d37b20f11852070f2b4c59ad5c117382e0801ef806855015b464c7a5459f701d

Analysis

max time kernel
1738s
max time network
1152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/02/2024, 09:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GoDm/src/structs.go
Size

8KB
MD5

57ee28583a75357f1ca926eb61fe4757
SHA1

0a093cb7f586357c9e61b7daee8084229db3ae52
SHA256

a409e3e0b1ef8a0eade566867973f4ce239e6c44ec2533135ae14150391bfa12
SHA512

43e9be9db8757bb7f868e4a7072b835ae3aabaf2ca31b864166cacfd40bc006c6425960b1a6d3685b040314b967fde69e70ef80c41ec60ef9e4368e7f12e9910
SSDEEP

192:YrCB2F1EJW9fmfpuXFfKdO7L+koFPTWDoFxAlt746NLWoj:SCB2FyW9fmhuXFWkoLkDWoj

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	4880	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1292	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\GoDm\src\structs.go
1⤵
- Modifies registry class
PID:4172

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1292

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:3300

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

Filesize
16KB

MD5
b6548a5c4b59d5f84a311041a3b2d743

SHA1
a39f39e9a7a7c44921df357b7d2b9adcec27944f

SHA256
9aafc140f7e04624b9df8c298488285bb50d5c4e8893e7abb3e4fc6e46ced5cc

SHA512
d02c8dac3f421f2c0958f0af02e83c409b8b4ce02f39b2f222d7f74b877a85a1632036f6847827228a33caaae07eea974ef643afa0399a75b74a170f69e96f87

Download Submit
memory/4880-40-0x00000191FA630000-0x00000191FA631000-memory.dmp

Filesize
4KB

Download
memory/4880-42-0x00000191FA630000-0x00000191FA631000-memory.dmp

Filesize
4KB

Download
memory/4880-33-0x00000191FA630000-0x00000191FA631000-memory.dmp

Filesize
4KB

Download
memory/4880-34-0x00000191FA630000-0x00000191FA631000-memory.dmp

Filesize
4KB

Download
memory/4880-35-0x00000191FA630000-0x00000191FA631000-memory.dmp

Filesize
4KB

Download
memory/4880-36-0x00000191FA630000-0x00000191FA631000-memory.dmp

Filesize
4KB

Download
memory/4880-37-0x00000191FA630000-0x00000191FA631000-memory.dmp

Filesize
4KB

Download
memory/4880-38-0x00000191FA630000-0x00000191FA631000-memory.dmp

Filesize
4KB

Download
memory/4880-39-0x00000191FA630000-0x00000191FA631000-memory.dmp

Filesize
4KB

Download
memory/4880-43-0x00000191FA260000-0x00000191FA261000-memory.dmp

Filesize
4KB

Download
memory/4880-32-0x00000191FA610000-0x00000191FA611000-memory.dmp

Filesize
4KB

Download
memory/4880-41-0x00000191FA630000-0x00000191FA631000-memory.dmp

Filesize
4KB

Download
memory/4880-0-0x00000191F1F40000-0x00000191F1F50000-memory.dmp

Filesize
64KB

Download
memory/4880-44-0x00000191FA250000-0x00000191FA251000-memory.dmp

Filesize
4KB

Download
memory/4880-46-0x00000191FA260000-0x00000191FA261000-memory.dmp

Filesize
4KB

Download
memory/4880-49-0x00000191FA250000-0x00000191FA251000-memory.dmp

Filesize
4KB

Download
memory/4880-52-0x00000191FA190000-0x00000191FA191000-memory.dmp

Filesize
4KB

Download
memory/4880-16-0x00000191F2040000-0x00000191F2050000-memory.dmp

Filesize
64KB

Download
memory/4880-64-0x00000191FA390000-0x00000191FA391000-memory.dmp

Filesize
4KB

Download
memory/4880-66-0x00000191FA3A0000-0x00000191FA3A1000-memory.dmp

Filesize
4KB

Download
memory/4880-67-0x00000191FA3A0000-0x00000191FA3A1000-memory.dmp

Filesize
4KB

Download
memory/4880-68-0x00000191FA4B0000-0x00000191FA4B1000-memory.dmp

Filesize
4KB

Download