Overview

overview

10

Static

static

8

c7f4619195...7d.exe

windows7_x64

10

c7f4619195...7d.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    22/05/2022, 00:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    c7f46191959054a2cc3ea3cff5db657d.exe
  • Size 2.0MB
  • Sample220522-a5dk7aecb6
  • SHA256 8d8de2dbae6460fda8a7dae85b6dde85cb511cf57462449b2120b4652340fbec
  • MD5 SHA1 SHA512
Score
10/10
gh0stratratsuricataupx

Malware Config

Signatures

  • Gh0st RAT payload 8 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat
  • suricata: ET MALWARE Backdoor family PCRat/Gh0st CnC traffic

    suricata: ET MALWARE Backdoor family PCRat/Gh0st CnC traffic

    suricata
  • suricata: ET MALWARE Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 102

    suricata: ET MALWARE Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 102

    suricata
  • suricata: ET MALWARE Gh0st Remote Access Trojan Encrypted Session To CnC Server

    suricata: ET MALWARE Gh0st Remote Access Trojan Encrypted Session To CnC Server

    suricata
  • Executes dropped EXE 2 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 5 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 51 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c7f46191959054a2cc3ea3cff5db657d.exe
    "C:\Users\Admin\AppData\Local\Temp\c7f46191959054a2cc3ea3cff5db657d.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1580
    • C:\Users\Admin\AppData\Local\Temp\Temp\a1.exe
      "C:\Users\Admin\AppData\Local\Temp\Temp\a1.exe"
      2⤵
      • Executes dropped EXE
      PID:1092
    • C:\Users\Admin\AppData\Local\Temp\Temp\sql.exe
      "C:\Users\Admin\AppData\Local\Temp\Temp\sql.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:956
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k imgsvc
    1⤵
    • Checks processor information in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    PID:1984

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        864500.dll
        • Path C:\864500.dll
        • Size 107KB
        • SHA256 707ba0317e2b0b7ae347cc48b35bd2cd5acf8468573a5003c9e5c6b7f2aa00ad
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        a1.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Temp\a1.exe
        • Size 2.0MB
        • SHA256 5d2e27843c4729cdbfa53087d8ef0619cd6c14b13f6d359cebf250442acda776
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        a1.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Temp\a1.exe
        • Size 2.0MB
        • SHA256 5d2e27843c4729cdbfa53087d8ef0619cd6c14b13f6d359cebf250442acda776
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        sql.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Temp\sql.exe
        • Size 139KB
        • SHA256 8ad7aee06e138580471b60b0f88c3b50e507e4137c98b8efd797cbc50b25189b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        sql.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Temp\sql.exe
        • Size 139KB
        • SHA256 8ad7aee06e138580471b60b0f88c3b50e507e4137c98b8efd797cbc50b25189b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        NT_Path.jpg
        • Path \??\c:\NT_Path.jpg
        • Size 60B
        • SHA256 321d28316d962ad07427bcdfeb8d34c777ea0be53929b046c29d1066c8c21c5e
        • MD5 SHA1 SHA512
        Submit Download

        filename.jpg
        • Path \??\c:\windows\filename.jpg
        • Size 9.5MB
        • SHA256 2d0a80765bee717d6e9e40efaa6310ae9974e561b3e82fbc243518c9001b7a43
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        a1.exe
        • Path \Users\Admin\AppData\Local\Temp\Temp\a1.exe
        • Size 2.0MB
        • SHA256 5d2e27843c4729cdbfa53087d8ef0619cd6c14b13f6d359cebf250442acda776
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        sql.exe
        • Path \Users\Admin\AppData\Local\Temp\Temp\sql.exe
        • Size 139KB
        • SHA256 8ad7aee06e138580471b60b0f88c3b50e507e4137c98b8efd797cbc50b25189b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        sql.exe
        • Path \Users\Admin\AppData\Local\Temp\Temp\sql.exe
        • Size 139KB
        • SHA256 8ad7aee06e138580471b60b0f88c3b50e507e4137c98b8efd797cbc50b25189b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        sql.exe
        • Path \Users\Admin\AppData\Local\Temp\Temp\sql.exe
        • Size 139KB
        • SHA256 8ad7aee06e138580471b60b0f88c3b50e507e4137c98b8efd797cbc50b25189b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        sql.exe
        • Path \Users\Admin\AppData\Local\Temp\Temp\sql.exe
        • Size 139KB
        • SHA256 8ad7aee06e138580471b60b0f88c3b50e507e4137c98b8efd797cbc50b25189b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/1580-54-0x0000000075E51000-0x0000000075E53000-memory.dmp
        Download