d34ef58261364124c05b91d7874e26e251f64b6ea8c2390a378edbaa4bc9c689

Resubmissions

07-08-2024 19:41

240807-yd5glawerc 7

07-08-2024 19:38

240807-ycn38asgnj 7

07-08-2024 19:33

240807-x9k76awdrh 7

Analysis

max time kernel
1367s
max time network
1156s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07-08-2024 19:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GLP_installer_900223086_market.exe
Size

3.7MB
MD5

503a84464431d9fb77fff5c76b9181dc
SHA1

622114e85462b0814c787d30efe11983e3497d33
SHA256

d34ef58261364124c05b91d7874e26e251f64b6ea8c2390a378edbaa4bc9c689
SHA512

947c7974886de6a43df2ebd1543ec6844739e6bb28cf0229a117dcb3f3c115c85293c2e780d1072b65660a49a31650611dc2187bf1d0ea5478a660995644a1fa
SSDEEP

49152:oR7p2tKp8TxbXTtoA6dgvYtBL0H7n41FGYna6wTzAwsxqIaS3Dq2PEFTQ311iKUJ:Y7pgFDpoPdggLL0Hns3aobLebQq5vv

Score

7^/10

bootkit discovery persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
468	GLP_installer_900223086_market.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	GLP_installer_900223086_market.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	GLP_installer_900223086_market.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GLP_installer_900223086_market.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
468	GLP_installer_900223086_market.exe
468	GLP_installer_900223086_market.exe

C:\Users\Admin\AppData\Local\Temp\GLP_installer_900223086_market.exe
"C:\Users\Admin\AppData\Local\Temp\GLP_installer_900223086_market.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Tencent\TxGameAssistant\TGBDownloader\dr.dll

Filesize
74KB

MD5
2814acbd607ba47bdbcdf6ac3076ee95

SHA1
50ab892071bed2bb2365ca1d4bf5594e71c6b13b

SHA256
5904a7e4d97eeac939662c3638a0e145f64ff3dd0198f895c4bf0337595c6a67

SHA512
34c73014ffc8d38d6dd29f4f84c8f4f9ea971bc131f665f65b277f453504d5efc2d483a792cdea610c5e0544bf3997b132dcdbe37224912c5234c15cdb89d498

Download Submit