Overview

overview

10

Static

static

8

c7f4619195...7d.exe

windows7_x64

10

c7f4619195...7d.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    22/05/2022, 00:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    c7f46191959054a2cc3ea3cff5db657d.exe
  • Size 2.0MB
  • Sample220522-a5dk7aecb6
  • SHA256 8d8de2dbae6460fda8a7dae85b6dde85cb511cf57462449b2120b4652340fbec
  • MD5 SHA1 SHA512
Score
10/10
gh0stratratsuricataupx

Malware Config

Signatures

  • Gh0st RAT payload 6 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat
  • suricata: ET MALWARE Backdoor family PCRat/Gh0st CnC traffic

    suricata: ET MALWARE Backdoor family PCRat/Gh0st CnC traffic

    suricata
  • suricata: ET MALWARE Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 102

    suricata: ET MALWARE Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 102

    suricata
  • suricata: ET MALWARE Gh0st Remote Access Trojan Encrypted Session To CnC Server

    suricata: ET MALWARE Gh0st Remote Access Trojan Encrypted Session To CnC Server

    suricata
  • Executes dropped EXE 2 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 26 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c7f46191959054a2cc3ea3cff5db657d.exe
    "C:\Users\Admin\AppData\Local\Temp\c7f46191959054a2cc3ea3cff5db657d.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1496
    • C:\Users\Admin\AppData\Local\Temp\Temp\a1.exe
      "C:\Users\Admin\AppData\Local\Temp\Temp\a1.exe"
      2⤵
      • Executes dropped EXE
      PID:616
    • C:\Users\Admin\AppData\Local\Temp\Temp\sql.exe
      "C:\Users\Admin\AppData\Local\Temp\Temp\sql.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:1112
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService -p -s SstpSvc
    1⤵
      PID:380
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k netsvcs -p -s DsmSvc
      1⤵
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:3476
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc
      1⤵
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:4976
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k netsvcs
      1⤵
        PID:4556
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\SysWOW64\svchost.exe -k imgsvc
        1⤵
        • Loads dropped DLL
        • Checks processor information in registry
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        PID:3400

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            885800.dll
            • Path C:\885800.dll
            • Size 107KB
            • SHA256 707ba0317e2b0b7ae347cc48b35bd2cd5acf8468573a5003c9e5c6b7f2aa00ad
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            885800.dll
            • Path C:\885800.dll
            • Size 107KB
            • SHA256 707ba0317e2b0b7ae347cc48b35bd2cd5acf8468573a5003c9e5c6b7f2aa00ad
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            a1.exe
            • Path C:\Users\Admin\AppData\Local\Temp\Temp\a1.exe
            • Size 2.0MB
            • SHA256 5d2e27843c4729cdbfa53087d8ef0619cd6c14b13f6d359cebf250442acda776
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            a1.exe
            • Path C:\Users\Admin\AppData\Local\Temp\Temp\a1.exe
            • Size 2.0MB
            • SHA256 5d2e27843c4729cdbfa53087d8ef0619cd6c14b13f6d359cebf250442acda776
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            sql.exe
            • Path C:\Users\Admin\AppData\Local\Temp\Temp\sql.exe
            • Size 139KB
            • SHA256 8ad7aee06e138580471b60b0f88c3b50e507e4137c98b8efd797cbc50b25189b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            sql.exe
            • Path C:\Users\Admin\AppData\Local\Temp\Temp\sql.exe
            • Size 139KB
            • SHA256 8ad7aee06e138580471b60b0f88c3b50e507e4137c98b8efd797cbc50b25189b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            FileName.jpg
            • Path C:\Windows\FileName.jpg
            • Size 1.4MB
            • SHA256 3578d4052a74472e1e81ed778afe3fb106e7a9ee524f4739ba8a41187b108061
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            netrasa.PNF
            • Path C:\Windows\INF\netrasa.PNF
            • Size 22KB
            • SHA256 b56c174db6467e19ba3ec294723d0caa948f04aeab3b4c985ad2bf07777e4e36
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            NT_Path.jpg
            • Path \??\c:\NT_Path.jpg
            • Size 60B
            • SHA256 1b445648e642aed6dff342dc1ee06c1b2f5f79c925949dc8a3ceb8da8059053d
            • MD5 SHA1 SHA512
            Submit Download

            filename.jpg
            • Path \??\c:\windows\filename.jpg
            • Size 1.4MB
            • SHA256 3578d4052a74472e1e81ed778afe3fb106e7a9ee524f4739ba8a41187b108061
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download