Analysis
-
max time kernel
149s -
max time network
174s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
25-07-2022 00:13
Static task
static1
Behavioral task
behavioral1
Sample
c2e6877234c2edd75a5d8525adf13c8712a3f29c86adad2bc579c6b1749c8002.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
c2e6877234c2edd75a5d8525adf13c8712a3f29c86adad2bc579c6b1749c8002.exe
Resource
win10v2004-20220721-en
General
-
Target
c2e6877234c2edd75a5d8525adf13c8712a3f29c86adad2bc579c6b1749c8002.exe
-
Size
588KB
-
MD5
4f542cd3e26d790abc538347a79b6f6e
-
SHA1
e8dbe80515f81a24d2cebe637af05b30251d4db4
-
SHA256
c2e6877234c2edd75a5d8525adf13c8712a3f29c86adad2bc579c6b1749c8002
-
SHA512
01c91dacec7b0892839ccf2f2d5ea3b7b42464c3124c6bad4b6677cb87c01b71789aee0cb6ce80a22c30e3ade3a09c4e8dd7f9e1d07cb59a997112d31c8adf06
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1688-55-0x0000000010000000-0x000000001000F000-memory.dmp family_gh0strat -
Executes dropped EXE 2 IoCs
Processes:
Qskkqaq.exeQskkqaq.exepid process 1732 Qskkqaq.exe 1752 Qskkqaq.exe -
Drops file in Program Files directory 2 IoCs
Processes:
c2e6877234c2edd75a5d8525adf13c8712a3f29c86adad2bc579c6b1749c8002.exedescription ioc process File created C:\Program Files (x86)\Qskkqaq.exe c2e6877234c2edd75a5d8525adf13c8712a3f29c86adad2bc579c6b1749c8002.exe File opened for modification C:\Program Files (x86)\Qskkqaq.exe c2e6877234c2edd75a5d8525adf13c8712a3f29c86adad2bc579c6b1749c8002.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
c2e6877234c2edd75a5d8525adf13c8712a3f29c86adad2bc579c6b1749c8002.exepid process 1688 c2e6877234c2edd75a5d8525adf13c8712a3f29c86adad2bc579c6b1749c8002.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
c2e6877234c2edd75a5d8525adf13c8712a3f29c86adad2bc579c6b1749c8002.exeQskkqaq.exeQskkqaq.exepid process 1688 c2e6877234c2edd75a5d8525adf13c8712a3f29c86adad2bc579c6b1749c8002.exe 1732 Qskkqaq.exe 1752 Qskkqaq.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
Qskkqaq.exedescription pid process target process PID 1732 wrote to memory of 1752 1732 Qskkqaq.exe Qskkqaq.exe PID 1732 wrote to memory of 1752 1732 Qskkqaq.exe Qskkqaq.exe PID 1732 wrote to memory of 1752 1732 Qskkqaq.exe Qskkqaq.exe PID 1732 wrote to memory of 1752 1732 Qskkqaq.exe Qskkqaq.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2e6877234c2edd75a5d8525adf13c8712a3f29c86adad2bc579c6b1749c8002.exe"C:\Users\Admin\AppData\Local\Temp\c2e6877234c2edd75a5d8525adf13c8712a3f29c86adad2bc579c6b1749c8002.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:1688
-
C:\Program Files (x86)\Qskkqaq.exe"C:\Program Files (x86)\Qskkqaq.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Program Files (x86)\Qskkqaq.exe"C:\Program Files (x86)\Qskkqaq.exe" Win72⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1752
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
588KB
MD54f542cd3e26d790abc538347a79b6f6e
SHA1e8dbe80515f81a24d2cebe637af05b30251d4db4
SHA256c2e6877234c2edd75a5d8525adf13c8712a3f29c86adad2bc579c6b1749c8002
SHA51201c91dacec7b0892839ccf2f2d5ea3b7b42464c3124c6bad4b6677cb87c01b71789aee0cb6ce80a22c30e3ade3a09c4e8dd7f9e1d07cb59a997112d31c8adf06
-
Filesize
588KB
MD54f542cd3e26d790abc538347a79b6f6e
SHA1e8dbe80515f81a24d2cebe637af05b30251d4db4
SHA256c2e6877234c2edd75a5d8525adf13c8712a3f29c86adad2bc579c6b1749c8002
SHA51201c91dacec7b0892839ccf2f2d5ea3b7b42464c3124c6bad4b6677cb87c01b71789aee0cb6ce80a22c30e3ade3a09c4e8dd7f9e1d07cb59a997112d31c8adf06
-
Filesize
588KB
MD54f542cd3e26d790abc538347a79b6f6e
SHA1e8dbe80515f81a24d2cebe637af05b30251d4db4
SHA256c2e6877234c2edd75a5d8525adf13c8712a3f29c86adad2bc579c6b1749c8002
SHA51201c91dacec7b0892839ccf2f2d5ea3b7b42464c3124c6bad4b6677cb87c01b71789aee0cb6ce80a22c30e3ade3a09c4e8dd7f9e1d07cb59a997112d31c8adf06