Overview
overview
10Static
static
10G K M 9 5.rar
windows7-x64
1G K M 9 5.rar
windows10-2004-x64
10G K M 9 5/Client.exe
windows7-x64
1G K M 9 5/Client.exe
windows10-2004-x64
3G K M 9 5...nu.exe
windows7-x64
7G K M 9 5...nu.exe
windows10-2004-x64
10G K M 9 5/ai.cfg
windows7-x64
3G K M 9 5/ai.cfg
windows10-2004-x64
3G K M 9 5/cacert.pem
windows7-x64
3G K M 9 5/cacert.pem
windows10-2004-x64
3G K M 9 5/config.vdf
windows7-x64
3G K M 9 5/config.vdf
windows10-2004-x64
3Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-10-2024 16:13
Behavioral task
behavioral1
Sample
G K M 9 5.rar
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
G K M 9 5.rar
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
G K M 9 5/Client.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
G K M 9 5/Client.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
G K M 9 5/GTA 5 Mod Menu.exe
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
G K M 9 5/GTA 5 Mod Menu.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
G K M 9 5/ai.cfg
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
G K M 9 5/ai.cfg
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
G K M 9 5/cacert.pem
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
G K M 9 5/cacert.pem
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
G K M 9 5/config.vdf
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
G K M 9 5/config.vdf
Resource
win10v2004-20241007-en
General
-
Target
G K M 9 5/cacert.pem
-
Size
2KB
-
MD5
39f89143815797c4a41c62f30f137094
-
SHA1
39a602c37ee958e5a5779c167ea095a56f0218e4
-
SHA256
5513aa54afe134569e08b27aa61e60e888ab31d9e112f8c5881adbaecc817678
-
SHA512
02cfee4a3fdc728e63e5a63797c58c5a6fbd805f6f6e5c0ab4e5dbf1d1701636a6aefc94095096b627b7475e731327d620c519ddc1a65b3ee49dd41b4d219d6d
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2568 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2568 AcroRd32.exe 2568 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2772 wrote to memory of 2576 2772 cmd.exe 31 PID 2772 wrote to memory of 2576 2772 cmd.exe 31 PID 2772 wrote to memory of 2576 2772 cmd.exe 31 PID 2576 wrote to memory of 2568 2576 rundll32.exe 32 PID 2576 wrote to memory of 2568 2576 rundll32.exe 32 PID 2576 wrote to memory of 2568 2576 rundll32.exe 32 PID 2576 wrote to memory of 2568 2576 rundll32.exe 32
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\G K M 9 5\cacert.pem"1⤵
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\G K M 9 5\cacert.pem2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\G K M 9 5\cacert.pem"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2568
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5eaa95f4289d66543320fc3602ac84c38
SHA138aaf1386470d7495051f657a9101c0307d53bf3
SHA25674f963be5a508566ab85ab0667d63d6ac637ae0a77775eefab76a924254e0c7b
SHA512ad50cd0cf60474e7b8d909bad5f5ccaf7e33120aec8e94c53cb896d8ff9a9f7b6044ad1c9c4e207fc348d88fa485e4450d23be5df05345637059b978c63f15e5