Analysis
-
max time kernel
104s -
max time network
139s -
platform
windows10-ltsc_2021_x64 -
resource
win10ltsc2021-20250314-en -
resource tags
-
submitted
26/03/2025, 05:54
General
-
Target
GTCCrackingToolV2.0.exe
-
Size
9.5MB
-
MD5
4790b00f8d08c3123a93a6bb0581f496
-
SHA1
46810574ef29fad1f4591524b000fb385009f804
-
SHA256
e9e3295ae8cd8261e5d9a200e25da5fe01b0126d170af749892ff52c3af58e2b
-
SHA512
181641a00853d0fe070ad88046c60ee592e78f9e3282a5623862156a91f00fc48a716315762737b6794f3a07ecbd0069a84f2162ff86b967617537a43698ea70
-
SSDEEP
196608:8ug/f7c2fOpS6qL0QPaNEfJYNYihp5cYughj3gXDJMIOaV:jgnI2fwqL0QlfJHihp5cYtJwXDq0
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Obfuscated with Agile.Net obfuscator 2 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 24 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\GTCCrackingToolV2.0.exe"C:\Users\Admin\AppData\Local\Temp\GTCCrackingToolV2.0.exe"1⤵
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\1A751740.dll" /A:H2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
709KB
MD5149873da1bd6963a6bffbcf17e9b972e
SHA13e89ca39e34903c06c9203a1cf77dcdfcb8456f9
SHA2563a0f152b273a8dfb6d44b032ba74d835f10fa019aa65427d6c9ab7b5989a995f
SHA5129252355ab21e08d490968d33b395afee01229e37e32f654434258fd513bf8e86c2dd6cbfc99a85a3683a8ad13613c91eb8e787931f05f28192c8b94922f0894d
-
Filesize
104KB
-
Filesize
2.1MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
24KB
-
Filesize
9.5MB
-
Filesize
10.8MB
-
Filesize
11.5MB
-
Filesize
10.8MB
-
Filesize
1.5MB
-
Filesize
72KB
-
Filesize
8KB
-
Filesize
136KB
-
Filesize
240KB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB