af41b9ac95c32686ba1ef373929b54f49088e5c4f295fe828b43b32b5160aa78

Analysis

max time kernel
117s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
01-08-2024 09:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

gawdth.exe
Size

898KB
MD5

c02798b26bdaf8e27c1c48ef5de4b2c3
SHA1

bc59ab8827e13d1a9a1892eb4da9cf2d7d62a615
SHA256

af41b9ac95c32686ba1ef373929b54f49088e5c4f295fe828b43b32b5160aa78
SHA512

b541aeedcc4db6f8e0db0788f2791339476a863c15efc72aef3db916fc7c8ab41d84c0546c05b675be4d7700c4f986dbae5e2858d60ecd44b4ffbcae2065cfc4
SSDEEP

24576:juDXTIGaPhEYzUzA0aouDXTIGaPhEYzUzA0br:KDjlabwz9MDjlabwz93

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

gawdth.execlamer.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Control Panel\International\Geo\Nation	gawdth.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Control Panel\International\Geo\Nation	clamer.exe

Executes dropped EXE 3 IoCs

Processes:

clamer.exelofsawd.exegffhaf.exe

pid process

532 clamer.exe
3584 lofsawd.exe
3632 gffhaf.exe
Drops file in Windows directory 1 IoCs

Processes:

lofsawd.exe

description ioc process

File created C:\Windows\Tasks\Test Task17.job lofsawd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
532	clamer.exe
3584	lofsawd.exe
3632	gffhaf.exe

description	ioc	process
File created	C:\Windows\Tasks\Test Task17.job	lofsawd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

lofsawd.exegffhaf.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lofsawd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gffhaf.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

gawdth.execmd.execlamer.exe

description	pid	process	target process
PID 228 wrote to memory of 4756	228	gawdth.exe	cmd.exe
PID 228 wrote to memory of 4756	228	gawdth.exe	cmd.exe
PID 4756 wrote to memory of 532	4756	cmd.exe	clamer.exe
PID 4756 wrote to memory of 532	4756	cmd.exe	clamer.exe
PID 532 wrote to memory of 3584	532	clamer.exe	lofsawd.exe
PID 532 wrote to memory of 3584	532	clamer.exe	lofsawd.exe
PID 532 wrote to memory of 3584	532	clamer.exe	lofsawd.exe

C:\Users\Admin\AppData\Local\Temp\gawdth.exe
"C:\Users\Admin\AppData\Local\Temp\gawdth.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe
    clamer.exe -priverdD
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:532
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\lofsawd.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\lofsawd.exe"
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:3584

C:\ProgramData\srtldv\gffhaf.exe
C:\ProgramData\srtldv\gffhaf.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat

Filesize
37B

MD5
28151380c82f5de81c1323171201e013

SHA1
ae515d813ba2b17c8c5ebdae196663dc81c26d3c

SHA256
bb8582ce28db923f243c8d7a3f2eccb0ed25930f5b5c94133af8eefb57a8231d

SHA512
46b29cba0dc813de0c58d2d83dc298fa677921fd1f19f41e2ed3c7909c497fab2236d10a9ae59b3f38e49cf167964ede45e15543673a1e0843266242b8e26253

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe

Filesize
453KB

MD5
a9f386515c3896a0a106940be362de47

SHA1
d1a9cf3c16555db4b2395d388995c2b13d2d683b

SHA256
12532d6bf0cdb5ea1cc0844e9ef73530456a337d5b73bb8d23e110fac46c3446

SHA512
7a2a4a6c7f9c426ff57066786892f4bbd7830f8c91985f1243abfd9148878345e83813eb09434b68b6616b76860d4163c1c7e32d4eb552953019fc8cb4c0a448

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\lofsawd.exe

Filesize
16KB

MD5
e7d405eec8052898f4d2b0440a6b72c9

SHA1
58cf7bfcec81faf744682f9479b905feed8e6e68

SHA256
b63a0e5f93b26ad0eeb9efba66691f3b7e7f51e93a2f0098bde43833f7a24cc2

SHA512
324507084bd56f7102459efe7b3c2d2560f4e89ed03ec4a38539ebb71bccdf1def7bc961c259f9b02f4b2be0d5e095136c9efcd5fc3108af3dc61d24970d6121

Download Submit
C:\Windows\Tasks\Test Task17.job

Filesize
238B

MD5
c8d369203a98cea8dbd172ac71bc2a72

SHA1
6d2704db19769b3cdf724f4a2ebf4b9aa44d024e

SHA256
242a0fe3516489cf1532b62379736ccf31d78539a75e85d70016a1013e97e1e1

SHA512
1149dfc8a62c54d87137436d53b401de69f62f29281bc1d5d4fad5cc9c9acee248776b7a26ce5223d06a41cefead744a85299e7e6919f57538cc4498ed79ad11

Download Submit