8c33aec23b2a9816d4b2d7087b9af5e03152e74a68e893c86fbed5fd20ed3fc0

General

Target
gmssetupx86.exe
Size 844KB
Sample260806-antabaeg85
SHA256 8c33aec23b2a9816d4b2d7087b9af5e03152e74a68e893c86fbed5fd20ed3fc0
MD5 f7d39cd590e173758106c76f445e35dd
SHA1 345bd81eef5c9d5c053950cc857691b38e34d84d
SHA512 7c122427f23f068020c309b71d23476ecb0626679782590ed8e49e6a3d6a7190a71632314f9b1610ff3b9f1c9302b624bd744125d439542c9a6c6ebc202eba85
SSDEEP 12288:2CdOy3vVrKxR5CXbNjAOxK/j2n+4YG/6c1mFFja3mXgcjfRlgsUBgaQYpYQv:2Cdxte/80jYLT3U1jfsWaQYpYQv
TLSH
T19C059D2273DDD360CB769173BF6973056EBF78650630B89B2F881D78A950171262CBA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Tachodata\GMSCLient\GMS.ini	gmssetupx86.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4480	sc.exe
1940	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4956	cmd.exe
4688	cmd.exe
3404	cmd.exe
4712	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gmssetupx86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 7124 wrote to memory of 3404	7124	gmssetupx86.exe	92
PID 3404 wrote to memory of 1940	3404	cmd.exe	93
PID 7124 wrote to memory of 4712	7124	gmssetupx86.exe	94
PID 4712 wrote to memory of 4480	4712	cmd.exe	95
PID 7124 wrote to memory of 4956	7124	gmssetupx86.exe	96
PID 4956 wrote to memory of 4388	4956	cmd.exe	97
PID 4388 wrote to memory of 4748	4388	net.exe	98
PID 7124 wrote to memory of 4688	7124	gmssetupx86.exe	99
PID 4688 wrote to memory of 3564	4688	cmd.exe	100
PID 3564 wrote to memory of 404	3564	net.exe	101

C:\Users\Admin\AppData\Local\Temp\gmssetupx86.exe
"C:\Users\Admin\AppData\Local\Temp\gmssetupx86.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:7124
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create GMSClient start= auto binPath= "C:\Program Files (x86)\Tachodata\GMSCLient\GMS-Client.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3404
- - C:\Windows\SysWOW64\sc.exe
    sc create GMSClient start= auto binPath= "C:\Program Files (x86)\Tachodata\GMSCLient\GMS-Client.exe"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1940
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc failure GMSClient actions= restart/180000/restart/180000/restart/180000 reset= 86400
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4712
- - C:\Windows\SysWOW64\sc.exe
    sc failure GMSClient actions= restart/180000/restart/180000/restart/180000 reset= 86400
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4480
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net start GMSClient
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Windows\SysWOW64\net.exe
    net start GMSClient
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4388
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start GMSClient
      4⤵
      System Location Discovery: System Language Discovery
      PID:4748
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net start GMSClient
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Windows\SysWOW64\net.exe
    net start GMSClient
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3564
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start GMSClient
      4⤵
      System Location Discovery: System Language Discovery
      PID:404