Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    18-08-2024 06:27

General

  • Target

    GRScript-v1.5/GrayRobot.exe

  • Size

    656KB

  • MD5

    99fb446133741d6d82ca31bacb453b75

  • SHA1

    f44c596a026d3ff4b7e77503a6f54f37f33fe60d

  • SHA256

    a8c0dc7ee69eded6e66813d86560ac2191a677a1042b85124122f0e6bc4c1785

  • SHA512

    78c4f2cee706ca5c2a648e95451081bad618d1c9a10bfbcbc209c2e85ea50516a6bfdad8f3a39467e0d72b7ee45f00c73e36b83d38cefb496093a617e6993a16

  • SSDEEP

    12288:mbc4g7vdQ2krMl9+bBj3eQ0jxfd6spL5vH6K:PlEhJ0jxosplv

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\GRScript-v1.5\GrayRobot.exe
    "C:\Users\Admin\AppData\Local\Temp\GRScript-v1.5\GrayRobot.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:2400

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2400-0-0x00000000003A0000-0x00000000003D1000-memory.dmp

    Filesize

    196KB

  • memory/2400-2-0x0000000000520000-0x0000000000620000-memory.dmp

    Filesize

    1024KB