Overview

overview

10

Static

static

7AE15C1BFD...6F.exe

windows7_x64

10

7AE15C1BFD...6F.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    22/03/2022, 13:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    7AE15C1BFDF60A0B05EFE8F2B0E0C70C1F7D8AAEF456F.exe
  • Size 145KB
  • Sample220322-qdstssfdb2
  • SHA256 7ae15c1bfdf60a0b05efe8f2b0e0c70c1f7d8aaef456fc82efd1092bc687c7d7
  • MD5 SHA1 SHA512
Score
10/10
gh0stratratsuricata

Malware Config

Signatures

  • Gh0st RAT payload 6 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat
  • suricata: ET MALWARE Backdoor family PCRat/Gh0st CnC traffic

    suricata: ET MALWARE Backdoor family PCRat/Gh0st CnC traffic

    suricata
  • suricata: ET MALWARE Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 102

    suricata: ET MALWARE Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 102

    suricata
  • Blocklisted process makes network request 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies data under HKEY_USERS 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7AE15C1BFDF60A0B05EFE8F2B0E0C70C1F7D8AAEF456F.exe
    "C:\Users\Admin\AppData\Local\Temp\7AE15C1BFDF60A0B05EFE8F2B0E0C70C1F7D8AAEF456F.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2000
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k imgsvc
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3860
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Program Files (x86)\Plmn\Ulmnopqrs.bmp", FineView
      2⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Modifies data under HKEY_USERS
      PID:1928

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Ulmnopqrs.bmp
        • Path C:\Program Files (x86)\Plmn\Ulmnopqrs.bmp
        • Size 224KB
        • SHA256 c897d2ce05c287c1555f0fbdabd63cc2adf2ab4edf62128c92d4ead4122ee81d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Ulmnopqrs.bmp
        • Path C:\Program Files (x86)\Plmn\Ulmnopqrs.bmp
        • Size 224KB
        • SHA256 c897d2ce05c287c1555f0fbdabd63cc2adf2ab4edf62128c92d4ead4122ee81d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        atiamellRvfK.dll
        • Path C:\Windows\atiamellRvfK.dll
        • Size 224KB
        • SHA256 c897d2ce05c287c1555f0fbdabd63cc2adf2ab4edf62128c92d4ead4122ee81d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        atiamellRvfK.dll
        • Path C:\Windows\atiamellRvfK.dll
        • Size 224KB
        • SHA256 c897d2ce05c287c1555f0fbdabd63cc2adf2ab4edf62128c92d4ead4122ee81d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ulmnopqrs.bmp
        • Path \??\c:\program files (x86)\plmn\ulmnopqrs.bmp
        • Size 224KB
        • SHA256 c897d2ce05c287c1555f0fbdabd63cc2adf2ab4edf62128c92d4ead4122ee81d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        win.log
        • Path \??\c:\windows\win.log
        • Size 111B
        • SHA256 11b591a8c83b1cf666a8a2fabed83a043fcb8df5afecb4aca493d4ada2c58469
        • MD5 SHA1 SHA512
        Submit Download

        memory/2000-130-0x0000000000400000-0x0000000000492000-memory.dmp
        Download