Analysis
- user interaction
yes - max time kernel
298s - max time network
271s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
03/07/2026, 19:41
General
- Target GUP.exe
- Size 789KB
- Sample260703-yeacvaby2n
- SHA256 b9c965aa538c21b4702ec7e4f3ac47fc999e1cd505d69e0896a309f7956bb351
Malware Config
Signatures
- Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies registry class 2 IoCs
- Opens file in notepad (likely ransom note) 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 17 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of FindShellTrayWindow 43 IoCs
- Suspicious use of SendNotifyMessage 43 IoCs
- Suspicious use of SetWindowsHookEx 27 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\GUP.exe"C:\Users\Admin\AppData\Local\Temp\GUP.exe"1⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\WatchExport.php2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\ProtectDebug.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
index.dat
b8ab77100df80ab2.customDestinations-ms
memory/4640-150-0x00007FF9E4630000-0x00007FF9E4640000-memory.dmp
memory/4640-95-0x00007FF9E4630000-0x00007FF9E4640000-memory.dmp
memory/4640-100-0x00007FF9E1CD0000-0x00007FF9E1CE0000-memory.dmp
memory/4640-151-0x00007FF9E4630000-0x00007FF9E4640000-memory.dmp
memory/4640-149-0x00007FF9E4630000-0x00007FF9E4640000-memory.dmp
memory/4640-148-0x00007FF9E4630000-0x00007FF9E4640000-memory.dmp
memory/4640-101-0x00007FF9E1CD0000-0x00007FF9E1CE0000-memory.dmp
memory/4640-98-0x00007FF9E4630000-0x00007FF9E4640000-memory.dmp
memory/4640-99-0x00007FF9E4630000-0x00007FF9E4640000-memory.dmp
memory/4640-96-0x00007FF9E4630000-0x00007FF9E4640000-memory.dmp
memory/4640-97-0x00007FF9E4630000-0x00007FF9E4640000-memory.dmp
memory/4796-20-0x000001CE0DC90000-0x000001CE0DD71000-memory.dmp
memory/4796-94-0x000001CE0DC90000-0x000001CE0DD71000-memory.dmp
memory/4796-9-0x000001CE0DC90000-0x000001CE0DD71000-memory.dmp
memory/4796-10-0x000001CE0DC90000-0x000001CE0DD71000-memory.dmp
memory/4796-11-0x000001CE0DC90000-0x000001CE0DD71000-memory.dmp
memory/4796-12-0x000001CE0DC90000-0x000001CE0DD71000-memory.dmp
memory/4796-13-0x000001CE0DC90000-0x000001CE0DD71000-memory.dmp
memory/4796-19-0x000001CE0DC90000-0x000001CE0DD71000-memory.dmp
memory/4796-14-0x000001CE0DC90000-0x000001CE0DD71000-memory.dmp
memory/4796-17-0x000001CE0DC90000-0x000001CE0DD71000-memory.dmp
memory/4796-8-0x000001CE0DC90000-0x000001CE0DD71000-memory.dmp
memory/4796-15-0x000001CE0DC90000-0x000001CE0DD71000-memory.dmp
memory/4796-16-0x000001CE0DC90000-0x000001CE0DD71000-memory.dmp
memory/4796-18-0x000001CE0DC90000-0x000001CE0DD71000-memory.dmp
memory/4796-2-0x000001CE0DC90000-0x000001CE0DD71000-memory.dmp
memory/5072-152-0x000001BC13C70000-0x000001BC13C71000-memory.dmp
memory/5072-153-0x000001BC13C70000-0x000001BC13C71000-memory.dmp
memory/5072-154-0x000001BC13C70000-0x000001BC13C71000-memory.dmp
memory/5072-164-0x000001BC13C70000-0x000001BC13C71000-memory.dmp
memory/5072-163-0x000001BC13C70000-0x000001BC13C71000-memory.dmp
memory/5072-162-0x000001BC13C70000-0x000001BC13C71000-memory.dmp
memory/5072-161-0x000001BC13C70000-0x000001BC13C71000-memory.dmp
memory/5072-160-0x000001BC13C70000-0x000001BC13C71000-memory.dmp
memory/5072-159-0x000001BC13C70000-0x000001BC13C71000-memory.dmp
memory/5072-158-0x000001BC13C70000-0x000001BC13C71000-memory.dmp