Resubmissions
03-06-2022 13:29
220603-qrcpqsffc9 1001-06-2022 09:32
220601-lhy46afgg5 1024-05-2022 11:14
220524-nca69acdbm 1019-05-2022 11:50
220519-nzy7lahgfl 1010-12-2021 01:57
211210-cc9h9sfaa3 10Analysis
-
max time kernel
41s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
03-06-2022 13:29
Static task
static1
Behavioral task
behavioral1
Sample
0856364e16bd3d86e02cd6b225898789.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
0856364e16bd3d86e02cd6b225898789.exe
Resource
win10v2004-20220414-en
General
-
Target
0856364e16bd3d86e02cd6b225898789.exe
-
Size
89KB
-
MD5
0856364e16bd3d86e02cd6b225898789
-
SHA1
38f2c492da0754645cda211ff124b4b25cb86e38
-
SHA256
1367ecca54ac27ce18179d6bfcc0ff93bb7cfb2882dc60c21ddf64726ba19936
-
SHA512
085b54d51bc9caceb539d7590c7bfd4511069a9c0e4f4712fcb6c5bb6fbf0abf7df734a7f0e40d668f53bfc7d7d860d81ece585aa875c809f64e31a58ab8a6e9
Malware Config
Signatures
-
Gh0st RAT payload 7 IoCs
Processes:
resource yara_rule \Program Files (x86)\Common Files\2021127134512.exe family_gh0strat \Program Files (x86)\Common Files\2021127134512.exe family_gh0strat C:\Program Files (x86)\Common Files\2021127134512.exe family_gh0strat C:\Program Files (x86)\Common Files\2021127134512.exe family_gh0strat \Program Files (x86)\Common Files\2021127134512.exe family_gh0strat \Program Files (x86)\Common Files\2021127134512.exe family_gh0strat \Program Files (x86)\Common Files\2021127134512.exe family_gh0strat -
hello 9 IoCs
hello.
Processes:
resource yara_rule behavioral1/memory/1844-54-0x0000000075261000-0x0000000075263000-memory.dmp dummy \Program Files (x86)\Common Files\2021127134512.exe dummy \Program Files (x86)\Common Files\2021127134512.exe dummy behavioral1/memory/1884-57-0x0000000000000000-mapping.dmp dummy C:\Program Files (x86)\Common Files\2021127134512.exe dummy C:\Program Files (x86)\Common Files\2021127134512.exe dummy \Program Files (x86)\Common Files\2021127134512.exe dummy \Program Files (x86)\Common Files\2021127134512.exe dummy \Program Files (x86)\Common Files\2021127134512.exe dummy -
Executes dropped EXE 1 IoCs
Processes:
2021127134512.exepid process 1884 2021127134512.exe -
Loads dropped DLL 5 IoCs
Processes:
0856364e16bd3d86e02cd6b225898789.exe2021127134512.exepid process 1844 0856364e16bd3d86e02cd6b225898789.exe 1844 0856364e16bd3d86e02cd6b225898789.exe 1884 2021127134512.exe 1884 2021127134512.exe 1884 2021127134512.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
2021127134512.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run 2021127134512.exe Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ball = "C:\\WINDOWS\\Ball.exe" 2021127134512.exe -
Drops file in System32 directory 1 IoCs
Processes:
2021127134512.exedescription ioc process File created C:\WINDOWS\SysWOW64\ctfmon.exe 2021127134512.exe -
Drops file in Program Files directory 1 IoCs
Processes:
0856364e16bd3d86e02cd6b225898789.exedescription ioc process File created C:\Program Files (x86)\Common Files\2021127134512.exe 0856364e16bd3d86e02cd6b225898789.exe -
Drops file in Windows directory 2 IoCs
Processes:
2021127134512.exedescription ioc process File created C:\WINDOWS\Ball.exe 2021127134512.exe File opened for modification C:\WINDOWS\Ball.exe 2021127134512.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
2021127134512.exepid process 1884 2021127134512.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
0856364e16bd3d86e02cd6b225898789.exedescription pid process target process PID 1844 wrote to memory of 1884 1844 0856364e16bd3d86e02cd6b225898789.exe 2021127134512.exe PID 1844 wrote to memory of 1884 1844 0856364e16bd3d86e02cd6b225898789.exe 2021127134512.exe PID 1844 wrote to memory of 1884 1844 0856364e16bd3d86e02cd6b225898789.exe 2021127134512.exe PID 1844 wrote to memory of 1884 1844 0856364e16bd3d86e02cd6b225898789.exe 2021127134512.exe PID 1844 wrote to memory of 1884 1844 0856364e16bd3d86e02cd6b225898789.exe 2021127134512.exe PID 1844 wrote to memory of 1884 1844 0856364e16bd3d86e02cd6b225898789.exe 2021127134512.exe PID 1844 wrote to memory of 1884 1844 0856364e16bd3d86e02cd6b225898789.exe 2021127134512.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0856364e16bd3d86e02cd6b225898789.exe"C:\Users\Admin\AppData\Local\Temp\0856364e16bd3d86e02cd6b225898789.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Common Files\2021127134512.exe"C:\Program Files (x86)\Common Files\2021127134512.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Common Files\2021127134512.exeFilesize
5.1MB
MD5af6f7b5960984adf1ad3ec5defb2d8a4
SHA12d8cae27a43e8e2241c53f20f89f6323d209f612
SHA256c537e80f2013565acd62603d772322d7ceaf0ebcc8cb33a3964d9423d117993f
SHA512118f388b27353070fe7e145144eb51e0157e51ebfcc4ab07ffcfd112121c5b7311014f411dfe81f7429b58f72721c15e3980ea826cfc768994f2a0eccf513c48
-
C:\Program Files (x86)\Common Files\2021127134512.exeFilesize
5.1MB
MD5af6f7b5960984adf1ad3ec5defb2d8a4
SHA12d8cae27a43e8e2241c53f20f89f6323d209f612
SHA256c537e80f2013565acd62603d772322d7ceaf0ebcc8cb33a3964d9423d117993f
SHA512118f388b27353070fe7e145144eb51e0157e51ebfcc4ab07ffcfd112121c5b7311014f411dfe81f7429b58f72721c15e3980ea826cfc768994f2a0eccf513c48
-
\Program Files (x86)\Common Files\2021127134512.exeFilesize
5.1MB
MD5af6f7b5960984adf1ad3ec5defb2d8a4
SHA12d8cae27a43e8e2241c53f20f89f6323d209f612
SHA256c537e80f2013565acd62603d772322d7ceaf0ebcc8cb33a3964d9423d117993f
SHA512118f388b27353070fe7e145144eb51e0157e51ebfcc4ab07ffcfd112121c5b7311014f411dfe81f7429b58f72721c15e3980ea826cfc768994f2a0eccf513c48
-
\Program Files (x86)\Common Files\2021127134512.exeFilesize
5.1MB
MD5af6f7b5960984adf1ad3ec5defb2d8a4
SHA12d8cae27a43e8e2241c53f20f89f6323d209f612
SHA256c537e80f2013565acd62603d772322d7ceaf0ebcc8cb33a3964d9423d117993f
SHA512118f388b27353070fe7e145144eb51e0157e51ebfcc4ab07ffcfd112121c5b7311014f411dfe81f7429b58f72721c15e3980ea826cfc768994f2a0eccf513c48
-
\Program Files (x86)\Common Files\2021127134512.exeFilesize
5.1MB
MD5af6f7b5960984adf1ad3ec5defb2d8a4
SHA12d8cae27a43e8e2241c53f20f89f6323d209f612
SHA256c537e80f2013565acd62603d772322d7ceaf0ebcc8cb33a3964d9423d117993f
SHA512118f388b27353070fe7e145144eb51e0157e51ebfcc4ab07ffcfd112121c5b7311014f411dfe81f7429b58f72721c15e3980ea826cfc768994f2a0eccf513c48
-
\Program Files (x86)\Common Files\2021127134512.exeFilesize
5.1MB
MD5af6f7b5960984adf1ad3ec5defb2d8a4
SHA12d8cae27a43e8e2241c53f20f89f6323d209f612
SHA256c537e80f2013565acd62603d772322d7ceaf0ebcc8cb33a3964d9423d117993f
SHA512118f388b27353070fe7e145144eb51e0157e51ebfcc4ab07ffcfd112121c5b7311014f411dfe81f7429b58f72721c15e3980ea826cfc768994f2a0eccf513c48
-
\Program Files (x86)\Common Files\2021127134512.exeFilesize
5.1MB
MD5af6f7b5960984adf1ad3ec5defb2d8a4
SHA12d8cae27a43e8e2241c53f20f89f6323d209f612
SHA256c537e80f2013565acd62603d772322d7ceaf0ebcc8cb33a3964d9423d117993f
SHA512118f388b27353070fe7e145144eb51e0157e51ebfcc4ab07ffcfd112121c5b7311014f411dfe81f7429b58f72721c15e3980ea826cfc768994f2a0eccf513c48
-
memory/1844-54-0x0000000075261000-0x0000000075263000-memory.dmpFilesize
8KB
-
memory/1884-57-0x0000000000000000-mapping.dmp