Analysis
-
max time kernel
118s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 02:07
Behavioral task
behavioral1
Sample
2e3a5dfa44d59681a60d78b8b08a1af3878d8e270c02d7e31a0876a85eb42a7e.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2e3a5dfa44d59681a60d78b8b08a1af3878d8e270c02d7e31a0876a85eb42a7e.exe
Resource
win10v2004-20241007-en
General
-
Target
2e3a5dfa44d59681a60d78b8b08a1af3878d8e270c02d7e31a0876a85eb42a7e.exe
-
Size
429KB
-
MD5
51ff79b406cb223dd49dd4c947ec97b0
-
SHA1
b9b0253480a1b6cbdd673383320fecae5efb3dce
-
SHA256
2e3a5dfa44d59681a60d78b8b08a1af3878d8e270c02d7e31a0876a85eb42a7e
-
SHA512
c2b8d15b0dc1b0846f39ce007be2deb41d5b6ae76af90d618f29da8691ed987c42f3c270f0ea7f4d10cbd2d3877118f4133803c9c965b6ff236ff8cfafd9367c
-
SSDEEP
12288:v4RG6lx/9Njr18QlSfJy4FjMSkJCzDLGDWD:O9NtSTZMzmmD4
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation 2e3a5dfa44d59681a60d78b8b08a1af3878d8e270c02d7e31a0876a85eb42a7e.exe -
Executes dropped EXE 3 IoCs
pid Process 4464 Gxtuum.exe 2508 Gxtuum.exe 380 Gxtuum.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\Gxtuum.job 2e3a5dfa44d59681a60d78b8b08a1af3878d8e270c02d7e31a0876a85eb42a7e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2e3a5dfa44d59681a60d78b8b08a1af3878d8e270c02d7e31a0876a85eb42a7e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gxtuum.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2972 wrote to memory of 4464 2972 2e3a5dfa44d59681a60d78b8b08a1af3878d8e270c02d7e31a0876a85eb42a7e.exe 83 PID 2972 wrote to memory of 4464 2972 2e3a5dfa44d59681a60d78b8b08a1af3878d8e270c02d7e31a0876a85eb42a7e.exe 83 PID 2972 wrote to memory of 4464 2972 2e3a5dfa44d59681a60d78b8b08a1af3878d8e270c02d7e31a0876a85eb42a7e.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e3a5dfa44d59681a60d78b8b08a1af3878d8e270c02d7e31a0876a85eb42a7e.exe"C:\Users\Admin\AppData\Local\Temp\2e3a5dfa44d59681a60d78b8b08a1af3878d8e270c02d7e31a0876a85eb42a7e.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\e458d263c0\Gxtuum.exe"C:\Users\Admin\AppData\Local\Temp\e458d263c0\Gxtuum.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4464
-
-
C:\Users\Admin\AppData\Local\Temp\e458d263c0\Gxtuum.exeC:\Users\Admin\AppData\Local\Temp\e458d263c0\Gxtuum.exe1⤵
- Executes dropped EXE
PID:2508
-
C:\Users\Admin\AppData\Local\Temp\e458d263c0\Gxtuum.exeC:\Users\Admin\AppData\Local\Temp\e458d263c0\Gxtuum.exe1⤵
- Executes dropped EXE
PID:380
Network
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
Remote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request209.205.72.20.in-addr.arpaIN PTRResponse
-
Remote address:212.193.31.8:80RequestPOST /3ofn3jf3e2ljk2/index.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: 212.193.31.8
Content-Length: 4
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Server: Apache/2.4.58 (Ubuntu)
Content-Length: 8
Content-Type: text/html; charset=UTF-8
-
Remote address:212.193.31.8:80RequestPOST /3ofn3jf3e2ljk2/index.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: 212.193.31.8
Content-Length: 158
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Server: Apache/2.4.58 (Ubuntu)
Content-Length: 7
Content-Type: text/html; charset=UTF-8
-
Remote address:8.8.8.8:53Request74.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request8.31.193.212.in-addr.arpaIN PTRResponse8.31.193.212.in-addr.arpaIN PTRice-cream-strawberryaezanetwork
-
Remote address:8.8.8.8:53Request97.17.167.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request200.163.202.172.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request206.23.85.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request14.227.111.52.in-addr.arpaIN PTRResponse
-
1.1kB 521 B 14 5
HTTP Request
POST http://212.193.31.8/3ofn3jf3e2ljk2/index.phpHTTP Response
200HTTP Request
POST http://212.193.31.8/3ofn3jf3e2ljk2/index.phpHTTP Response
200
-
66 B 90 B 1 1
DNS Request
8.8.8.8.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
209.205.72.20.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.210.232.199.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
74.32.126.40.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
71 B 118 B 1 1
DNS Request
8.31.193.212.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
97.17.167.52.in-addr.arpa
-
74 B 160 B 1 1
DNS Request
200.163.202.172.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
206.23.85.13.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
14.227.111.52.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
429KB
MD551ff79b406cb223dd49dd4c947ec97b0
SHA1b9b0253480a1b6cbdd673383320fecae5efb3dce
SHA2562e3a5dfa44d59681a60d78b8b08a1af3878d8e270c02d7e31a0876a85eb42a7e
SHA512c2b8d15b0dc1b0846f39ce007be2deb41d5b6ae76af90d618f29da8691ed987c42f3c270f0ea7f4d10cbd2d3877118f4133803c9c965b6ff236ff8cfafd9367c