Analysis

  • max time kernel
    185s
  • max time network
    195s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220721-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-07-2022 04:58

General

  • Target

    aab860136a482df72beb37e9f7d5f8284fe663879588203143729c4190fec856.exe

  • Size

    32KB

  • MD5

    162f53c58e2e4f9d670446a7c7c0cfff

  • SHA1

    af737da1835e56105d29527022dafb83e4e13937

  • SHA256

    aab860136a482df72beb37e9f7d5f8284fe663879588203143729c4190fec856

  • SHA512

    7e37aab76bb83dd0f58db973add99d0c6157c80cf2a89b3b92fe951ebab7eeb7bb7ac2012a01358481c8c8d7e2b21b9d8209a700a7802751aa74d3854f19c0a5

Malware Config

Signatures

  • Gh0st RAT payload 5 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • RunningRat

    RunningRat is a remote access trojan first seen in 2018.

  • Executes dropped EXE 1 IoCs
  • Sets DLL path for service in the registry 2 TTPs 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 3 IoCs
  • Creates a Windows Service
  • Drops file in System32 directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 5 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aab860136a482df72beb37e9f7d5f8284fe663879588203143729c4190fec856.exe
    "C:\Users\Admin\AppData\Local\Temp\aab860136a482df72beb37e9f7d5f8284fe663879588203143729c4190fec856.exe"
    1⤵
    • Sets DLL path for service in the registry
    • Checks computer location settings
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4356
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\Admin\AppData\Local\Temp\aab860136a482df72beb37e9f7d5f8284fe663879588203143729c4190fec856.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2744
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 1
        3⤵
        • Runs ping.exe
        PID:3444
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k "serivces"
    1⤵
      PID:3572
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\SysWOW64\svchost.exe -k "serivces"
      1⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:2388
      • C:\Windows\SysWOW64\serivces.exe
        C:\Windows\system32\serivces.exe "c:\windows\system32\240587578.dll",MainThread
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        PID:2088

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\SysWOW64\240587578.dll

      Filesize

      37KB

      MD5

      01732383f30044f6f444c6ecd95ed05d

      SHA1

      b58c949261541e7599a4e9b3f79582d877aa8fe5

      SHA256

      6cc07d2e4f2ab6c07a555d563865b060ee2a3c82cb57c13f5f56ec5c85a90255

      SHA512

      7f4254ce85ff7d77f8e019c98e975e184e286de590cfcd8d99d50fc95861da2824bd99b0f45c0a84b92a6cce4357878d287bb62cdbb06a1323b7305426b33f37

    • C:\Windows\SysWOW64\240587578.dll

      Filesize

      37KB

      MD5

      01732383f30044f6f444c6ecd95ed05d

      SHA1

      b58c949261541e7599a4e9b3f79582d877aa8fe5

      SHA256

      6cc07d2e4f2ab6c07a555d563865b060ee2a3c82cb57c13f5f56ec5c85a90255

      SHA512

      7f4254ce85ff7d77f8e019c98e975e184e286de590cfcd8d99d50fc95861da2824bd99b0f45c0a84b92a6cce4357878d287bb62cdbb06a1323b7305426b33f37

    • C:\Windows\SysWOW64\240587578.dll

      Filesize

      37KB

      MD5

      01732383f30044f6f444c6ecd95ed05d

      SHA1

      b58c949261541e7599a4e9b3f79582d877aa8fe5

      SHA256

      6cc07d2e4f2ab6c07a555d563865b060ee2a3c82cb57c13f5f56ec5c85a90255

      SHA512

      7f4254ce85ff7d77f8e019c98e975e184e286de590cfcd8d99d50fc95861da2824bd99b0f45c0a84b92a6cce4357878d287bb62cdbb06a1323b7305426b33f37

    • C:\Windows\SysWOW64\serivces.exe

      Filesize

      60KB

      MD5

      889b99c52a60dd49227c5e485a016679

      SHA1

      8fa889e456aa646a4d0a4349977430ce5fa5e2d7

      SHA256

      6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910

      SHA512

      08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641

    • C:\Windows\SysWOW64\serivces.exe

      Filesize

      60KB

      MD5

      889b99c52a60dd49227c5e485a016679

      SHA1

      8fa889e456aa646a4d0a4349977430ce5fa5e2d7

      SHA256

      6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910

      SHA512

      08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641

    • \??\c:\windows\SysWOW64\240587578.dll

      Filesize

      37KB

      MD5

      01732383f30044f6f444c6ecd95ed05d

      SHA1

      b58c949261541e7599a4e9b3f79582d877aa8fe5

      SHA256

      6cc07d2e4f2ab6c07a555d563865b060ee2a3c82cb57c13f5f56ec5c85a90255

      SHA512

      7f4254ce85ff7d77f8e019c98e975e184e286de590cfcd8d99d50fc95861da2824bd99b0f45c0a84b92a6cce4357878d287bb62cdbb06a1323b7305426b33f37

    • memory/2088-137-0x0000000000000000-mapping.dmp

    • memory/2744-134-0x0000000000000000-mapping.dmp

    • memory/3444-136-0x0000000000000000-mapping.dmp

    • memory/4356-130-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB

    • memory/4356-135-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB