Analysis
-
max time kernel
142s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
25-07-2022 00:13
Static task
static1
Behavioral task
behavioral1
Sample
cc821917e18b2d58044aeb9dee3438f99b2699b34a0bd0921020879ec38ef941.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
cc821917e18b2d58044aeb9dee3438f99b2699b34a0bd0921020879ec38ef941.exe
Resource
win10v2004-20220721-en
General
-
Target
cc821917e18b2d58044aeb9dee3438f99b2699b34a0bd0921020879ec38ef941.exe
-
Size
588KB
-
MD5
85d0730151c5baa1924309d5ea0b25a2
-
SHA1
97fd65741f9fb937dfc96fb4b22eb15f99e9fbe4
-
SHA256
cc821917e18b2d58044aeb9dee3438f99b2699b34a0bd0921020879ec38ef941
-
SHA512
14b8e28e66637ed28b4ff329037d456ee8753263fed2d3bc1840ff5cbd0d01a4d679fde75aad47a94333e2f87891d95789f9fe7e669ba0f7ec30c7062247a518
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1680-55-0x0000000010000000-0x000000001000F000-memory.dmp family_gh0strat -
Executes dropped EXE 2 IoCs
Processes:
Qskkqaq.exeQskkqaq.exepid process 1996 Qskkqaq.exe 2000 Qskkqaq.exe -
Drops file in Program Files directory 2 IoCs
Processes:
cc821917e18b2d58044aeb9dee3438f99b2699b34a0bd0921020879ec38ef941.exedescription ioc process File created C:\Program Files (x86)\Qskkqaq.exe cc821917e18b2d58044aeb9dee3438f99b2699b34a0bd0921020879ec38ef941.exe File opened for modification C:\Program Files (x86)\Qskkqaq.exe cc821917e18b2d58044aeb9dee3438f99b2699b34a0bd0921020879ec38ef941.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
cc821917e18b2d58044aeb9dee3438f99b2699b34a0bd0921020879ec38ef941.exepid process 1680 cc821917e18b2d58044aeb9dee3438f99b2699b34a0bd0921020879ec38ef941.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
cc821917e18b2d58044aeb9dee3438f99b2699b34a0bd0921020879ec38ef941.exeQskkqaq.exeQskkqaq.exepid process 1680 cc821917e18b2d58044aeb9dee3438f99b2699b34a0bd0921020879ec38ef941.exe 1996 Qskkqaq.exe 2000 Qskkqaq.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
Qskkqaq.exedescription pid process target process PID 1996 wrote to memory of 2000 1996 Qskkqaq.exe Qskkqaq.exe PID 1996 wrote to memory of 2000 1996 Qskkqaq.exe Qskkqaq.exe PID 1996 wrote to memory of 2000 1996 Qskkqaq.exe Qskkqaq.exe PID 1996 wrote to memory of 2000 1996 Qskkqaq.exe Qskkqaq.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc821917e18b2d58044aeb9dee3438f99b2699b34a0bd0921020879ec38ef941.exe"C:\Users\Admin\AppData\Local\Temp\cc821917e18b2d58044aeb9dee3438f99b2699b34a0bd0921020879ec38ef941.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:1680
-
C:\Program Files (x86)\Qskkqaq.exe"C:\Program Files (x86)\Qskkqaq.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Program Files (x86)\Qskkqaq.exe"C:\Program Files (x86)\Qskkqaq.exe" Win72⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2000
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
588KB
MD585d0730151c5baa1924309d5ea0b25a2
SHA197fd65741f9fb937dfc96fb4b22eb15f99e9fbe4
SHA256cc821917e18b2d58044aeb9dee3438f99b2699b34a0bd0921020879ec38ef941
SHA51214b8e28e66637ed28b4ff329037d456ee8753263fed2d3bc1840ff5cbd0d01a4d679fde75aad47a94333e2f87891d95789f9fe7e669ba0f7ec30c7062247a518
-
Filesize
588KB
MD585d0730151c5baa1924309d5ea0b25a2
SHA197fd65741f9fb937dfc96fb4b22eb15f99e9fbe4
SHA256cc821917e18b2d58044aeb9dee3438f99b2699b34a0bd0921020879ec38ef941
SHA51214b8e28e66637ed28b4ff329037d456ee8753263fed2d3bc1840ff5cbd0d01a4d679fde75aad47a94333e2f87891d95789f9fe7e669ba0f7ec30c7062247a518
-
Filesize
588KB
MD585d0730151c5baa1924309d5ea0b25a2
SHA197fd65741f9fb937dfc96fb4b22eb15f99e9fbe4
SHA256cc821917e18b2d58044aeb9dee3438f99b2699b34a0bd0921020879ec38ef941
SHA51214b8e28e66637ed28b4ff329037d456ee8753263fed2d3bc1840ff5cbd0d01a4d679fde75aad47a94333e2f87891d95789f9fe7e669ba0f7ec30c7062247a518