Overview
overview
7Static
static
3GDLauncher...up.exe
windows7-x64
7GDLauncher...up.exe
windows10-2004-x64
7$PLUGINSDI...er.dll
windows7-x64
1$PLUGINSDI...er.dll
windows10-2004-x64
1$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows7-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3$PLUGINSDIR/app-64.7z
windows7-x64
3$PLUGINSDIR/app-64.7z
windows10-2004-x64
77za.exe
windows7-x64
17za.exe
windows10-2004-x64
1GDLauncher.exe
windows7-x64
7GDLauncher.exe
windows10-2004-x64
7LICENSES.c...m.html
windows7-x64
1LICENSES.c...m.html
windows10-2004-x64
1chrome_100...nt.pak
windows7-x64
3chrome_100...nt.pak
windows10-2004-x64
3chrome_200...nt.pak
windows7-x64
3chrome_200...nt.pak
windows10-2004-x64
3concrt140.dll
windows7-x64
1concrt140.dll
windows10-2004-x64
1d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows7-x64
1ffmpeg.dll
windows10-2004-x64
1icudtl.dat
windows7-x64
3icudtl.dat
windows10-2004-x64
3libEGL.dll
windows7-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows7-x64
1Analysis
-
max time kernel
120s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22/02/2024, 17:44
Static task
static1
Behavioral task
behavioral1
Sample
GDLauncher-win-setup.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
GDLauncher-win-setup.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240220-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/WinShell.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/app-64.7z
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/app-64.7z
Resource
win10v2004-20240221-en
Behavioral task
behavioral13
Sample
7za.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
7za.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral15
Sample
GDLauncher.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
GDLauncher.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral17
Sample
LICENSES.chromium.html
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
LICENSES.chromium.html
Resource
win10v2004-20240221-en
Behavioral task
behavioral19
Sample
chrome_100_percent.pak
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
chrome_100_percent.pak
Resource
win10v2004-20240221-en
Behavioral task
behavioral21
Sample
chrome_200_percent.pak
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
chrome_200_percent.pak
Resource
win10v2004-20240221-en
Behavioral task
behavioral23
Sample
concrt140.dll
Resource
win7-20240215-en
Behavioral task
behavioral24
Sample
concrt140.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral25
Sample
d3dcompiler_47.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral26
Sample
ffmpeg.dll
Resource
win7-20240221-en
Behavioral task
behavioral27
Sample
ffmpeg.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral28
Sample
icudtl.dat
Resource
win7-20240221-en
Behavioral task
behavioral29
Sample
icudtl.dat
Resource
win10v2004-20240221-en
Behavioral task
behavioral30
Sample
libEGL.dll
Resource
win7-20240221-en
Behavioral task
behavioral31
Sample
libEGL.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral32
Sample
libGLESv2.dll
Resource
win7-20240220-en
General
-
Target
icudtl.dat
-
Size
9.9MB
-
MD5
c6ae43f9d596f3dd0d86fb3e62a5b5de
-
SHA1
198b3b4abc0f128398d25c66455c531a7af34a6d
-
SHA256
00f755664926fda5fda14b87af41097f6ea4b20154f90be65d73717580db26ee
-
SHA512
3c43e2dcdf037726a94319a147a8bc41a4c0fd66e6b18b3c7c95449912bf875382dde5ec0525dcad6a52e8820b0859caf8fa73cb287283334ec8d06eb3227ec4
-
SSDEEP
196608:tGzwSv9AAQu1+liXUxCGZHa93Whlw6ZzbSEQF:t3KlQusliXUxCGZHa93Whlw6ZzbSEQF
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.dat\ = "dat_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\dat_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\dat_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\dat_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\dat_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\dat_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.dat rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\dat_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2728 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2728 AcroRd32.exe 2728 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3016 wrote to memory of 2532 3016 cmd.exe 29 PID 3016 wrote to memory of 2532 3016 cmd.exe 29 PID 3016 wrote to memory of 2532 3016 cmd.exe 29 PID 2532 wrote to memory of 2728 2532 rundll32.exe 30 PID 2532 wrote to memory of 2728 2532 rundll32.exe 30 PID 2532 wrote to memory of 2728 2532 rundll32.exe 30 PID 2532 wrote to memory of 2728 2532 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\icudtl.dat1⤵
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\icudtl.dat2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\icudtl.dat"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2728
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5d7c211123735aa698fdb80875994bdb6
SHA1f467ce5217959d26267389b348709333424e34e3
SHA256a3c6231a506d0edfa42808a25c8260f8c3295fe19d585f6d441ad7047d824e08
SHA5120f8070698ab121b707a991bc6c547ba57503c4a63643a0891f8af9135688aacb0dbacc734afb622b5878e19e032d09e70e2368ca07b9daa9848b7937cfed000a