f2ebbd96f7cf19aa8cc8b1273d1f80169de93ac4dde951ff4547177a11010945

Analysis

max time kernel
32s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15/10/2024, 16:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
689ff816fc3db38894e81abbdf63c02b.exe
Size 549KB
Sample241015-tmcqqatdqa
SHA256 f2ebbd96f7cf19aa8cc8b1273d1f80169de93ac4dde951ff4547177a11010945
MD5 689ff816fc3db38894e81abbdf63c02b
SHA1 aceb8ce81d4724d77a1b3031015f6e60d1139352
SHA512 b7eefa534ab5b409718d8b2287983417299f78bfed6696bba1037d3c816c3cadd172e5d59b0ff6e4ee8abf340cbc396c1695a075e747030fa7f6d2bfcfb8ef4c
SSDEEP 12288:MzW5JeQqp6xEWEoiH5KlCrX4FZg40rvM1BCpkLDapAGEhoCXOfNw9lu+eqQoEzwz:MzWCKlCroFWHr6BCCXau7X3pP7
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

credential_access discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
6	2728	rundll32.exe
8	2272	rundll32.exe

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
2196	Gxtuum.exe

Loads dropped DLL 13 IoCs

pid	Process
808	689ff816fc3db38894e81abbdf63c02b.exe
2764	rundll32.exe
2764	rundll32.exe
2764	rundll32.exe
2764	rundll32.exe
2728	rundll32.exe
2728	rundll32.exe
2728	rundll32.exe
2728	rundll32.exe
2272	rundll32.exe
2272	rundll32.exe
2272	rundll32.exe
2272	rundll32.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Gxtuum.job	689ff816fc3db38894e81abbdf63c02b.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1292	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	689ff816fc3db38894e81abbdf63c02b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gxtuum.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2792	netsh.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2728	rundll32.exe
2728	rundll32.exe
2728	rundll32.exe
2728	rundll32.exe
2728	rundll32.exe
1292	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1292	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
808	689ff816fc3db38894e81abbdf63c02b.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 808 wrote to memory of 2196	808	689ff816fc3db38894e81abbdf63c02b.exe	30
PID 808 wrote to memory of 2196	808	689ff816fc3db38894e81abbdf63c02b.exe	30
PID 808 wrote to memory of 2196	808	689ff816fc3db38894e81abbdf63c02b.exe	30
PID 808 wrote to memory of 2196	808	689ff816fc3db38894e81abbdf63c02b.exe	30
PID 2196 wrote to memory of 2764	2196	Gxtuum.exe	32
PID 2196 wrote to memory of 2764	2196	Gxtuum.exe	32
PID 2196 wrote to memory of 2764	2196	Gxtuum.exe	32
PID 2196 wrote to memory of 2764	2196	Gxtuum.exe	32
PID 2196 wrote to memory of 2764	2196	Gxtuum.exe	32
PID 2196 wrote to memory of 2764	2196	Gxtuum.exe	32
PID 2196 wrote to memory of 2764	2196	Gxtuum.exe	32
PID 2764 wrote to memory of 2728	2764	rundll32.exe	33
PID 2764 wrote to memory of 2728	2764	rundll32.exe	33
PID 2764 wrote to memory of 2728	2764	rundll32.exe	33
PID 2764 wrote to memory of 2728	2764	rundll32.exe	33
PID 2728 wrote to memory of 2792	2728	rundll32.exe	34
PID 2728 wrote to memory of 2792	2728	rundll32.exe	34
PID 2728 wrote to memory of 2792	2728	rundll32.exe	34
PID 2728 wrote to memory of 1292	2728	rundll32.exe	36
PID 2728 wrote to memory of 1292	2728	rundll32.exe	36
PID 2728 wrote to memory of 1292	2728	rundll32.exe	36
PID 2196 wrote to memory of 2272	2196	Gxtuum.exe	38
PID 2196 wrote to memory of 2272	2196	Gxtuum.exe	38
PID 2196 wrote to memory of 2272	2196	Gxtuum.exe	38
PID 2196 wrote to memory of 2272	2196	Gxtuum.exe	38
PID 2196 wrote to memory of 2272	2196	Gxtuum.exe	38
PID 2196 wrote to memory of 2272	2196	Gxtuum.exe	38
PID 2196 wrote to memory of 2272	2196	Gxtuum.exe	38

C:\Users\Admin\AppData\Local\Temp\689ff816fc3db38894e81abbdf63c02b.exe
"C:\Users\Admin\AppData\Local\Temp\689ff816fc3db38894e81abbdf63c02b.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:808
- C:\Users\Admin\AppData\Local\Temp\76c5995d57\Gxtuum.exe
  "C:\Users\Admin\AppData\Local\Temp\76c5995d57\Gxtuum.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2196
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\0560249ade67ec\cred64.dll, Main
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2764
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\0560249ade67ec\cred64.dll, Main
      4⤵
      Blocklisted process makes network request
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2728
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:2792
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\506706701124_Desktop.zip' -CompressionLevel Optimal
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1292
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\0560249ade67ec\clip64.dll, Main
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Gxtuum.exe

Path C:\Users\Admin\AppData\Local\Temp\76c5995d57\Gxtuum.exe
Size 549KB
SHA256 f2ebbd96f7cf19aa8cc8b1273d1f80169de93ac4dde951ff4547177a11010945
MD5 689ff816fc3db38894e81abbdf63c02b
SHA1 aceb8ce81d4724d77a1b3031015f6e60d1139352
SHA512 b7eefa534ab5b409718d8b2287983417299f78bfed6696bba1037d3c816c3cadd172e5d59b0ff6e4ee8abf340cbc396c1695a075e747030fa7f6d2bfcfb8ef4c
SSDEEP 12288:MzW5JeQqp6xEWEoiH5KlCrX4FZg40rvM1BCpkLDapAGEhoCXOfNw9lu+eqQoEzwz:MzWCKlCroFWHr6BCCXau7X3pP7
MD5 SHA1 SHA512 SSDEEP

Submit Download

clip64.dll

Path C:\Users\Admin\AppData\Roaming\0560249ade67ec\clip64.dll
Size 127KB
SHA256 a7a307c332573b2bf76edcf53d37e5a91c1fa3a8ce36f720cb10c8c22928f388
MD5 9730e0bcf27e4265d1be56b8a7767759
SHA1 11af04e5c73de95a2fb4231970a9f145b39cf381
SHA512 960d9f3d0b1111395438484bb52a890eaf55297d2f952c692af5fb64bf442c347ba23e23ec864b6685de2f822c85c363972b047ca371b00a531b342791db2f38
SSDEEP 3072:XeCHM7q++uIwqUjW0uVP0rHv/09aNmw62xm4+5L:O6M7lL5jLuVPaFA5L
MD5 SHA1 SHA512 SSDEEP

Submit Download

cred64.dll

Path C:\Users\Admin\AppData\Roaming\0560249ade67ec\cred64.dll
Size 1.2MB
SHA256 ebf4f2d5bbda21860684dfeb6f0fa0704c87013096d59cefd89ee48c27ee7ab8
MD5 1b32cdb682dc2b89bab7263aa4f1f08b
SHA1 5cdcc6b59cd71aa379b14792a546e229efa4dd12
SHA512 2fec86d8c165bc613f7c5b5f337ed101d2db2ddf3902e73d448784b8ce90650f23ea285f0bb7f8343a434af57c3e7ed79e3131063310a7aa0047e9180bf61b00
SSDEEP 24576:ujm1sk9lP6nWZJaIOo/QHtH9YZ0yNJW+6Jslb:Z96nWerAQHB9yjWzi
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/808-1-0x0000000000490000-0x0000000000491000-memory.dmp

Download

memory/1292-32-0x000000001B660000-0x000000001B942000-memory.dmp

Download

memory/1292-33-0x0000000002790000-0x0000000002798000-memory.dmp

Download