e9e3295ae8cd8261e5d9a200e25da5fe01b0126d170af749892ff52c3af58e2b

Reason

Machine shutdown

General

Target

GTCCrackingToolV2.0.exe
Size

9.5MB
MD5

4790b00f8d08c3123a93a6bb0581f496
SHA1

46810574ef29fad1f4591524b000fb385009f804
SHA256

e9e3295ae8cd8261e5d9a200e25da5fe01b0126d170af749892ff52c3af58e2b
SHA512

181641a00853d0fe070ad88046c60ee592e78f9e3282a5623862156a91f00fc48a716315762737b6794f3a07ecbd0069a84f2162ff86b967617537a43698ea70
SSDEEP

196608:8ug/f7c2fOpS6qL0QPaNEfJYNYihp5cYughj3gXDJMIOaV:jgnI2fwqL0QlfJHihp5cYtJwXDq0

Score

7^/10

agilenet discovery

Malware Config

Signatures

Obfuscated with Agile.Net obfuscator 2 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral2/memory/2980-6-0x000000001C5D0000-0x000000001C750000-memory.dmp	agile_net
behavioral2/files/0x000f000000012245-12.dat	agile_net

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2980	GTCCrackingToolV2.0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2772	cmd.exe
2652	PING.EXE

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
3068	timeout.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2652	PING.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2980	GTCCrackingToolV2.0.exe
Token: SeShutdownPrivilege	2736	shutdown.exe
Token: SeRemoteShutdownPrivilege	2736	shutdown.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2504	2980	GTCCrackingToolV2.0.exe	30
PID 2980 wrote to memory of 2504	2980	GTCCrackingToolV2.0.exe	30
PID 2980 wrote to memory of 2504	2980	GTCCrackingToolV2.0.exe	30
PID 2504 wrote to memory of 2444	2504	cmd.exe	32
PID 2504 wrote to memory of 2444	2504	cmd.exe	32
PID 2504 wrote to memory of 2444	2504	cmd.exe	32
PID 2980 wrote to memory of 2736	2980	GTCCrackingToolV2.0.exe	34
PID 2980 wrote to memory of 2736	2980	GTCCrackingToolV2.0.exe	34
PID 2980 wrote to memory of 2736	2980	GTCCrackingToolV2.0.exe	34
PID 2444 wrote to memory of 3068	2444	cmd.exe	36
PID 2444 wrote to memory of 3068	2444	cmd.exe	36
PID 2444 wrote to memory of 3068	2444	cmd.exe	36
PID 2980 wrote to memory of 2772	2980	GTCCrackingToolV2.0.exe	38
PID 2980 wrote to memory of 2772	2980	GTCCrackingToolV2.0.exe	38
PID 2980 wrote to memory of 2772	2980	GTCCrackingToolV2.0.exe	38
PID 2772 wrote to memory of 2652	2772	cmd.exe	40
PID 2772 wrote to memory of 2652	2772	cmd.exe	40
PID 2772 wrote to memory of 2652	2772	cmd.exe	40

C:\Users\Admin\AppData\Local\Temp\GTCCrackingToolV2.0.exe
"C:\Users\Admin\AppData\Local\Temp\GTCCrackingToolV2.0.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c start cmd /C "color b && title Error && echo Debugger Detected && timeout /t 5"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Windows\system32\cmd.exe
    cmd /C "color b && title Error && echo Debugger Detected && timeout /t 5"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2444
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3068
- C:\Windows\System32\shutdown.exe
  "C:\Windows\System32\shutdown.exe" /s /t 10
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2736
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\GTCCrackingToolV2.0.exe"
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\system32\PING.EXE
    ping 1.1.1.1 -n 1 -w 3000
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2652

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:2720

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:2452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1A751740.dll

Filesize
709KB

MD5
149873da1bd6963a6bffbcf17e9b972e

SHA1
3e89ca39e34903c06c9203a1cf77dcdfcb8456f9

SHA256
3a0f152b273a8dfb6d44b032ba74d835f10fa019aa65427d6c9ab7b5989a995f

SHA512
9252355ab21e08d490968d33b395afee01229e37e32f654434258fd513bf8e86c2dd6cbfc99a85a3683a8ad13613c91eb8e787931f05f28192c8b94922f0894d

Download Submit
memory/2980-0-0x000007FEF5CD3000-0x000007FEF5CD4000-memory.dmp

Filesize
4KB

Download
memory/2980-1-0x00000000012F0000-0x0000000001C76000-memory.dmp

Filesize
9.5MB

Download
memory/2980-4-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

Filesize
9.9MB

Download
memory/2980-6-0x000000001C5D0000-0x000000001C750000-memory.dmp

Filesize
1.5MB

Download
memory/2980-8-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

Filesize
9.9MB

Download
memory/2980-10-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

Filesize
9.9MB

Download
memory/2980-9-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

Filesize
9.9MB

Download
memory/2980-11-0x0000000000650000-0x0000000000656000-memory.dmp

Filesize
24KB

Download
memory/2980-13-0x000000001E360000-0x000000001EED6000-memory.dmp

Filesize
11.5MB

Download
memory/2980-14-0x0000000000680000-0x000000000069A000-memory.dmp

Filesize
104KB

Download
memory/2980-15-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

Errors