Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
07-07-2022 05:19
Static task
static1
Behavioral task
behavioral1
Sample
f38ceb5bccd2de5ccf73d79ec5711d40.exe
Resource
win7-20220414-en
General
-
Target
f38ceb5bccd2de5ccf73d79ec5711d40.exe
-
Size
2.1MB
-
MD5
f38ceb5bccd2de5ccf73d79ec5711d40
-
SHA1
72eb623006fad037f57831ebe2a554c3823105d9
-
SHA256
f73282bb29d6711a116656bf12a55c2e7df5eb9a95376b6d1d087309fc37bb14
-
SHA512
199be4590729211be3b144a789ba4455fdc4e23604b36f2a4989bb75a763718abcd058e075236040a8ed51158f7783c2f99f77bbbfd9796426deb3902fae851d
Malware Config
Signatures
-
Gh0st RAT payload 11 IoCs
Processes:
resource yara_rule behavioral2/memory/5024-1485-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral2/memory/5024-1484-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral2/memory/5024-1487-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral2/memory/5024-1488-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral2/memory/924-2851-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral2/memory/2280-4209-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral2/memory/2280-4413-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral2/memory/4976-6924-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral2/memory/4976-6926-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral2/memory/4976-6932-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral2/memory/4976-6936-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat -
Executes dropped EXE 4 IoCs
Processes:
Pwtqfef.exePwtqfef.exePwtqfef.exePwtqfef.exepid process 924 Pwtqfef.exe 2280 Pwtqfef.exe 4976 Pwtqfef.exe 5108 Pwtqfef.exe -
Processes:
resource yara_rule behavioral2/memory/5024-1481-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral2/memory/5024-1485-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral2/memory/5024-1484-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral2/memory/5024-1487-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral2/memory/5024-1488-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral2/memory/924-2851-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral2/memory/2280-4209-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral2/memory/2280-4413-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral2/memory/4976-6920-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral2/memory/4976-6924-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral2/memory/4976-6926-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral2/memory/4976-6932-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral2/memory/4976-6936-0x0000000010000000-0x0000000010362000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
f38ceb5bccd2de5ccf73d79ec5711d40.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation f38ceb5bccd2de5ccf73d79ec5711d40.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
Pwtqfef.exedescription ioc process File opened (read-only) \??\F: Pwtqfef.exe File opened (read-only) \??\H: Pwtqfef.exe File opened (read-only) \??\N: Pwtqfef.exe File opened (read-only) \??\P: Pwtqfef.exe File opened (read-only) \??\Q: Pwtqfef.exe File opened (read-only) \??\B: Pwtqfef.exe File opened (read-only) \??\I: Pwtqfef.exe File opened (read-only) \??\K: Pwtqfef.exe File opened (read-only) \??\T: Pwtqfef.exe File opened (read-only) \??\V: Pwtqfef.exe File opened (read-only) \??\E: Pwtqfef.exe File opened (read-only) \??\G: Pwtqfef.exe File opened (read-only) \??\J: Pwtqfef.exe File opened (read-only) \??\M: Pwtqfef.exe File opened (read-only) \??\O: Pwtqfef.exe File opened (read-only) \??\R: Pwtqfef.exe File opened (read-only) \??\S: Pwtqfef.exe File opened (read-only) \??\L: Pwtqfef.exe File opened (read-only) \??\U: Pwtqfef.exe File opened (read-only) \??\W: Pwtqfef.exe File opened (read-only) \??\X: Pwtqfef.exe File opened (read-only) \??\Y: Pwtqfef.exe File opened (read-only) \??\Z: Pwtqfef.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 31 IoCs
Processes:
f38ceb5bccd2de5ccf73d79ec5711d40.exePwtqfef.exePwtqfef.exePwtqfef.exePwtqfef.exepid process 5024 f38ceb5bccd2de5ccf73d79ec5711d40.exe 5024 f38ceb5bccd2de5ccf73d79ec5711d40.exe 924 Pwtqfef.exe 924 Pwtqfef.exe 924 Pwtqfef.exe 2280 Pwtqfef.exe 2280 Pwtqfef.exe 2280 Pwtqfef.exe 4976 Pwtqfef.exe 4976 Pwtqfef.exe 5108 Pwtqfef.exe 5108 Pwtqfef.exe 4976 Pwtqfef.exe 4976 Pwtqfef.exe 4976 Pwtqfef.exe 4976 Pwtqfef.exe 4976 Pwtqfef.exe 4976 Pwtqfef.exe 4976 Pwtqfef.exe 4976 Pwtqfef.exe 4976 Pwtqfef.exe 4976 Pwtqfef.exe 4976 Pwtqfef.exe 4976 Pwtqfef.exe 4976 Pwtqfef.exe 4976 Pwtqfef.exe 4976 Pwtqfef.exe 4976 Pwtqfef.exe 4976 Pwtqfef.exe 4976 Pwtqfef.exe 4976 Pwtqfef.exe -
Drops file in Program Files directory 2 IoCs
Processes:
f38ceb5bccd2de5ccf73d79ec5711d40.exedescription ioc process File created C:\Program Files (x86)\Pwtqfef.exe f38ceb5bccd2de5ccf73d79ec5711d40.exe File opened for modification C:\Program Files (x86)\Pwtqfef.exe f38ceb5bccd2de5ccf73d79ec5711d40.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4484 2280 WerFault.exe Pwtqfef.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
Pwtqfef.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Pwtqfef.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Pwtqfef.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 Pwtqfef.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString Pwtqfef.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 Pwtqfef.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Pwtqfef.exe -
Modifies data under HKEY_USERS 5 IoCs
Processes:
Pwtqfef.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft Pwtqfef.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie Pwtqfef.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7" Pwtqfef.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum Pwtqfef.exe Key created \REGISTRY\USER\.DEFAULT\Software Pwtqfef.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Pwtqfef.exepid process 4976 Pwtqfef.exe 4976 Pwtqfef.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
f38ceb5bccd2de5ccf73d79ec5711d40.exePwtqfef.exePwtqfef.exePwtqfef.exePwtqfef.exedescription pid process Token: SeDebugPrivilege 5024 f38ceb5bccd2de5ccf73d79ec5711d40.exe Token: SeDebugPrivilege 924 Pwtqfef.exe Token: SeDebugPrivilege 2280 Pwtqfef.exe Token: SeDebugPrivilege 2280 Pwtqfef.exe Token: SeDebugPrivilege 2280 Pwtqfef.exe Token: SeDebugPrivilege 4976 Pwtqfef.exe Token: SeDebugPrivilege 5108 Pwtqfef.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
f38ceb5bccd2de5ccf73d79ec5711d40.exePwtqfef.exedescription pid process target process PID 5024 wrote to memory of 924 5024 f38ceb5bccd2de5ccf73d79ec5711d40.exe Pwtqfef.exe PID 5024 wrote to memory of 924 5024 f38ceb5bccd2de5ccf73d79ec5711d40.exe Pwtqfef.exe PID 5024 wrote to memory of 924 5024 f38ceb5bccd2de5ccf73d79ec5711d40.exe Pwtqfef.exe PID 2280 wrote to memory of 4976 2280 Pwtqfef.exe Pwtqfef.exe PID 2280 wrote to memory of 4976 2280 Pwtqfef.exe Pwtqfef.exe PID 2280 wrote to memory of 4976 2280 Pwtqfef.exe Pwtqfef.exe PID 2280 wrote to memory of 5108 2280 Pwtqfef.exe Pwtqfef.exe PID 2280 wrote to memory of 5108 2280 Pwtqfef.exe Pwtqfef.exe PID 2280 wrote to memory of 5108 2280 Pwtqfef.exe Pwtqfef.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f38ceb5bccd2de5ccf73d79ec5711d40.exe"C:\Users\Admin\AppData\Local\Temp\f38ceb5bccd2de5ccf73d79ec5711d40.exe"1⤵
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Pwtqfef.exe"C:\Program Files (x86)\Pwtqfef.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Pwtqfef.exe"C:\Program Files (x86)\Pwtqfef.exe"1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Pwtqfef.exe"C:\Program Files (x86)\Pwtqfef.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Pwtqfef.exe"C:\Program Files (x86)\Pwtqfef.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 6602⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2280 -ip 22801⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Pwtqfef.exeFilesize
2.1MB
MD5f38ceb5bccd2de5ccf73d79ec5711d40
SHA172eb623006fad037f57831ebe2a554c3823105d9
SHA256f73282bb29d6711a116656bf12a55c2e7df5eb9a95376b6d1d087309fc37bb14
SHA512199be4590729211be3b144a789ba4455fdc4e23604b36f2a4989bb75a763718abcd058e075236040a8ed51158f7783c2f99f77bbbfd9796426deb3902fae851d
-
C:\Program Files (x86)\Pwtqfef.exeFilesize
2.1MB
MD5f38ceb5bccd2de5ccf73d79ec5711d40
SHA172eb623006fad037f57831ebe2a554c3823105d9
SHA256f73282bb29d6711a116656bf12a55c2e7df5eb9a95376b6d1d087309fc37bb14
SHA512199be4590729211be3b144a789ba4455fdc4e23604b36f2a4989bb75a763718abcd058e075236040a8ed51158f7783c2f99f77bbbfd9796426deb3902fae851d
-
C:\Program Files (x86)\Pwtqfef.exeFilesize
2.1MB
MD5f38ceb5bccd2de5ccf73d79ec5711d40
SHA172eb623006fad037f57831ebe2a554c3823105d9
SHA256f73282bb29d6711a116656bf12a55c2e7df5eb9a95376b6d1d087309fc37bb14
SHA512199be4590729211be3b144a789ba4455fdc4e23604b36f2a4989bb75a763718abcd058e075236040a8ed51158f7783c2f99f77bbbfd9796426deb3902fae851d
-
C:\Program Files (x86)\Pwtqfef.exeFilesize
2.1MB
MD5f38ceb5bccd2de5ccf73d79ec5711d40
SHA172eb623006fad037f57831ebe2a554c3823105d9
SHA256f73282bb29d6711a116656bf12a55c2e7df5eb9a95376b6d1d087309fc37bb14
SHA512199be4590729211be3b144a789ba4455fdc4e23604b36f2a4989bb75a763718abcd058e075236040a8ed51158f7783c2f99f77bbbfd9796426deb3902fae851d
-
C:\Program Files (x86)\Pwtqfef.exeFilesize
2.1MB
MD5f38ceb5bccd2de5ccf73d79ec5711d40
SHA172eb623006fad037f57831ebe2a554c3823105d9
SHA256f73282bb29d6711a116656bf12a55c2e7df5eb9a95376b6d1d087309fc37bb14
SHA512199be4590729211be3b144a789ba4455fdc4e23604b36f2a4989bb75a763718abcd058e075236040a8ed51158f7783c2f99f77bbbfd9796426deb3902fae851d
-
memory/924-2841-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/924-2850-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/924-2843-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/924-1492-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/924-2840-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/924-1498-0x0000000075C90000-0x0000000075D0A000-memory.dmpFilesize
488KB
-
memory/924-1497-0x0000000075F60000-0x0000000076100000-memory.dmpFilesize
1.6MB
-
memory/924-1495-0x0000000077070000-0x0000000077285000-memory.dmpFilesize
2.1MB
-
memory/924-1494-0x0000000077DD0000-0x0000000077F73000-memory.dmpFilesize
1.6MB
-
memory/924-2851-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/924-4210-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/924-1489-0x0000000000000000-mapping.dmp
-
memory/2280-4199-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/2280-4202-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/2280-4209-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/2280-4208-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/2280-4200-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/2280-4413-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/2280-2857-0x0000000075C90000-0x0000000075D0A000-memory.dmpFilesize
488KB
-
memory/2280-2856-0x0000000075F60000-0x0000000076100000-memory.dmpFilesize
1.6MB
-
memory/2280-2854-0x0000000077070000-0x0000000077285000-memory.dmpFilesize
2.1MB
-
memory/2280-2853-0x0000000077DD0000-0x0000000077F73000-memory.dmpFilesize
1.6MB
-
memory/2280-2852-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/4976-6910-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/4976-6913-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/4976-6915-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/4976-6920-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/4976-6924-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/4976-6926-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/4976-6929-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/4976-6932-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/4976-4215-0x0000000077DD0000-0x0000000077F73000-memory.dmpFilesize
1.6MB
-
memory/4976-6935-0x0000000075150000-0x0000000075189000-memory.dmpFilesize
228KB
-
memory/4976-6936-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/4976-4222-0x0000000075C90000-0x0000000075D0A000-memory.dmpFilesize
488KB
-
memory/4976-4211-0x0000000000000000-mapping.dmp
-
memory/4976-4221-0x0000000075F60000-0x0000000076100000-memory.dmpFilesize
1.6MB
-
memory/4976-4217-0x0000000077070000-0x0000000077285000-memory.dmpFilesize
2.1MB
-
memory/5024-131-0x0000000077DD0000-0x0000000077F73000-memory.dmpFilesize
1.6MB
-
memory/5024-1493-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/5024-1488-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/5024-1487-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/5024-1486-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/5024-132-0x0000000077070000-0x0000000077285000-memory.dmpFilesize
2.1MB
-
memory/5024-134-0x0000000075F60000-0x0000000076100000-memory.dmpFilesize
1.6MB
-
memory/5024-1480-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/5024-1484-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/5024-130-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/5024-135-0x0000000075C90000-0x0000000075D0A000-memory.dmpFilesize
488KB
-
memory/5024-1477-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/5024-1478-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/5024-1485-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/5024-1481-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/5108-4223-0x0000000075F60000-0x0000000076100000-memory.dmpFilesize
1.6MB
-
memory/5108-6919-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/5108-6917-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/5108-6916-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/5108-4227-0x0000000075C90000-0x0000000075D0A000-memory.dmpFilesize
488KB
-
memory/5108-6931-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/5108-4219-0x0000000077070000-0x0000000077285000-memory.dmpFilesize
2.1MB
-
memory/5108-6933-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/5108-6934-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/5108-4213-0x0000000000000000-mapping.dmp
-
memory/5108-4216-0x0000000077DD0000-0x0000000077F73000-memory.dmpFilesize
1.6MB
-
memory/5108-6937-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB