Overview
overview
10Static
static
3VMM.zip
windows7-x64
7VMM.zip
windows10-2004-x64
1Data.exe
windows7-x64
1Data.exe
windows10-2004-x64
1Setup.exe
windows7-x64
5Setup.exe
windows10-2004-x64
10iepdf32.dll
windows7-x64
3iepdf32.dll
windows10-2004-x64
3indecorum.tiff
windows7-x64
3indecorum.tiff
windows10-2004-x64
3plugins/Co...st.dll
windows7-x64
1plugins/Co...st.dll
windows10-2004-x64
1plugins/Np...er.dll
windows7-x64
1plugins/Np...er.dll
windows10-2004-x64
1plugins/Np...rt.dll
windows7-x64
1plugins/Np...rt.dll
windows10-2004-x64
1plugins/mi...ls.dll
windows7-x64
1plugins/mi...ls.dll
windows10-2004-x64
1rubadub.odp
windows7-x64
1rubadub.odp
windows10-2004-x64
1updater/GUP.exe
windows7-x64
1updater/GUP.exe
windows10-2004-x64
6updater/LICENSE
windows7-x64
1updater/LICENSE
windows10-2004-x64
1updater/README.md
windows7-x64
3updater/README.md
windows10-2004-x64
3updater/enco.exe
windows7-x64
6updater/enco.exe
windows10-2004-x64
6updater/gup.xml
windows7-x64
1updater/gup.xml
windows10-2004-x64
1updater/libcurl.dll
windows7-x64
1updater/libcurl.dll
windows10-2004-x64
1Analysis
-
max time kernel
146s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06/04/2024, 06:52
Static task
static1
Behavioral task
behavioral1
Sample
VMM.zip
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
VMM.zip
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Data.exe
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
Data.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
Setup.exe
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
Setup.exe
Resource
win10v2004-20240319-en
Behavioral task
behavioral7
Sample
iepdf32.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
iepdf32.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
indecorum.tiff
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
indecorum.tiff
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
plugins/Config/nppPluginList.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
plugins/Config/nppPluginList.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
plugins/NppConverter/NppConverter.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
plugins/NppConverter/NppConverter.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
plugins/NppExport/NppExport.dll
Resource
win7-20240220-en
Behavioral task
behavioral16
Sample
plugins/NppExport/NppExport.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral17
Sample
plugins/mimeTools/mimeTools.dll
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
plugins/mimeTools/mimeTools.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
rubadub.odp
Resource
win7-20240319-en
Behavioral task
behavioral20
Sample
rubadub.odp
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
updater/GUP.exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
updater/GUP.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
updater/LICENSE
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
updater/LICENSE
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
updater/README.md
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
updater/README.md
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
updater/enco.exe
Resource
win7-20240215-en
Behavioral task
behavioral28
Sample
updater/enco.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
updater/gup.xml
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
updater/gup.xml
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
updater/libcurl.dll
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
updater/libcurl.dll
Resource
win10v2004-20240226-en
General
-
Target
updater/GUP.exe
-
Size
818KB
-
MD5
1884dd352c2b8df7e7ee80573af580ac
-
SHA1
cabd8ed8b7c65f403ecdd90a9dff142b044fb3fc
-
SHA256
f22a7438a2226321324a81926bb311c25377ce977a32c84064d29e932fa22598
-
SHA512
a90fa4a1dbf789b0a9d085e4e3dfbb6fe2efe5dccabe311bb6411529e5cb465e575291e414d86acbe82c9b39eb6d6cf92c45e5d29d6ff75782d98c201863039c
-
SSDEEP
12288:HySK0M5qRxaBr5wFNbgpA0WUVzOR63AczZXBS3CNmBDIOh68ADKbp34zZZ6dNNoq:SqMo2aWqT2KbpIFZ6PNeTw
Malware Config
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation GUP.exe -
Executes dropped EXE 1 IoCs
pid Process 3220 npp.8.6.5.Installer.exe -
Loads dropped DLL 4 IoCs
pid Process 3220 npp.8.6.5.Installer.exe 3220 npp.8.6.5.Installer.exe 3220 npp.8.6.5.Installer.exe 3220 npp.8.6.5.Installer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4368 GUP.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4368 wrote to memory of 3220 4368 GUP.exe 93 PID 4368 wrote to memory of 3220 4368 GUP.exe 93 PID 4368 wrote to memory of 3220 4368 GUP.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\updater\GUP.exe"C:\Users\Admin\AppData\Local\Temp\updater\GUP.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\npp.8.6.5.Installer.exe"C:\Users\Admin\AppData\Local\Temp\npp.8.6.5.Installer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3220
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.5MB
MD56f7e2e04a4e06254fd1454515eb0331d
SHA1ba940c6b526da1ce127f43b835b4d8c9d5c4b59c
SHA2565180a17f24df75ccc000cdc2904b14c865ccfd7521909bf06cc75189a65c3e2f
SHA512b230bea0ea463a34c3f01c5714d2dbd8dc9023ac373e46f4ec821fabb876d977fe3f5814740e903650a3d604422fef12bd7bbab7e1b531d9688af8111b30d859
-
Filesize
15KB
MD5d095b082b7c5ba4665d40d9c5042af6d
SHA12220277304af105ca6c56219f56f04e894b28d27
SHA256b2091205e225fc07daf1101218c64ce62a4690cacac9c3d0644d12e93e4c213c
SHA51261fb5cf84028437d8a63d0fda53d9fe0f521d8fe04e96853a5b7a22050c4c4fb5528ff0cdbb3ae6bc74a5033563fc417fc7537e4778227c9fd6633ae844c47d9
-
Filesize
5KB
MD550016010fb0d8db2bc4cd258ceb43be5
SHA144ba95ee12e69da72478cf358c93533a9c7a01dc
SHA25632230128c18574c1e860dfe4b17fe0334f685740e27bc182e0d525a8948c9c2e
SHA512ed4cf49f756fbf673449dca20e63dce6d3a612b61f294efc9c3ccebeffa6a1372667932468816d3a7afdb7e5a652760689d8c6d3f331cedee7247404c879a233
-
Filesize
12KB
MD54add245d4ba34b04f213409bfe504c07
SHA1ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
SHA2569111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
SHA5121bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
-
Filesize
1KB
MD5bf874b71933a47516bfeeb045c90b42b
SHA1fa94e0fc3d7c3c38ba0b62d28fe4bf9ed98cc5dd
SHA25601a9b42b23ce0be7164d4a6da8452cb2e2f60ea81c2dd6a6a0616f7760727054
SHA51201d073dd3356225c53b5320bf07d94b6c88c0b484da1b220b0f0981a06898e242cc8c5a0a428cc4821d3a049122acc405a562d455762f5c4f1d100af0661a2ab