d2c38cecf49e55b35607cb0407a427fc6c0003909038466c8242120703fc7202

General

Target

74331fc1a01348185f62475ee5471472.exe
Size

1.4MB
MD5

74331fc1a01348185f62475ee5471472
SHA1

9c03c6dfc9786dfb960e5d4b1bd6db4fe5a036b2
SHA256

d2c38cecf49e55b35607cb0407a427fc6c0003909038466c8242120703fc7202
SHA512

114069ecf6ba1ff2b101cc6c86de3a5a95ae9b0e7517fdabda057507fcf4ccf76e87516ba019666504f57abbfb011dad3bfa87382d88f74bb913eb81af63fa32
SSDEEP

24576:BzMhy7MCOI7QAJcJpItV8xjPhrmR4Y4ptRNEg2JUYnbuR656+3xCu8kjfaY:BBMCOIBWOtmxjPkyYElOUK6R6pou1fB

Score

10^/10

evasion persistence trojan upx

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	GBTR_SENTRA.exe

Disables Task Manager via registry modification
evasion

Executes dropped EXE 1 IoCs

pid	Process
2536	GBTR_SENTRA.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2204-0-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral1/memory/2204-14-0x0000000000400000-0x0000000000424000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\GBTR_SENTRA = "C:\\GBTR_SENTRA.exe"	GBTR_SENTRA.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	GBTR_SENTRA.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2204	74331fc1a01348185f62475ee5471472.exe
Token: SeBackupPrivilege	2204	74331fc1a01348185f62475ee5471472.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2536	2204	74331fc1a01348185f62475ee5471472.exe	20
PID 2204 wrote to memory of 2536	2204	74331fc1a01348185f62475ee5471472.exe	20
PID 2204 wrote to memory of 2536	2204	74331fc1a01348185f62475ee5471472.exe	20
PID 2204 wrote to memory of 2536	2204	74331fc1a01348185f62475ee5471472.exe	20
PID 2204 wrote to memory of 2536	2204	74331fc1a01348185f62475ee5471472.exe	20
PID 2204 wrote to memory of 2536	2204	74331fc1a01348185f62475ee5471472.exe	20
PID 2204 wrote to memory of 2536	2204	74331fc1a01348185f62475ee5471472.exe	20

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	GBTR_SENTRA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	GBTR_SENTRA.exe

C:\Users\Admin\AppData\Local\Temp\74331fc1a01348185f62475ee5471472.exe
"C:\Users\Admin\AppData\Local\Temp\74331fc1a01348185f62475ee5471472.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2204
- C:\GBTR_SENTRA.exe
  "C:\GBTR_SENTRA.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - System policy modification
  PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\GBTR_SENTRA.exe

Filesize
455KB

MD5
0a33e4e29028239d73eacff70bcab7e9

SHA1
70c2e1836acaab5d4b2c3a06822cd865ca4e077f

SHA256
e48d42793e05f745a3513cf63a0be24cddcfbd1317baad75d75afd135f39a9d9

SHA512
538c647eb7d69f02d81c65154b7f2bca2f416ca5daaefc60e401d06168950cfbcbf7ef439f6ff973b1678863378a0c32ac0ab85f8be755f48c7cd98b267d0bc5

Download Submit
C:\GBTR_SENTRA.exe

Filesize
492KB

MD5
e49531fc58972e4219ca478f8538d222

SHA1
b81f0cdf0990a44cc0cf8a8ddd60b0c5b727f117

SHA256
a71cde1f272296ea0e409fc5ced1d7b6289ac551ba2bedcac6116315c599baf2

SHA512
58a63044bd960459d6edb9278f6d6c696d184e404f4b8bcec551792a11a9973e850255f55832ef80de38d2e12017176624754c72aacbde23f564a76adb7cdbb9

Download Submit
C:\GBTR_SENTRA.exe

Filesize
403KB

MD5
7bb7f6f91467b518eeb3fcd2846e034b

SHA1
d429c319be34693a8fead40638495dfbeadc3f16

SHA256
1c01d850e3b16d97cb62df0aedfd2217221fd802ad14fc6a2640ca41a4c00781

SHA512
38a7e8ece999162d42d50406aa7c066de5357fa1b8eff3e32dc791d8dba3c2c836758d29a400bf7c877db5d46fe97fd4253d67e894aef82b58e0332fc2015def

Download Submit
C:\libmySQL50.dll

Filesize
398KB

MD5
cf29b6a1fabaadbc484b18018bdceae8

SHA1
57b7b0cf95e0b45b244135cb47602939abe12b52

SHA256
40693e09cb6df1aee721c9c74a8ead967cccf48dabeab7fa3a9ad3f930a152e2

SHA512
761528beb7e447f38251d3001f696098d730cef0b557c8c7e187bfcff8c15800735ce7fbe41badb2bd0d33eaf896fcd32f59f1e2d89483d3b8636b89325ae8d7

Download Submit
memory/2204-25-0x0000000003660000-0x00000000038B0000-memory.dmp

Filesize
2.3MB

Download
memory/2204-14-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2204-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2204-3-0x0000000000240000-0x0000000000264000-memory.dmp

Filesize
144KB

Download
memory/2204-1-0x0000000000240000-0x0000000000264000-memory.dmp

Filesize
144KB

Download
memory/2204-15-0x0000000003660000-0x00000000038B0000-memory.dmp

Filesize
2.3MB

Download
memory/2204-2-0x0000000000240000-0x0000000000264000-memory.dmp

Filesize
144KB

Download
memory/2536-20-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2536-19-0x0000000000400000-0x0000000000650000-memory.dmp

Filesize
2.3MB

Download
memory/2536-18-0x0000000000EB0000-0x0000000001100000-memory.dmp

Filesize
2.3MB

Download
memory/2536-23-0x0000000000400000-0x0000000000650000-memory.dmp

Filesize
2.3MB

Download
memory/2536-17-0x0000000000EB0000-0x0000000001100000-memory.dmp

Filesize
2.3MB

Download
memory/2536-26-0x0000000000EB0000-0x0000000001100000-memory.dmp

Filesize
2.3MB

Download
memory/2536-27-0x0000000000400000-0x0000000000650000-memory.dmp

Filesize
2.3MB

Download
memory/2536-28-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2536-33-0x0000000000400000-0x0000000000650000-memory.dmp

Filesize
2.3MB

Download
memory/2536-34-0x0000000000400000-0x0000000000650000-memory.dmp

Filesize
2.3MB

Download
memory/2536-35-0x0000000000400000-0x0000000000650000-memory.dmp

Filesize
2.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads