Overview

overview

8

Static

static

5

gusetup.exe

windows11-21h2-x64

8

x64/AppMetrics.dll

windows11-21h2-x64

1

x64/CheckD...ss.exe

windows11-21h2-x64

1

x64/CheckUpdate.dll

windows11-21h2-x64

1

x64/Config.dll

windows11-21h2-x64

1

x64/Contex...er.dll

windows11-21h2-x64

5

x64/CrashReport.dll

windows11-21h2-x64

1

x64/CrashReport.exe

windows11-21h2-x64

1

x64/GUAssi...vc.exe

windows11-21h2-x64

1

x64/Languages.dll

windows11-21h2-x64

1

x64/Log.dll

windows11-21h2-x64

1

x64/MachineCode.dll

windows11-21h2-x64

1

x64/Memfil...ce.exe

windows11-21h2-x64

1

x64/Micros...TL.xml

windows11-21h2-x64

7

x64/Micros...RT.xml

windows11-21h2-x64

4

x64/Micros...FC.xml

windows11-21h2-x64

4

x64/ObjectAdmin.dll

windows11-21h2-x64

1

x64/Register.dll

windows11-21h2-x64

1

x64/ScanFile.dll

windows11-21h2-x64

1

x64/SkinsManager.dll

windows11-21h2-x64

1

x64/Unistall.exe

windows11-21h2-x64

1

x64/Win64S...nk.exe

windows11-21h2-x64

1

x64/atl90.dll

windows11-21h2-x64

1

x64/mfc90.dll

windows11-21h2-x64

1

x64/mfc90u.dll

windows11-21h2-x64

1

x64/mfcm90.dll

windows11-21h2-x64

1

x64/mfcm90u.dll

windows11-21h2-x64

1

x64/msvcp90.dll

windows11-21h2-x64

1

x64/msvcr90.dll

windows11-21h2-x64

1

x64/zlib.dll

windows11-21h2-x64

1

x64ProcessAssist.dll

windows11-21h2-x64

3

zlib1.dll

windows11-21h2-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    gusetup.exe
  • Size 27.1MB
  • Sample260816-c2nm4abr2w
  • SHA256 d4984b3eb46285e2553256b996b4866940b809d2d2d6adf045db13664da74181
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarebootkitdefense_evasiondiscoveryinstallerpersistenceprivilege_escalationspywarestealertrojan

Malware Config

Targets

    • Target
      gusetup.exe
    • Size 27.1MB
    • SHA256 d4984b3eb46285e2553256b996b4866940b809d2d2d6adf045db13664da74181
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    bootkitdefense_evasiondiscoveryinstallerpersistenceprivilege_escalationspywarestealertrojan

    • Drops file in Drivers directory

    • Uses Session Manager for persistence

      Creates Session Manager registry key to run executable early in system boot.

      persistence

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation
    behavioral1
    • Target
      x64/AppMetrics.dll
    • Size 147KB
    • SHA256 0b76e9ba0701d72a5d4a1cc8d32d794863f535f94f31ee342fafa801ca090872
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral2
    • Target
      x64/CheckDiskProgress.exe
    • Size 83KB
    • SHA256 e702024b4f857b5785e8cc52eebd834542f1f6ac5b20b110023b3f7fe7d2b4fc
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral3
    • Target
      x64/CheckUpdate.dll
    • Size 814KB
    • SHA256 8f6f1519a300a77402eb071072b2c85cf7a2e72e705054716c8145ef89383a3e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral4
    • Target
      x64/Config.dll
    • Size 45KB
    • SHA256 15bb8ae52a9e8578e7f386b9cf4d50121f3e42ed25db069edab27cd035e3ea2c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral5
    • Target
      x64/ContextHandler.dll
    • Size 91KB
    • SHA256 5706048b89a2a027c668e34e9c24b05e40fc17d4316caa4bedc05230c1409706
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    5/10
    persistenceprivilege_escalation

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation
    behavioral6
    • Target
      x64/CrashReport.dll
    • Size 109KB
    • SHA256 3b7afdb04918bd21a37530f8d76d57cec15c2984217b3632d0caf6eba4461052
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral7
    • Target
      x64/CrashReport.exe
    • Size 324KB
    • SHA256 a4d2630ed841b8cbc7d8a0e089d55c6b78ea2224025a0d0c15c14d74551fb009
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral8
    • Target
      x64/GUAssistComSvc.exe
    • Size 149KB
    • SHA256 1ddcd3cf1430119061a52ead6922447f2818860f3552e02bba85c172d491a2f7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral9
    • Target
      x64/Languages.dll
    • Size 63KB
    • SHA256 8f53730a1112309f600bd3d11066fdf8d220031ded1386e8a829e4a62b6eda3e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral10
    • Target
      x64/Log.dll
    • Size 153KB
    • SHA256 ff8fbbe32ba6e92504ca24e9aaffce986d09fddda83d31786b3c804d77f0f45b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral11
    • Target
      x64/MachineCode.dll
    • Size 130KB
    • SHA256 7069dac1c8f05da4c992d377a8950940843798a37dbfc81598b14bda5254081c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral12
    • Target
      x64/MemfilesService.exe
    • Size 406KB
    • SHA256 b3c68038c78fe69cd48b2a30075f06bf4b5df36a2374dcecea9eb4363910a329
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral13
    • Target
      x64/Microsoft.VC90.ATL.manifest
    • Size 468B
    • SHA256 e53eb957d9747839d4f64bf616e63b49147df858c820385056e1249a8f0bf1d3
    • MD5 SHA1 SHA512 TLSH
    Score
    7/10
    adwarediscoveryspyware

    • Loads dropped DLL

    behavioral14
    • Target
      x64/Microsoft.VC90.CRT.manifest
    • Size 526B
    • SHA256 58fc4416331672c7b7a413ce071c01ddfdf91ed1c0604ce014250b38dfc78787
    • MD5 SHA1 SHA512 TLSH
    Score
    4/10
    adwarediscoveryspyware
    behavioral15
    • Target
      x64/Microsoft.VC90.MFC.manifest
    • Size 550B
    • SHA256 e85ea26d156723557653b22c10adaefdfa0d9615049541a74cdb968f146a5ace
    • MD5 SHA1 SHA512 TLSH
    Score
    4/10
    adwarediscoveryspyware
    behavioral16
    • Target
      x64/ObjectAdmin.dll
    • Size 87KB
    • SHA256 e528dbc73a01bbe97632067796680a9f6dfe7f8a10424db2637971327fe21a77
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral17
    • Target
      x64/Register.dll
    • Size 801KB
    • SHA256 a772bf5eb9ec19a24bbd4bcd12a4bbbe9ce9b220378156b7f0470a08081515e1
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral18
    • Target
      x64/ScanFile.dll
    • Size 86KB
    • SHA256 ddba2d82efedd2474371dddda86c2ce703c44fdf5f5f708fb5d6bcbec57b5eac
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral19
    • Target
      x64/SkinsManager.dll
    • Size 116KB
    • SHA256 ccf26423ea4eb2d9f666ef309c99d0dbb56e001bdee56debe3902d5769788ff5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral20
    • Target
      x64/Unistall.exe
    • Size 31KB
    • SHA256 0d8df759dd56c772a1093fcfc63234df727929fd501f22e8f08318e3a4cb25e2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral21
    • Target
      x64/Win64ShellLink.exe
    • Size 147KB
    • SHA256 b453e616204f367c77c53d1068feee425af54bff1156cf2690b86d3d8aaf8c5e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral22
    • Target
      x64/atl90.dll
    • Size 172KB
    • SHA256 1fc041ed328c887e461c233a89b0001a57ef40d5a74c7300900dc3938850edfd
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral23
    • Target
      x64/mfc90.dll
    • Size 1.6MB
    • SHA256 2a527eef7d5cbc295e5b3ceef5c5e1c34bf9fba51335102b44d73b67f5dbbe86
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral24
    • Target
      x64/mfc90u.dll
    • Size 1.6MB
    • SHA256 05edbe012dac7de6cf398af14dd6007dd83b63a3e4f930972b12a1ebd75c0d41
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral25
    • Target
      x64/mfcm90.dll
    • Size 65KB
    • SHA256 33174be770ead05787933900b07be4598985bf9350790c47be77a56e5300ae0c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral26
    • Target
      x64/mfcm90u.dll
    • Size 65KB
    • SHA256 7838de76c4c7cde8e76a6d4bbc84203f22c498c1da9a34e82454d84075457e1f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral27
    • Target
      x64/msvcp90.dll
    • Size 831KB
    • SHA256 10859f06f41144fa32cf5da223511f85fe349b1d76471ef65f0395dac606ef63
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral28
    • Target
      x64/msvcr90.dll
    • Size 612KB
    • SHA256 e11ce4b90db815359b2d76f95f623fc26924c5a254f0540224fa6feb623817e5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral29
    • Target
      x64/zlib.dll
    • Size 146KB
    • SHA256 d4f34e2441eb92ab7b0de7c029cea76971b79ad1759a926256c502892b71c97a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral30
    • Target
      x64ProcessAssist.dll
    • Size 51KB
    • SHA256 820ddef67e9dc1e28dfb01936dadff7d610561c115f178c2954a0f8936f200d6
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral31
    • Target
      zlib1.dll
    • Size 92KB
    • SHA256 7bf3f3bd2d06abc8ce49b3b5469202976142939fc40cb6250d997b6bab3288a7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

2
T1546

Change Default File Association

1
T1546.001

Component Object Model Hijacking

1
T1546.015

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

2
T1546

Change Default File Association

1
T1546.001

Component Object Model Hijacking

1
T1546.015

Defense Evasion

Modify Registry

3
T1112

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

1
T1120

Query Registry

3
T1012

System Information Discovery

4
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Time Discovery

1
T1124

Lateral Movement

Collection

Data from Local System

2
T1005

Command and Control

Exfiltration

Impact

Tasks

static1

installer
Score
5/10

behavioral1

bootkitdefense_evasiondiscoveryinstallerpersistenceprivilege_escalationspywarestealertrojan
Score
8/10

behavioral2

Score
1/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

Score
1/10

behavioral6

persistenceprivilege_escalation
Score
5/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
1/10

behavioral14

adwarediscoveryspyware
Score
7/10

behavioral15

adwarediscoveryspyware
Score
4/10

behavioral16

adwarediscoveryspyware
Score
4/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

discovery
Score
3/10

behavioral32

discovery
Score
3/10