MALICIOUS — GardenscapesPCGUI.exe

MALICIOUS — GardenscapesPCGUI.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100). 3 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: d3112b9acac87ba46f867118aa807a5b554984b54202a474ab3600f13758d92c
SHA-1: 88f4059e9482a05ac9fb5d2db26e8170c2591c8b
MD5: 2831aab5ff7b2cd6f00a56fafd0b28a4
imphash: 0a94e6fd5e6de302f0ac60e5cb1d4cd6
ssdeep: 196608:qvu4SiL/Xtx7frSKOfBNW9GPNimayXyxZjBuClqHnxdJ2QXQ6gEoc:qGkTvDrOfa9GPNijyI+vHzJ2QA65oc
TLSH: T1EF6D336110332668E1E9B8EC941EE4CC5087F41A37606FFED997611F62C92EB21274DB
Submitted as: GardenscapesPCGUI.exe
File type: pe · Size: 13030400 bytes
Verdict: malicious (94/100)

Detections (3 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): Nuitka
Detect It Easy (packer/type): DIE:Nuitka
Microsoft Defender: Trojan:Win32/Sabsik.EN.A!ml

MITRE ATT&CK

Why this verdict

The malicious score of 94/100 is the fusion of 9 weighted signals:

Microsoft Defender flagged Trojan:Win32/Sabsik.EN.A!ml (rule Trojan:Win32/Sabsik.EN.A!ml) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 1 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:Nuitka (rule DIE:Nuitka) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged Nuitka (rule Nuitka) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: Nuitka - static signal, weight 0.25, confidence 0.55
Dropped 11 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

8671 behavior events · 2 ATT&CK techniques · 99 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\onefile_8692_560015_Rku8dpsGZcI\python3.dll - 5146005c36455e7ede4b8ecc0dc6f6fa8ea6b4a99fedbabc1994ae27dfab9d1b
C:\Users\analyst\AppData\Local\Temp\onefile_8692_560015_Rku8dpsGZcI\_wmi.pyd - 752fb80edb51f45d3cc1c046f3b007802432b91aef400c985640d6b276a67c12
C:\Users\analyst\AppData\Local\Temp\onefile_8692_560015_Rku8dpsGZcI\_ssl.pyd - a5d361707f7a2a2d726b20770e8a6fc25d753be30bcbcbbb683ffee7959557c2
C:\Users\analyst\AppData\Local\Temp\onefile_8692_560015_Rku8dpsGZcI\tcl\encoding\cp864.enc - 81bebfd9a61e9f17495763b68d57742fab2a1a43871015699a2c8e5fded4ec19
C:\Users\analyst\AppData\Local\Temp\onefile_8692_560015_Rku8dpsGZcI\tcl\encoding\iso8859-5.enc - 3130bf26da0c840c1e02203a90c3b1c38966fb203130e2fbb3dd7cb3865a3539
C:\Users\analyst\AppData\Local\Temp\onefile_8692_560015_Rku8dpsGZcI\tcl\encoding\cns11643.enc - 8924545cc92584169138aadb64683c07bbf846a57014c2e668d23b63f43f3610
C:\Users\analyst\AppData\Local\Temp\onefile_8692_560015_Rku8dpsGZcI\zlib1.dll - 21feea753a6f991f01bcf9d30afada06eca3a105e97d5d81998ef359c4fc86a3
C:\Users\analyst\AppData\Local\Temp\onefile_8692_560015_Rku8dpsGZcI\tcl\encoding\iso8859-1.enc - a9cb4f4ca111608f882729bc5eb1c2f15530c515ef02dd2ca62f2d8dc5a210cf
C:\Users\analyst\AppData\Local\Temp\onefile_8692_560015_Rku8dpsGZcI\gui_remote.dll - 370e621454ac66f4b72e699f5aff9f044b505538c413c50c5b2335c5daad820f
C:\Users\analyst\AppData\Local\Temp\onefile_8692_560015_Rku8dpsGZcI\customtkinter\assets\icons\CustomTkinter_icon_Windows.ico - 1234c017c871eb2e20d36f668f93e066cdcb93db464d5cef9d7a5bf83506d28c
C:\Users\analyst\AppData\Local\Temp\onefile_8692_560015_Rku8dpsGZcI\tcl\encoding\cp874.enc - 4f05f31ca026bbfeeee49ed86504cb060784137a9cfae0e5954d276e837ab5de
C:\Users\analyst\AppData\Local\Temp\onefile_8692_560015_Rku8dpsGZcI\tcl\parray.tcl - e269029c8263e3cbc1920c3604ecdcf15edccb208a0d68f9eb42b73954d620c0
C:\Users\analyst\AppData\Local\Temp\onefile_8692_560015_Rku8dpsGZcI\tcl\encoding\iso8859-13.enc - 3271d39d7b4dcd841e8e5d5153d1b8837718b88fefec73dc37d314816eefe5e5
C:\Users\analyst\AppData\Local\Temp\onefile_8692_560015_Rku8dpsGZcI\tcl\encoding\cp850.enc - 13df611f429a9b331da1b34f3c718cccaf0bd4ab44f71a9c632197987b4d643b
C:\Users\analyst\AppData\Local\Temp\onefile_8692_560015_Rku8dpsGZcI\tcl\encoding\dingbats.enc - eb9b262e4d179268e6f017c0d4ef0e7034e31a5b4893595d150640ca1f6a1c45

Embedded URLs

http://schemas.microsoft.com/SMI/2016/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

yfr.za
t.za
t.tw
b.co
cio.tw
schemas.microsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

13.89.179.15
52.123.252.236
4.230.171.124
40.84.85.40
74.179.77.164
74.178.76.128
40.79.141.154
52.230.59.222
4.207.44.77
135.232.92.137
4.150.223.100
4.207.44.68
20.42.179.192
52.148.114.188
92.223.78.30
57.155.104.224
4.150.223.105
172.172.255.217
72.154.7.98
52.110.12.16
52.110.12.14

File paths

z:\AN
S:\dA
d:\Gf
D:\a\1\b\\\pdb
i:\~
i:\Gf
z:\_t
h:\({

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report