote to memory of 2708	2936	0.exe	32
PID 2936 wrote to memory of 2708	2936	0.exe	32
PID 2936 wrote to memory of 2708	2936	0.exe	32
PID 2936 wrote to memory of 2708	2936	0.exe	32

C:\Windows\0.exe
"C:\Windows\0.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\uninstal.bat
  2⤵
  PID:2708

C:\Users\Admin\AppData\Local\Temp\16a75bacfd82a05161928b7c5418b23f.exe
"C:\Users\Admin\AppData\Local\Temp\16a75bacfd82a05161928b7c5418b23f.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1372

C:\Program Files\Internet Explorer\IEXPLORE.EXE
"C:\Program Files\Internet Explorer\IEXPLORE.EXE"
1⤵
PID:2548

C:\Windows\Gtool.exe
C:\Windows\Gtool.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\0.exe

Filesize
92KB

MD5
69571e81c097225acaa53e390edfdc5b

SHA1
0841f7ae6e44394aad734d2811e30392a800d141

SHA256
7fbe8d24a949d30e6f5370440d970266c45602c650bb9d820eac9a68c93f70e5

SHA512
e047b2d0cff6b50bf380da9590ef395dd84074403aced5f039fad39dda4a2701c2057cda81874476a9b9b24f3a761aabcf720e00e043b095d73843d5fe924dc5

Download Submit
memory/1372-7-0x00000000030C0000-0x00000000031E0000-memory.dmp

Filesize
1.1MB

Download
memory/1372-30-0x0000000000400000-0x0000000000401080-memory.dmp

Filesize
4KB

Download
memory/2932-18-0x0000000000400000-0x0000000000520000-memory.dmp

Filesize
1.1MB

Download
memory/2932-19-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2932-29-0x0000000000400000-0x0000000000520000-memory.dmp

Filesize
1.1MB

Download
memory/2936-14-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2936-10-0x0000000000400000-0x0000000000520000-memory.dmp

Filesize
1.1MB

Download
memory/2936-9-0x0000000000400000-0x0000000000520000-memory.dmp

Filesize
1.1MB

Download
memory/2936-8-0x0000000000400000-0x0000000000520000-memory.dmp

Filesize
1.1MB

Download
memory/2936-27-0x0000000000400000-0x0000000000520000-memory.dmp

Filesize
1.1MB

Download