829d348eb2637386211bfe31b9ce1cca1c545e3a18a60bf20513a969fe97596b

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
30-05-2024 17:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

gasai_cracked/Gasai.exe
Size

101.8MB
MD5

be4c06fafcf75bea728c6fc5c9a8bd8d
SHA1

c610f057ed82a128d0360d10160bcefe40e05ad4
SHA256

efbce42a1ef148232051b6396f21f308b2fb14e5332dbf0599393187a548abd8
SHA512

d126dadb5f67d4d04691d20ae2d22c30b8f39004ff18805d0336109adcbc4d882db4250df484fe404a69c29b4bf8e623414997d79885b8c70395714fa9b7d0c2
SSDEEP

3145728:bWpiySwgYRaISeDB1jdvHqpN/SC++VN/SLqrn0/fu/f:bWoySwx2s1jVKSCcqV

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 7 IoCs

pid	Process
2056	Gasai.exe
2056	Gasai.exe
2056	Gasai.exe
2056	Gasai.exe
2056	Gasai.exe
2056	Gasai.exe
2056	Gasai.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 2056	1908	Gasai.exe	29
PID 1908 wrote to memory of 2056	1908	Gasai.exe	29
PID 1908 wrote to memory of 2056	1908	Gasai.exe	29

C:\Users\Admin\AppData\Local\Temp\gasai_cracked\Gasai.exe
"C:\Users\Admin\AppData\Local\Temp\gasai_cracked\Gasai.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Users\Admin\AppData\Local\Temp\gasai_cracked\Gasai.exe
  "C:\Users\Admin\AppData\Local\Temp\gasai_cracked\Gasai.exe"
  2⤵
  - Loads dropped DLL
  PID:2056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI19082\api-ms-win-core-file-l2-1-0.dll

Filesize
20KB

MD5
50abf0a7ee67f00f247bada185a7661c

SHA1
0cddac9ac4db3bf10a11d4b79085ef9cb3fb84a1

SHA256
f957a4c261506484b53534a9be8931c02ec1a349b3f431a858f8215cecfec3f7

SHA512
c2694bb5d103baff1264926a04d2f0fe156b8815a23c3748412a81cc307b71a9236a0e974b5549321014065e393d10228a0f0004df9ba677f03b5d244a64b528

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI19082\api-ms-win-core-localization-l1-2-0.dll

Filesize
20KB

MD5
de5695f26a0bcb54f59a8bc3f9a4ecef

SHA1
99c32595f3edc2c58bdb138c3384194831e901d6

SHA256
e9539fce90ad8be582b25ab2d5645772c2a5fb195e602ecdbf12b980656e436a

SHA512
df635d5d51cdea24885ae9f0406f317ddcf04ecb6bfa26579bb2e256c457057607844ded4b52ff1f5ca25abe29d1eb2b20f1709cf19035d3829f36bbe31f550f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI19082\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
20KB

MD5
74c264cffc09d183fcb1555b16ea7e4b

SHA1
0b5b08cdf6e749b48254ac811ca09ba95473d47c

SHA256
a8e2fc077d9a7d2faa85e1e6833047c90b22c6086487b98fc0e6a86b7bf8bf09

SHA512
285afbcc39717510ced2ed096d9f77fc438268ecaa59cff3cf167fcc538e90c73c67652046b0ee379e0507d6e346af79d43c51a571c6dd66034f9385a73d00d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI19082\greenlet-1.1.2.dist-info\INSTALLER

Filesize
4B

MD5
365c9bfeb7d89244f2ce01c1de44cb85

SHA1
d7a03141d5d6b1e88b6b59ef08b6681df212c599

SHA256
ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

SHA512
d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI19082\jedi\third_party\typeshed\third_party\3\docutils\parsers\__init__.pyi

Filesize
63B

MD5
84a27291937d76e46b277653002601f2

SHA1
fe60efb40aeeee2998bb07245d4f9571ad08825f

SHA256
ddf071712a6926be84384714a23bdf946dc47a083b96fd90a7474d41020bacfe

SHA512
e489e83fd33fdc8ba88954725f79c2132bc4162ba713c72b190b790b4a368e3ceb024d7b8bceec4544123a5435fdfd987876f1b2542da06cba899f5ac72945be

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI19082\python310.dll

Filesize
4.2MB

MD5
a1185bef38fdba5e3fe6a71f93a9d142

SHA1
e2b40f5e518ad000002b239a84c153fdc35df4eb

SHA256
8d0bec69554317ccf1796c505d749d5c9f3be74ccbfce1d9e4d5fe64a536ae9e

SHA512
cb9baea9b483b9153efe2f453d6ac0f0846b140e465d07244f651c946900bfcd768a6b4c0c335ecebb45810bf08b7324501ea22b40cc7061b2f2bb98ed7897f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI19082\ucrtbase.dll

Filesize
1.1MB

MD5
3b337c2d41069b0a1e43e30f891c3813

SHA1
ebee2827b5cb153cbbb51c9718da1549fa80fc5c

SHA256
c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7

SHA512
fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI19082\api-ms-win-core-file-l1-2-0.dll

Filesize
20KB

MD5
d92e6a007fc22a1e218552ebfb65da93

SHA1
3c9909332e94f7b7386664a90f52730f4027a75a

SHA256
03bd3217eae0ef68521b39556e7491292db540f615da873dd8da538693b81862

SHA512
b8b0e6052e68c08e558e72c168e4ff318b1907c4dc5fc1cd1104f5cae7cc418293013dabbb30c835a5c35a456e1cb22cc352b7ae40f82b9b7311bb7419d854c7

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI19082\api-ms-win-core-timezone-l1-1-0.dll

Filesize
20KB

MD5
cb39eea2ef9ed3674c597d5f0667b5b4

SHA1
c133dc6416b3346fa5b0f449d7cc6f7dbf580432

SHA256
1627b921934053f1f7d2a19948aee06fac5db8ee8d4182e6f071718d0681f235

SHA512
2c65014dc045a2c1e5f52f3fea4967d2169e4a78d41fe56617ce9a4d5b30ebf25043112917ff3d7d152744ddef70475937ae0a7f96785f97dcefafe8e6f14d9c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads