1fdb4c3d83d707f399a4d721f3350d5ae01545a4ba06998259dba8b3b1886e8c

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2024, 16:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1fdb4c3d83d707f399a4d721f3350d5ae01545a4ba06998259dba8b3b1886e8c.exe
Size

2.3MB
MD5

7e9667a8146d3338f001a66d9845daa2
SHA1

2ffbf169e41fa9759891d3d314156e0125325a67
SHA256

1fdb4c3d83d707f399a4d721f3350d5ae01545a4ba06998259dba8b3b1886e8c
SHA512

b05722e1e889867aecba0b504615371ef38c6cf31866b138b39f8f528dd7b15a98a47065e0eff5bfe59edfb6c304992410a80985617df68a737e6b02ff991695
SSDEEP

49152:pN4D+rOBMQe8ywfzIS6+N8t96i9+HxT29iAjWVai/ZB3kbuRNQbKgF/3:pN4D0O+nwfzISE9T2xAS3kbujgp

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4204	gpu.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0006000000023215-4.dat	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4204	gpu.exe
4204	gpu.exe
4204	gpu.exe
4204	gpu.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
4204	gpu.exe
4204	gpu.exe
4204	gpu.exe
4204	gpu.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 4204	4504	1fdb4c3d83d707f399a4d721f3350d5ae01545a4ba06998259dba8b3b1886e8c.exe	89
PID 4504 wrote to memory of 4204	4504	1fdb4c3d83d707f399a4d721f3350d5ae01545a4ba06998259dba8b3b1886e8c.exe	89

C:\Users\Admin\AppData\Local\Temp\1fdb4c3d83d707f399a4d721f3350d5ae01545a4ba06998259dba8b3b1886e8c.exe
"C:\Users\Admin\AppData\Local\Temp\1fdb4c3d83d707f399a4d721f3350d5ae01545a4ba06998259dba8b3b1886e8c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Users\Administrator\lgx\gpu.exe
  "C:\Users\Administrator\lgx\gpu.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Administrator\lgx\gpu.exe

Filesize
1.0MB

MD5
e83cbcd2ac2f1034e0d16e05619f2370

SHA1
3dacb5acc91ecbc434b7f206affa0651e8e0275f

SHA256
6eb154f3cc161daa9978d609e4c53e4432075634dd0849fddfd31c66a135f5c4

SHA512
c318445cc3900ea494ae8175f7d7345cbb2f09c2b18608d9694b249a90c32c566060d3c48cc726f1642d1d6dcc5da6310f87d077ed3220bcacafd96a9c2eefe1

Download Submit