Analysis
- max time kernel
44s - max time network
141s - platform
windows7_x64 - resource
win7-20220414-en - submitted
27/06/2022, 15:01
General
- Target 0f9e62354cf5353a7adcbe67cd3bcd93.exe
- Size 156KB
- Sample220627-sdvz9sdgd3
- SHA256 46bed426035dbd31cb6736dd3f573944d0c47e3d474b02fef43b537bf2ec2e3e
Score
10/10
Malware Config
Signatures
- Gh0st RAT payload 4 IoCs
- Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
- Executes dropped EXE 1 IoCs
- Sets DLL path for service in the registry 2 TTPs 1 IoCs
- Loads dropped DLL 4 IoCs
- Drops file in System32 directory 4 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f9e62354cf5353a7adcbe67cd3bcd93.exe"C:\Users\Admin\AppData\Local\Temp\0f9e62354cf5353a7adcbe67cd3bcd93.exe"1⤵
- Sets DLL path for service in the registry
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "windowsϵͳÖ÷¶¯·ÀÓù"1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "windowsϵͳÖ÷¶¯·ÀÓù"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\windowsϵͳÖ÷¶¯·ÀÓù.exeC:\Windows\system32\windowsϵͳÖ÷¶¯·ÀÓù.exe "c:\windows\system32\7071977.jpg",MainInstall2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
ini.ini
windowsϵͳÖ÷¶¯·ÀÓù.exe
windowsϵͳÖ÷¶¯·ÀÓù.exe
7071977.jpg
7071977.jpg
7071977.jpg
7071977.jpg
windowsϵͳÖ÷¶¯·ÀÓù.exe
memory/1748-54-0x0000000075761000-0x0000000075763000-memory.dmp