43358b1bf2342e4c45179ffe1eba80b41fe64ca7aba3cf0e551f5ceada787b59

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/03/2024, 04:01

Target
$PLUGINSDIR/Gossiper.exe
Size 5.1MB
Sample240321-elpassbd94
SHA256 250d3b191f5a723fc9b045fbb9b89c747cade393d85705966f8cec58e6373a00
MD5 1c89e1b7b17c0ada4b6dfe347493a835
SHA1 1215b533ec5b67d23cd59551da50658b5d5e6288
SHA512 1b9bcd900ed17e3441c9691c85483c5d82809c009da01ba74e8f6f8dd3da3d06fd0949f7d4fc6dcbbc3aeedb10d495e5699faa14b802ae4f5fad2167f35bf77a
SSDEEP 98304:LnREBoBGZxci3pItnmLufTzki76yvdvwwWcUCTivQI7qQ9l7f1FzbQt:LkoBGTNSQOzv5vccHT27TlvG
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2372	GLB4F1A.tmp

Loads dropped DLL 3 IoCs

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\GLBSINST.%$D	GLB4F1A.tmp

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\C:\Users\Admin\AppData\Local\Temp\INSTALL.LOG	GLB4F1A.tmp
File created	C:\C:\Users\Admin\AppData\Local\Temp\INSTALL.LOG	GLB4F1A.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2372	2292	Gossiper.exe	28
PID 2292 wrote to memory of 2372	2292	Gossiper.exe	28
PID 2292 wrote to memory of 2372	2292	Gossiper.exe	28
PID 2292 wrote to memory of 2372	2292	Gossiper.exe	28
PID 2292 wrote to memory of 2372	2292	Gossiper.exe	28
PID 2292 wrote to memory of 2372	2292	Gossiper.exe	28
PID 2292 wrote to memory of 2372	2292	Gossiper.exe	28

GLB4F1A.tmp

Path \Users\Admin\AppData\Local\Temp\GLB4F1A.tmp
Size 70KB
SHA256 5630aad833e5ae2eaa4e0e4ea2f829779470e7e22dcca28a6b2e96c352d737b9
MD5 a64e7a7a00ae2ef9c15cb721c60c60c7
SHA1 b738107d696aec72a3fc5a371c23023386c50b7d
SHA512 05d9adfecf9d1ee19faa9fe108c6dc0e237b00f5e4c6e65ee7e9657287271961b018e8ea949c07e3a63ef37d423138ea80f825df5f6e12189157c57c5317dcf3
SSDEEP 1536:bgiiJZEE8LjsUXb6huJkHYD8QNMYqqleYFjuKfMcXrP3wP1uK:bsJ6EObNuYDvFebKpjwd5
MD5 SHA1 SHA512 SSDEEP

Submit Download

GLC4F68.tmp

Path \Users\Admin\AppData\Local\Temp\GLC4F68.tmp
Size 161KB
SHA256 a87f19f9fee475d2b2e82acfb4589be6d816b613064cd06826e1d4c147beb50a
MD5 8c97d8bb1470c6498e47b12c5a03ce39
SHA1 15d233b22f1c3d756dca29bcc0021e6fb0b8cdf7
SHA512 7ad0b2b0319da52152c2595ee45045d0c06b157cdaaa56ad57dde9736be3e45fd7357949126f80d3e72b21510f9bf69d010d51b3967a7644662808beed067c3f
SSDEEP 3072:5kgzCh4age/BKZ5akmUbe2Rm9+ORsUIlyR6J7ooLGA5:9zCuagOcZ5ak36pTRTvRKGA5
MD5 SHA1 SHA512 SSDEEP

Submit Download

GLK4FA7.tmp

Path \Users\Admin\AppData\Local\Temp\GLK4FA7.tmp
Size 33KB
SHA256 bfe7e013cfb85e78b994d3ad34eca08286494a835cb85f1d7bced3df6fe93a11
MD5 517419cae37f6c78c80f9b7d0fbb8661
SHA1 a9e419f3d9ef589522556e0920c84fe37a548873
SHA512 5046565443cf463b6fa4d2d5868879efc6a9db969bf05e3c80725b99bd091ce062cfe66c5551eb1cc5f00a38f2cfcda1f36fb4d60d9ff816c4ec3107b5a0df40
SSDEEP 384:8lB+vEr4Ry91G5GkrCiKY4WyWMmqnXDYjESmvmkIKXMoCu+7/U:Hhy91G5GCCiK1mqXr1
MD5 SHA1 SHA512 SSDEEP

Submit Download