17ef63395dd24979aeaf6bae39cc015ab6f2c4f1a636b2f7d376428a0d072ef8

Resubmissions

22-10-2024 20:31

241022-za7m8avdpm 10

22-10-2024 20:06

241022-yvkhra1gpc 7

Analysis

max time kernel
550s
max time network
433s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-10-2024 20:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Gatherum Installer.exe
Size

49.7MB
MD5

e3037737b8f93aba2883cf659ec8d03e
SHA1

d29ab97312396bb9c1e7edd803b46954500e5bd8
SHA256

17ef63395dd24979aeaf6bae39cc015ab6f2c4f1a636b2f7d376428a0d072ef8
SHA512

6a4be06dec84ee12510630bdb340d0d8f79b2897ba0f7fcf2782ee1c881fcd81468a37e24cb2a58ee9629b6b641c2f6a2eed384659226f58bb9136eb8bf6cda6
SSDEEP

1572864:L9QC1e8qh+C1eU2qHMbgjTE/VYfC+Z3Y/:L1e8qhvx6g9Cs3Y/

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
216	GatherumApp.exe

Loads dropped DLL 3 IoCs

pid	Process
216	GatherumApp.exe
216	GatherumApp.exe
216	GatherumApp.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gatherum Installer.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	216	GatherumApp.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 216	4924	Gatherum Installer.exe	87
PID 4924 wrote to memory of 216	4924	Gatherum Installer.exe	87

C:\Users\Admin\AppData\Local\Temp\Gatherum Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Gatherum Installer.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Users\Admin\AppData\Local\Temp\7z7B56833C\GatherumApp.exe
  C:\Users\Admin\AppData\Local\Temp\7z7B56833C\GatherumApp.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7z7B56833C\D3DCompiler_47_cor3.dll

Filesize
4.7MB

MD5
03a60a6652caf4f49ea5912ce4e1b33c

SHA1
a0d949d4af7b1048dc55e39d1d1260a1e0660c4f

SHA256
b23e7b820ed5c6ea7dcd77817e2cd79f1cec9561d457172287ee634a8bd658c3

SHA512
6711d40d171ea200c92d062226a69f33eb41e9232d74291ef6f0202de73cf4dc54fbdd769104d2bb3e89dc2d81f2f2f3479e4258a5d6a54c545e56b07746b4c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z7B56833C\PresentationNative_cor3.dll

Filesize
1.2MB

MD5
274761a595f86982214221b5685b3218

SHA1
b908013028cb07fb799de2e48b6492404add6069

SHA256
6d5910c0a0a4e3ee8863e4dadc73662d28ae9bfcda4a52960e26c1237386851a

SHA512
3f9cf3d8e428619b798374f2e2a6ef9cf4213428277a74306978552772aae1a4a9ae7247c2dc893c0054d480dda871bbd74b0bc4afd65b0f584958d501ed8867

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z7B56833C\wpfgfx_cor3.dll

Filesize
1.9MB

MD5
627ecf139beed59b4e1b26caac8f68e4

SHA1
9747fe073aed451c936a66f8ad112bbb1a8c31c8

SHA256
0a01412b64e6889ace8933dd2f559d186b693aefe31e6b084e2d435b1737af39

SHA512
25bdb740039c867ce0cc1347493cf456e32d767c898a683da1306992ae77ed3605612c804c2eae483320f18f2cd0850c17226ef21e09fe07997aa47679b6030e

Download Submit