Analysis

  • max time kernel
    80s
  • max time network
    183s
  • platform
    windows7_x64
  • resource
    win7-20220718-en
  • resource tags

    arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
  • submitted
    31-07-2022 04:58

General

  • Target

    aab860136a482df72beb37e9f7d5f8284fe663879588203143729c4190fec856.exe

  • Size

    32KB

  • MD5

    162f53c58e2e4f9d670446a7c7c0cfff

  • SHA1

    af737da1835e56105d29527022dafb83e4e13937

  • SHA256

    aab860136a482df72beb37e9f7d5f8284fe663879588203143729c4190fec856

  • SHA512

    7e37aab76bb83dd0f58db973add99d0c6157c80cf2a89b3b92fe951ebab7eeb7bb7ac2012a01358481c8c8d7e2b21b9d8209a700a7802751aa74d3854f19c0a5

Malware Config

Signatures

  • Gh0st RAT payload 8 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • RunningRat

    RunningRat is a remote access trojan first seen in 2018.

  • RunningRat payload 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Sets DLL path for service in the registry 2 TTPs 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 7 IoCs
  • Creates a Windows Service
  • Drops file in System32 directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 6 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 52 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aab860136a482df72beb37e9f7d5f8284fe663879588203143729c4190fec856.exe
    "C:\Users\Admin\AppData\Local\Temp\aab860136a482df72beb37e9f7d5f8284fe663879588203143729c4190fec856.exe"
    1⤵
    • Sets DLL path for service in the registry
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1996
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\Admin\AppData\Local\Temp\aab860136a482df72beb37e9f7d5f8284fe663879588203143729c4190fec856.exe"
      2⤵
      • Deletes itself
      • Suspicious use of WriteProcessMemory
      PID:1724
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 1
        3⤵
        • Runs ping.exe
        PID:1404
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k "serivces"
    1⤵
      PID:1736
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\SysWOW64\svchost.exe -k "serivces"
      1⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:984
      • C:\Windows\SysWOW64\serivces.exe
        C:\Windows\system32\serivces.exe "c:\windows\system32\7117748.dll",MainThread
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        PID:2036

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\SysWOW64\serivces.exe

      Filesize

      43KB

      MD5

      51138beea3e2c21ec44d0932c71762a8

      SHA1

      8939cf35447b22dd2c6e6f443446acc1bf986d58

      SHA256

      5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

      SHA512

      794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

    • C:\Windows\SysWOW64\serivces.exe

      Filesize

      43KB

      MD5

      51138beea3e2c21ec44d0932c71762a8

      SHA1

      8939cf35447b22dd2c6e6f443446acc1bf986d58

      SHA256

      5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

      SHA512

      794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

    • \??\c:\windows\SysWOW64\7117748.dll

      Filesize

      37KB

      MD5

      01732383f30044f6f444c6ecd95ed05d

      SHA1

      b58c949261541e7599a4e9b3f79582d877aa8fe5

      SHA256

      6cc07d2e4f2ab6c07a555d563865b060ee2a3c82cb57c13f5f56ec5c85a90255

      SHA512

      7f4254ce85ff7d77f8e019c98e975e184e286de590cfcd8d99d50fc95861da2824bd99b0f45c0a84b92a6cce4357878d287bb62cdbb06a1323b7305426b33f37

    • \Windows\SysWOW64\7117748.dll

      Filesize

      37KB

      MD5

      01732383f30044f6f444c6ecd95ed05d

      SHA1

      b58c949261541e7599a4e9b3f79582d877aa8fe5

      SHA256

      6cc07d2e4f2ab6c07a555d563865b060ee2a3c82cb57c13f5f56ec5c85a90255

      SHA512

      7f4254ce85ff7d77f8e019c98e975e184e286de590cfcd8d99d50fc95861da2824bd99b0f45c0a84b92a6cce4357878d287bb62cdbb06a1323b7305426b33f37

    • \Windows\SysWOW64\7117748.dll

      Filesize

      37KB

      MD5

      01732383f30044f6f444c6ecd95ed05d

      SHA1

      b58c949261541e7599a4e9b3f79582d877aa8fe5

      SHA256

      6cc07d2e4f2ab6c07a555d563865b060ee2a3c82cb57c13f5f56ec5c85a90255

      SHA512

      7f4254ce85ff7d77f8e019c98e975e184e286de590cfcd8d99d50fc95861da2824bd99b0f45c0a84b92a6cce4357878d287bb62cdbb06a1323b7305426b33f37

    • \Windows\SysWOW64\7117748.dll

      Filesize

      37KB

      MD5

      01732383f30044f6f444c6ecd95ed05d

      SHA1

      b58c949261541e7599a4e9b3f79582d877aa8fe5

      SHA256

      6cc07d2e4f2ab6c07a555d563865b060ee2a3c82cb57c13f5f56ec5c85a90255

      SHA512

      7f4254ce85ff7d77f8e019c98e975e184e286de590cfcd8d99d50fc95861da2824bd99b0f45c0a84b92a6cce4357878d287bb62cdbb06a1323b7305426b33f37

    • \Windows\SysWOW64\7117748.dll

      Filesize

      37KB

      MD5

      01732383f30044f6f444c6ecd95ed05d

      SHA1

      b58c949261541e7599a4e9b3f79582d877aa8fe5

      SHA256

      6cc07d2e4f2ab6c07a555d563865b060ee2a3c82cb57c13f5f56ec5c85a90255

      SHA512

      7f4254ce85ff7d77f8e019c98e975e184e286de590cfcd8d99d50fc95861da2824bd99b0f45c0a84b92a6cce4357878d287bb62cdbb06a1323b7305426b33f37

    • \Windows\SysWOW64\7117748.dll

      Filesize

      37KB

      MD5

      01732383f30044f6f444c6ecd95ed05d

      SHA1

      b58c949261541e7599a4e9b3f79582d877aa8fe5

      SHA256

      6cc07d2e4f2ab6c07a555d563865b060ee2a3c82cb57c13f5f56ec5c85a90255

      SHA512

      7f4254ce85ff7d77f8e019c98e975e184e286de590cfcd8d99d50fc95861da2824bd99b0f45c0a84b92a6cce4357878d287bb62cdbb06a1323b7305426b33f37

    • \Windows\SysWOW64\7117748.dll

      Filesize

      37KB

      MD5

      01732383f30044f6f444c6ecd95ed05d

      SHA1

      b58c949261541e7599a4e9b3f79582d877aa8fe5

      SHA256

      6cc07d2e4f2ab6c07a555d563865b060ee2a3c82cb57c13f5f56ec5c85a90255

      SHA512

      7f4254ce85ff7d77f8e019c98e975e184e286de590cfcd8d99d50fc95861da2824bd99b0f45c0a84b92a6cce4357878d287bb62cdbb06a1323b7305426b33f37

    • \Windows\SysWOW64\serivces.exe

      Filesize

      43KB

      MD5

      51138beea3e2c21ec44d0932c71762a8

      SHA1

      8939cf35447b22dd2c6e6f443446acc1bf986d58

      SHA256

      5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

      SHA512

      794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

    • memory/1404-61-0x0000000000000000-mapping.dmp

    • memory/1724-59-0x0000000000000000-mapping.dmp

    • memory/1996-60-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB

    • memory/1996-54-0x0000000075BF1000-0x0000000075BF3000-memory.dmp

      Filesize

      8KB

    • memory/1996-55-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB

    • memory/2036-63-0x0000000000000000-mapping.dmp