Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
05-02-2024 11:04
Static task
static1
Behavioral task
behavioral1
Sample
91d38ff34f7873e73bcc3860dcfebb61.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
91d38ff34f7873e73bcc3860dcfebb61.exe
Resource
win10v2004-20231215-en
General
-
Target
91d38ff34f7873e73bcc3860dcfebb61.exe
-
Size
147KB
-
MD5
91d38ff34f7873e73bcc3860dcfebb61
-
SHA1
89708ae9a87da9547e5b107ed444d457b2c753eb
-
SHA256
6fd9798ecac7cdfd94e55a36b9be488f9f52db44cd012ebbf2b718c8ffa5ff44
-
SHA512
ef004be03571d0e17afc3c785adb75fe974a59010e271307e9252cf2436a0118ee9c0fff7b24a5512d31e7f54c69ed562414484e90c78cf196cb5ac78fc8fea4
-
SSDEEP
3072:Yid3OHRBIRVcJ3Yeq4lExI7clo8gSyn+9C:7BOIYGe5lkovuC
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 2728 netsh.exe -
Drops startup file 2 IoCs
Processes:
91d38ff34f7873e73bcc3860dcfebb61.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\egjtd.exe 91d38ff34f7873e73bcc3860dcfebb61.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\egjtd.exe 91d38ff34f7873e73bcc3860dcfebb61.exe -
Executes dropped EXE 1 IoCs
Processes:
gssbqu.exepid process 2704 gssbqu.exe -
Loads dropped DLL 2 IoCs
Processes:
91d38ff34f7873e73bcc3860dcfebb61.exegssbqu.exepid process 2756 91d38ff34f7873e73bcc3860dcfebb61.exe 2704 gssbqu.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
91d38ff34f7873e73bcc3860dcfebb61.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\hehkilji = "C:\\Users\\Admin\\AppData\\Local\\gssbqu.exe" 91d38ff34f7873e73bcc3860dcfebb61.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\hehkilji = "C:\\Users\\Admin\\AppData\\Local\\gssbqu.exe" 91d38ff34f7873e73bcc3860dcfebb61.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
91d38ff34f7873e73bcc3860dcfebb61.exedescription pid process target process PID 1216 set thread context of 2756 1216 91d38ff34f7873e73bcc3860dcfebb61.exe 91d38ff34f7873e73bcc3860dcfebb61.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
91d38ff34f7873e73bcc3860dcfebb61.exe91d38ff34f7873e73bcc3860dcfebb61.exegssbqu.exedescription pid process target process PID 1216 wrote to memory of 2756 1216 91d38ff34f7873e73bcc3860dcfebb61.exe 91d38ff34f7873e73bcc3860dcfebb61.exe PID 1216 wrote to memory of 2756 1216 91d38ff34f7873e73bcc3860dcfebb61.exe 91d38ff34f7873e73bcc3860dcfebb61.exe PID 1216 wrote to memory of 2756 1216 91d38ff34f7873e73bcc3860dcfebb61.exe 91d38ff34f7873e73bcc3860dcfebb61.exe PID 1216 wrote to memory of 2756 1216 91d38ff34f7873e73bcc3860dcfebb61.exe 91d38ff34f7873e73bcc3860dcfebb61.exe PID 1216 wrote to memory of 2756 1216 91d38ff34f7873e73bcc3860dcfebb61.exe 91d38ff34f7873e73bcc3860dcfebb61.exe PID 1216 wrote to memory of 2756 1216 91d38ff34f7873e73bcc3860dcfebb61.exe 91d38ff34f7873e73bcc3860dcfebb61.exe PID 1216 wrote to memory of 2756 1216 91d38ff34f7873e73bcc3860dcfebb61.exe 91d38ff34f7873e73bcc3860dcfebb61.exe PID 1216 wrote to memory of 2756 1216 91d38ff34f7873e73bcc3860dcfebb61.exe 91d38ff34f7873e73bcc3860dcfebb61.exe PID 2756 wrote to memory of 2728 2756 91d38ff34f7873e73bcc3860dcfebb61.exe netsh.exe PID 2756 wrote to memory of 2728 2756 91d38ff34f7873e73bcc3860dcfebb61.exe netsh.exe PID 2756 wrote to memory of 2728 2756 91d38ff34f7873e73bcc3860dcfebb61.exe netsh.exe PID 2756 wrote to memory of 2728 2756 91d38ff34f7873e73bcc3860dcfebb61.exe netsh.exe PID 2756 wrote to memory of 2704 2756 91d38ff34f7873e73bcc3860dcfebb61.exe gssbqu.exe PID 2756 wrote to memory of 2704 2756 91d38ff34f7873e73bcc3860dcfebb61.exe gssbqu.exe PID 2756 wrote to memory of 2704 2756 91d38ff34f7873e73bcc3860dcfebb61.exe gssbqu.exe PID 2756 wrote to memory of 2704 2756 91d38ff34f7873e73bcc3860dcfebb61.exe gssbqu.exe PID 2704 wrote to memory of 2660 2704 gssbqu.exe gssbqu.exe PID 2704 wrote to memory of 2660 2704 gssbqu.exe gssbqu.exe PID 2704 wrote to memory of 2660 2704 gssbqu.exe gssbqu.exe PID 2704 wrote to memory of 2660 2704 gssbqu.exe gssbqu.exe PID 2704 wrote to memory of 2660 2704 gssbqu.exe gssbqu.exe PID 2704 wrote to memory of 2660 2704 gssbqu.exe gssbqu.exe PID 2704 wrote to memory of 2660 2704 gssbqu.exe gssbqu.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\91d38ff34f7873e73bcc3860dcfebb61.exe"C:\Users\Admin\AppData\Local\Temp\91d38ff34f7873e73bcc3860dcfebb61.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\91d38ff34f7873e73bcc3860dcfebb61.exeC:\Users\Admin\AppData\Local\Temp\91d38ff34f7873e73bcc3860dcfebb61.exe2⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram 1.exe 1 ENABLE3⤵
- Modifies Windows Firewall
-
C:\Users\Admin\AppData\Local\gssbqu.exe"C:\Users\Admin\AppData\Local\gssbqu.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\gssbqu.exeC:\Users\Admin\AppData\Local\gssbqu.exe4⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\gssbqu.exeFilesize
147KB
MD591d38ff34f7873e73bcc3860dcfebb61
SHA189708ae9a87da9547e5b107ed444d457b2c753eb
SHA2566fd9798ecac7cdfd94e55a36b9be488f9f52db44cd012ebbf2b718c8ffa5ff44
SHA512ef004be03571d0e17afc3c785adb75fe974a59010e271307e9252cf2436a0118ee9c0fff7b24a5512d31e7f54c69ed562414484e90c78cf196cb5ac78fc8fea4
-
memory/1216-26-0x0000000000860000-0x0000000000960000-memory.dmpFilesize
1024KB
-
memory/1216-11-0x0000000000860000-0x0000000000960000-memory.dmpFilesize
1024KB
-
memory/1216-67-0x0000000000860000-0x0000000000960000-memory.dmpFilesize
1024KB
-
memory/1216-15-0x0000000000860000-0x0000000000960000-memory.dmpFilesize
1024KB
-
memory/1216-9-0x0000000000860000-0x0000000000960000-memory.dmpFilesize
1024KB
-
memory/1216-13-0x0000000000860000-0x0000000000960000-memory.dmpFilesize
1024KB
-
memory/1216-28-0x0000000000860000-0x0000000000960000-memory.dmpFilesize
1024KB
-
memory/2704-49-0x0000000000560000-0x0000000000660000-memory.dmpFilesize
1024KB
-
memory/2704-52-0x0000000000560000-0x0000000000660000-memory.dmpFilesize
1024KB
-
memory/2704-69-0x0000000000560000-0x0000000000660000-memory.dmpFilesize
1024KB
-
memory/2704-68-0x0000000000560000-0x0000000000660000-memory.dmpFilesize
1024KB
-
memory/2704-58-0x0000000000560000-0x0000000000660000-memory.dmpFilesize
1024KB
-
memory/2704-56-0x0000000000560000-0x0000000000660000-memory.dmpFilesize
1024KB
-
memory/2756-17-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2756-27-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2756-19-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2756-31-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2756-60-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2756-14-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2756-30-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2756-21-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB