Overview
overview
9Static
static
7GlassWireSetup.exe
windows7-x64
9GlassWireSetup.exe
windows10-2004-x64
9$PLUGINSDI...St.exe
windows7-x64
9$PLUGINSDI...St.exe
windows10-2004-x64
9$PLUGINSDI...nu.dll
windows7-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...er.dll
windows7-x64
9$PLUGINSDI...er.dll
windows10-2004-x64
9$PLUGINSDI...86.exe
windows7-x64
7$PLUGINSDI...86.exe
windows10-2004-x64
7GWCtlSrv.exe
windows7-x64
9GWCtlSrv.exe
windows10-2004-x64
9GWEventLog.dll
windows7-x64
9GWEventLog.dll
windows10-2004-x64
9GWIdlMon.exe
windows7-x64
9GWIdlMon.exe
windows10-2004-x64
9GWUnlock.exe
windows7-x64
9GWUnlock.exe
windows10-2004-x64
9GWUpgradeMonitor.exe
windows7-x64
9GWUpgradeMonitor.exe
windows10-2004-x64
9GlassWire.exe
windows7-x64
9GlassWire.exe
windows10-2004-x64
9Qt5Core.dll
windows7-x64
1Qt5Core.dll
windows10-2004-x64
3Qt5Gui.dll
windows7-x64
1Qt5Gui.dll
windows10-2004-x64
1Analysis
-
max time kernel
119s -
max time network
54s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30-06-2024 07:11
Behavioral task
behavioral1
Sample
GlassWireSetup.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
GlassWireSetup.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/GWInstSt.exe
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/GWInstSt.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240611-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsihelper.dll
Resource
win7-20240220-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsihelper.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/vc_redist.x86.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/vc_redist.x86.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
GWCtlSrv.exe
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
GWCtlSrv.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral19
Sample
GWEventLog.dll
Resource
win7-20240419-en
Behavioral task
behavioral20
Sample
GWEventLog.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
GWIdlMon.exe
Resource
win7-20231129-en
Behavioral task
behavioral22
Sample
GWIdlMon.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
GWUnlock.exe
Resource
win7-20240611-en
Behavioral task
behavioral24
Sample
GWUnlock.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
GWUpgradeMonitor.exe
Resource
win7-20240611-en
Behavioral task
behavioral26
Sample
GWUpgradeMonitor.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral27
Sample
GlassWire.exe
Resource
win7-20240220-en
Behavioral task
behavioral28
Sample
GlassWire.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
Qt5Core.dll
Resource
win7-20231129-en
Behavioral task
behavioral30
Sample
Qt5Core.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral31
Sample
Qt5Gui.dll
Resource
win7-20240419-en
Behavioral task
behavioral32
Sample
Qt5Gui.dll
Resource
win10v2004-20240611-en
General
-
Target
GWIdlMon.exe
-
Size
5.3MB
-
MD5
5d333cdf3eced3cf2f61c07cc15a8eba
-
SHA1
6321f00a6f39dc1f8b22cafccb6c5fe47aa29e65
-
SHA256
fdf09a997ff577218a43fab6767d3a6239f12ffe59d9917d44e540bc23fdd252
-
SHA512
51b61345f81549693900e7b2e1592be0da03e0e3fee5c75885cb4af3e851f757097e5d18d625cb3868ea5f5d4bfc9ca6c1d8fda1ba17eb8ae48a905b82c7faba
-
SSDEEP
98304:2wnrJIKFej1+izXGP/JRZOqZVZpSxhJO5vsI7k7LJKSm24rfUN9tjjtNB:7n9xex+iiJRMqNp8hM5EI7k7opfrfUNZ
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
GWIdlMon.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ GWIdlMon.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
GWIdlMon.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion GWIdlMon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion GWIdlMon.exe -
Processes:
GWIdlMon.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA GWIdlMon.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
GWIdlMon.exepid process 4332 GWIdlMon.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4332-0-0x0000000077564000-0x0000000077566000-memory.dmpFilesize
8KB
-
memory/4332-1-0x00000000007A0000-0x00000000016F2000-memory.dmpFilesize
15.3MB
-
memory/4332-4-0x00000000007A0000-0x00000000016F2000-memory.dmpFilesize
15.3MB
-
memory/4332-3-0x00000000007A0000-0x00000000016F2000-memory.dmpFilesize
15.3MB
-
memory/4332-2-0x00000000007A0000-0x00000000016F2000-memory.dmpFilesize
15.3MB
-
memory/4332-5-0x00000000007A0000-0x00000000016F2000-memory.dmpFilesize
15.3MB
-
memory/4332-7-0x00000000007A0000-0x00000000016F2000-memory.dmpFilesize
15.3MB
-
memory/4332-8-0x00000000007A0000-0x00000000016F2000-memory.dmpFilesize
15.3MB
-
memory/4332-9-0x00000000007A0000-0x00000000016F2000-memory.dmpFilesize
15.3MB
-
memory/4332-6-0x00000000007A0000-0x00000000016F2000-memory.dmpFilesize
15.3MB
-
memory/4332-10-0x00000000007A0000-0x00000000016F2000-memory.dmpFilesize
15.3MB