Overview
overview
9Static
static
7GlassWireSetup.exe
windows7-x64
9GlassWireSetup.exe
windows10-2004-x64
9$PLUGINSDI...St.exe
windows7-x64
9$PLUGINSDI...St.exe
windows10-2004-x64
9$PLUGINSDI...nu.dll
windows7-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...er.dll
windows7-x64
9$PLUGINSDI...er.dll
windows10-2004-x64
9$PLUGINSDI...86.exe
windows7-x64
7$PLUGINSDI...86.exe
windows10-2004-x64
7GWCtlSrv.exe
windows7-x64
9GWCtlSrv.exe
windows10-2004-x64
9GWEventLog.dll
windows7-x64
9GWEventLog.dll
windows10-2004-x64
9GWIdlMon.exe
windows7-x64
9GWIdlMon.exe
windows10-2004-x64
9GWUnlock.exe
windows7-x64
9GWUnlock.exe
windows10-2004-x64
9GWUpgradeMonitor.exe
windows7-x64
9GWUpgradeMonitor.exe
windows10-2004-x64
9GlassWire.exe
windows7-x64
9GlassWire.exe
windows10-2004-x64
9Qt5Core.dll
windows7-x64
1Qt5Core.dll
windows10-2004-x64
3Qt5Gui.dll
windows7-x64
1Qt5Gui.dll
windows10-2004-x64
1Analysis
-
max time kernel
50s -
max time network
59s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30-06-2024 07:11
Behavioral task
behavioral1
Sample
GlassWireSetup.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
GlassWireSetup.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/GWInstSt.exe
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/GWInstSt.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240611-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsihelper.dll
Resource
win7-20240220-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsihelper.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/vc_redist.x86.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/vc_redist.x86.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
GWCtlSrv.exe
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
GWCtlSrv.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral19
Sample
GWEventLog.dll
Resource
win7-20240419-en
Behavioral task
behavioral20
Sample
GWEventLog.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
GWIdlMon.exe
Resource
win7-20231129-en
Behavioral task
behavioral22
Sample
GWIdlMon.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
GWUnlock.exe
Resource
win7-20240611-en
Behavioral task
behavioral24
Sample
GWUnlock.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
GWUpgradeMonitor.exe
Resource
win7-20240611-en
Behavioral task
behavioral26
Sample
GWUpgradeMonitor.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral27
Sample
GlassWire.exe
Resource
win7-20240220-en
Behavioral task
behavioral28
Sample
GlassWire.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
Qt5Core.dll
Resource
win7-20231129-en
Behavioral task
behavioral30
Sample
Qt5Core.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral31
Sample
Qt5Gui.dll
Resource
win7-20240419-en
Behavioral task
behavioral32
Sample
Qt5Gui.dll
Resource
win10v2004-20240611-en
General
-
Target
GWUnlock.exe
-
Size
3.9MB
-
MD5
e3b8025f68218afe124eac6fe003eff6
-
SHA1
8ec765a41e631c5d77882e71d48f63fc0d0ffbbd
-
SHA256
f424e81a5504896a2f96a56433e086daf86020d3503d88b67fa885a75eb79389
-
SHA512
136f9a72dc76a412669675b7d17527f5d1d63ae793afddce0554e070eafc954c8b33683fc2c3dd13b64f09437f05ef796edc4140d6421f15c50387a8a8a83962
-
SSDEEP
98304:SKaIL5ysioj6zmmKO0msVe/GZfqOOijGEeJJqhhMmWb:2IL5Z+mmKO0vy03tpib
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
GWUnlock.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ GWUnlock.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
GWUnlock.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion GWUnlock.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion GWUnlock.exe -
Processes:
resource yara_rule behavioral24/memory/1732-0-0x00000000001E0000-0x0000000000C1B000-memory.dmp themida behavioral24/memory/1732-2-0x00000000001E0000-0x0000000000C1B000-memory.dmp themida behavioral24/memory/1732-3-0x00000000001E0000-0x0000000000C1B000-memory.dmp themida behavioral24/memory/1732-4-0x00000000001E0000-0x0000000000C1B000-memory.dmp themida behavioral24/memory/1732-5-0x00000000001E0000-0x0000000000C1B000-memory.dmp themida behavioral24/memory/1732-6-0x00000000001E0000-0x0000000000C1B000-memory.dmp themida behavioral24/memory/1732-7-0x00000000001E0000-0x0000000000C1B000-memory.dmp themida behavioral24/memory/1732-8-0x00000000001E0000-0x0000000000C1B000-memory.dmp themida behavioral24/memory/1732-10-0x00000000001E0000-0x0000000000C1B000-memory.dmp themida behavioral24/memory/1732-11-0x00000000001E0000-0x0000000000C1B000-memory.dmp themida behavioral24/memory/1732-9-0x00000000001E0000-0x0000000000C1B000-memory.dmp themida behavioral24/memory/1732-13-0x00000000001E0000-0x0000000000C1B000-memory.dmp themida -
Processes:
GWUnlock.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA GWUnlock.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
GWUnlock.exepid process 1732 GWUnlock.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1732-1-0x00000000778D4000-0x00000000778D6000-memory.dmpFilesize
8KB
-
memory/1732-0-0x00000000001E0000-0x0000000000C1B000-memory.dmpFilesize
10.2MB
-
memory/1732-2-0x00000000001E0000-0x0000000000C1B000-memory.dmpFilesize
10.2MB
-
memory/1732-3-0x00000000001E0000-0x0000000000C1B000-memory.dmpFilesize
10.2MB
-
memory/1732-4-0x00000000001E0000-0x0000000000C1B000-memory.dmpFilesize
10.2MB
-
memory/1732-5-0x00000000001E0000-0x0000000000C1B000-memory.dmpFilesize
10.2MB
-
memory/1732-6-0x00000000001E0000-0x0000000000C1B000-memory.dmpFilesize
10.2MB
-
memory/1732-7-0x00000000001E0000-0x0000000000C1B000-memory.dmpFilesize
10.2MB
-
memory/1732-8-0x00000000001E0000-0x0000000000C1B000-memory.dmpFilesize
10.2MB
-
memory/1732-10-0x00000000001E0000-0x0000000000C1B000-memory.dmpFilesize
10.2MB
-
memory/1732-11-0x00000000001E0000-0x0000000000C1B000-memory.dmpFilesize
10.2MB
-
memory/1732-9-0x00000000001E0000-0x0000000000C1B000-memory.dmpFilesize
10.2MB
-
memory/1732-13-0x00000000001E0000-0x0000000000C1B000-memory.dmpFilesize
10.2MB