Analysis
- max time kernel
4294202s - max time network
145s - platform
windows7_x64 - resource
win7-20220311-en - submitted
22/03/2022, 13:09
Static task
static1
Behavioral task
behavioral1
Sample
7AE15C1BFDF60A0B05EFE8F2B0E0C70C1F7D8AAEF456F.exe
Resource
win7-20220311-en
windows7_x64
0 signatures
0 seconds
General
- Target 7AE15C1BFDF60A0B05EFE8F2B0E0C70C1F7D8AAEF456F.exe
- Size 145KB
- Sample220322-qdstssfdb2
- SHA256 7ae15c1bfdf60a0b05efe8f2b0e0c70c1f7d8aaef456fc82efd1092bc687c7d7
- MD5 d4ffa8c3584762b282e3f1ad7ba79bad
- SHA1 f7a0ed621d7d93b4a3d57c5d9c57bc1287531e90
- SHA512 ccec9f14b0cd9a4a663fb72d145d9e9ddffb9bf3fdbd7875b609d6e28cdd33cd39d2ac7359256c03998a6130043cd79a35c3d74a3a93729b45606ae1d5649fc4
- MD5 SHA1 SHA512
Malware Config
Signatures
- Gh0st RAT payload 4 IoCs
resource yara_rule behavioral1/files/0x000d000000012346-55.dat family_gh0strat behavioral1/files/0x000d000000012346-56.dat family_gh0strat behavioral1/files/0x000a00000001230b-59.dat family_gh0strat behavioral1/files/0x000d000000012346-61.dat family_gh0strat - suricata: ET MALWARE Backdoor family PCRat/Gh0st CnC traffic
suricata: ET MALWARE Backdoor family PCRat/Gh0st CnC traffic
- suricata: ET MALWARE Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 102
suricata: ET MALWARE Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 102
- Blocklisted process makes network request 4 IoCs
flow pid Process 3 540 rundll32.exe 4 540 rundll32.exe 6 540 rundll32.exe 7 540 rundll32.exe - Deletes itself 1 IoCs
pid Process 1740 svchost.exe - Loads dropped DLL 2 IoCs
pid Process 1740 svchost.exe 540 rundll32.exe - Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files (x86)\Plmn\Ulmnopqrs.bmp svchost.exe File opened for modification C:\Program Files (x86)\Plmn\Ulmnopqrs.bmp 7AE15C1BFDF60A0B05EFE8F2B0E0C70C1F7D8AAEF456F.exe File created C:\Program Files (x86)\Plmn\Ulmnopqrs.bmp 7AE15C1BFDF60A0B05EFE8F2B0E0C70C1F7D8AAEF456F.exe File opened for modification C:\Program Files (x86)\Plmn\Ulmnopqrs.bmp svchost.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\atiamellCNao.dll 7AE15C1BFDF60A0B05EFE8F2B0E0C70C1F7D8AAEF456F.exe File created \??\c:\windows\win.log 7AE15C1BFDF60A0B05EFE8F2B0E0C70C1F7D8AAEF456F.exe - Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\NetSubKey rundll32.exe - Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeBackupPrivilege 1604 7AE15C1BFDF60A0B05EFE8F2B0E0C70C1F7D8AAEF456F.exe Token: SeRestorePrivilege 1604 7AE15C1BFDF60A0B05EFE8F2B0E0C70C1F7D8AAEF456F.exe Token: SeBackupPrivilege 1604 7AE15C1BFDF60A0B05EFE8F2B0E0C70C1F7D8AAEF456F.exe Token: SeRestorePrivilege 1604 7AE15C1BFDF60A0B05EFE8F2B0E0C70C1F7D8AAEF456F.exe Token: SeBackupPrivilege 1604 7AE15C1BFDF60A0B05EFE8F2B0E0C70C1F7D8AAEF456F.exe Token: SeRestorePrivilege 1604 7AE15C1BFDF60A0B05EFE8F2B0E0C70C1F7D8AAEF456F.exe Token: SeBackupPrivilege 1604 7AE15C1BFDF60A0B05EFE8F2B0E0C70C1F7D8AAEF456F.exe Token: SeRestorePrivilege 1604 7AE15C1BFDF60A0B05EFE8F2B0E0C70C1F7D8AAEF456F.exe Token: SeBackupPrivilege 1740 svchost.exe Token: SeRestorePrivilege 1740 svchost.exe Token: SeBackupPrivilege 1740 svchost.exe Token: SeRestorePrivilege 1740 svchost.exe Token: SeBackupPrivilege 1740 svchost.exe Token: SeRestorePrivilege 1740 svchost.exe Token: SeDebugPrivilege 1740 svchost.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1740 wrote to memory of 540 1740 svchost.exe 28 PID 1740 wrote to memory of 540 1740 svchost.exe 28 PID 1740 wrote to memory of 540 1740 svchost.exe 28 PID 1740 wrote to memory of 540 1740 svchost.exe 28 PID 1740 wrote to memory of 540 1740 svchost.exe 28 PID 1740 wrote to memory of 540 1740 svchost.exe 28 PID 1740 wrote to memory of 540 1740 svchost.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\7AE15C1BFDF60A0B05EFE8F2B0E0C70C1F7D8AAEF456F.exe"C:\Users\Admin\AppData\Local\Temp\7AE15C1BFDF60A0B05EFE8F2B0E0C70C1F7D8AAEF456F.exe"1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1604
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Deletes itself
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Program Files (x86)\Plmn\Ulmnopqrs.bmp", FineView2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Modifies data under HKEY_USERS
PID:540
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\atiamellCNao.dll
- Size 224KB
- SHA256 c897d2ce05c287c1555f0fbdabd63cc2adf2ab4edf62128c92d4ead4122ee81d
- MD5 6eb5b3877b8f4f44091d5368b5a64a9f
- SHA1 d67697bfa75188f0ff5d2fefcc61853db1f166a3
- SHA512 922385992fc76898c042da8f66876944bd9107dc37faa99cf5ef7ae30fb8b4e3a7bc0829b263a63378f36a594c64300f0d8d28b65bcb9e4a22790ddd9f0a700d
- SSDEEP 3072:KdQo6wtIptugitFof9zCPc4MQ77IxZa39TtsAneb/eZJ73tt4TSOB3c7TLby:sQoPIHi0zYOQ77aZQ10/6J7zWSOBay
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\program files (x86)\plmn\ulmnopqrs.bmp
- Size 224KB
- SHA256 c897d2ce05c287c1555f0fbdabd63cc2adf2ab4edf62128c92d4ead4122ee81d
- MD5 6eb5b3877b8f4f44091d5368b5a64a9f
- SHA1 d67697bfa75188f0ff5d2fefcc61853db1f166a3
- SHA512 922385992fc76898c042da8f66876944bd9107dc37faa99cf5ef7ae30fb8b4e3a7bc0829b263a63378f36a594c64300f0d8d28b65bcb9e4a22790ddd9f0a700d
- SSDEEP 3072:KdQo6wtIptugitFof9zCPc4MQ77IxZa39TtsAneb/eZJ73tt4TSOB3c7TLby:sQoPIHi0zYOQ77aZQ10/6J7zWSOBay
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\windows\win.log
- Size 111B
- SHA256 bddf63a0dbe7995b428db0917325e7995fe0b664cda7cbee589677734b834ebe
- MD5 842ca60f43d62c441f2f4105c023fe3c
- SHA1 777563f167370b98ca07ea804b4a8803f0eeafd7
- SHA512 5b309d8752cdc502742d863ce0a6708e7e94dd5cbbfa0f34b49693b657997804d9e75a791cf0fe98f90946603b03091d17e6244a284a116e62ddf1178fb3af1a
- MD5 SHA1 SHA512
- Path \Program Files (x86)\Plmn\Ulmnopqrs.bmp
- Size 224KB
- SHA256 c897d2ce05c287c1555f0fbdabd63cc2adf2ab4edf62128c92d4ead4122ee81d
- MD5 6eb5b3877b8f4f44091d5368b5a64a9f
- SHA1 d67697bfa75188f0ff5d2fefcc61853db1f166a3
- SHA512 922385992fc76898c042da8f66876944bd9107dc37faa99cf5ef7ae30fb8b4e3a7bc0829b263a63378f36a594c64300f0d8d28b65bcb9e4a22790ddd9f0a700d
- SSDEEP 3072:KdQo6wtIptugitFof9zCPc4MQ77IxZa39TtsAneb/eZJ73tt4TSOB3c7TLby:sQoPIHi0zYOQ77aZQ10/6J7zWSOBay
- MD5 SHA1 SHA512 SSDEEP
- Path \Program Files (x86)\Plmn\Ulmnopqrs.bmp
- Size 224KB
- SHA256 c897d2ce05c287c1555f0fbdabd63cc2adf2ab4edf62128c92d4ead4122ee81d
- MD5 6eb5b3877b8f4f44091d5368b5a64a9f
- SHA1 d67697bfa75188f0ff5d2fefcc61853db1f166a3
- SHA512 922385992fc76898c042da8f66876944bd9107dc37faa99cf5ef7ae30fb8b4e3a7bc0829b263a63378f36a594c64300f0d8d28b65bcb9e4a22790ddd9f0a700d
- SSDEEP 3072:KdQo6wtIptugitFof9zCPc4MQ77IxZa39TtsAneb/eZJ73tt4TSOB3c7TLby:sQoPIHi0zYOQ77aZQ10/6J7zWSOBay
- MD5 SHA1 SHA512 SSDEEP
