Analysis
-
max time kernel
102s -
max time network
116s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
17-08-2022 06:06
Behavioral task
behavioral1
Sample
b1a54aa41872cf32808a7f8453edad44.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b1a54aa41872cf32808a7f8453edad44.exe
Resource
win10v2004-20220812-en
General
-
Target
b1a54aa41872cf32808a7f8453edad44.exe
-
Size
112KB
-
MD5
b1a54aa41872cf32808a7f8453edad44
-
SHA1
b039946b52f84142cf2addab8181564abb5f6550
-
SHA256
2c7de522a0b7230acc514fecdfeaf05e9578fded236ad1337551fd42d4ac7c49
-
SHA512
923760294a8a8bd4b274bf64181c98d6b8ce01930280b1e8d1721c66c3cf63d6d3423fe28025c172264b6f1ba38406e49a8830e17d759a26eaf94783b9d4adae
Malware Config
Signatures
-
Gh0st RAT payload 7 IoCs
Processes:
resource yara_rule \Windows\Fonts\7085924.dll family_gh0strat \Windows\Fonts\7085924.dll family_gh0strat \??\c:\windows\fonts\7085924.dll family_gh0strat \Windows\Fonts\7085924.dll family_gh0strat \Windows\Fonts\7085924.dll family_gh0strat \Windows\Fonts\7085924.dll family_gh0strat \Windows\Fonts\7085924.dll family_gh0strat -
Executes dropped EXE 1 IoCs
Processes:
serivces.exepid process 2032 serivces.exe -
Sets DLL path for service in the registry 2 TTPs 1 IoCs
Processes:
b1a54aa41872cf32808a7f8453edad44.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\serivces\Parameters\ServiceDll = "C:\\Windows\\fonts\\7085924.dll" b1a54aa41872cf32808a7f8453edad44.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1332 cmd.exe -
Loads dropped DLL 7 IoCs
Processes:
b1a54aa41872cf32808a7f8453edad44.exesvchost.exeserivces.exepid process 1676 b1a54aa41872cf32808a7f8453edad44.exe 908 svchost.exe 908 svchost.exe 2032 serivces.exe 2032 serivces.exe 2032 serivces.exe 2032 serivces.exe -
Creates a Windows Service
-
Drops file in System32 directory 2 IoCs
Processes:
svchost.exedescription ioc process File created C:\Windows\SysWOW64\serivces.exe svchost.exe File opened for modification C:\Windows\SysWOW64\serivces.exe svchost.exe -
Drops file in Windows directory 1 IoCs
Processes:
b1a54aa41872cf32808a7f8453edad44.exedescription ioc process File created C:\Windows\fonts\7085924.dll b1a54aa41872cf32808a7f8453edad44.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
b1a54aa41872cf32808a7f8453edad44.exepid process 1676 b1a54aa41872cf32808a7f8453edad44.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
b1a54aa41872cf32808a7f8453edad44.exedescription pid process Token: SeIncBasePriorityPrivilege 1676 b1a54aa41872cf32808a7f8453edad44.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
b1a54aa41872cf32808a7f8453edad44.exepid process 1676 b1a54aa41872cf32808a7f8453edad44.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
b1a54aa41872cf32808a7f8453edad44.execmd.exesvchost.exedescription pid process target process PID 1676 wrote to memory of 1332 1676 b1a54aa41872cf32808a7f8453edad44.exe cmd.exe PID 1676 wrote to memory of 1332 1676 b1a54aa41872cf32808a7f8453edad44.exe cmd.exe PID 1676 wrote to memory of 1332 1676 b1a54aa41872cf32808a7f8453edad44.exe cmd.exe PID 1676 wrote to memory of 1332 1676 b1a54aa41872cf32808a7f8453edad44.exe cmd.exe PID 1332 wrote to memory of 1132 1332 cmd.exe PING.EXE PID 1332 wrote to memory of 1132 1332 cmd.exe PING.EXE PID 1332 wrote to memory of 1132 1332 cmd.exe PING.EXE PID 1332 wrote to memory of 1132 1332 cmd.exe PING.EXE PID 908 wrote to memory of 2032 908 svchost.exe serivces.exe PID 908 wrote to memory of 2032 908 svchost.exe serivces.exe PID 908 wrote to memory of 2032 908 svchost.exe serivces.exe PID 908 wrote to memory of 2032 908 svchost.exe serivces.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b1a54aa41872cf32808a7f8453edad44.exe"C:\Users\Admin\AppData\Local\Temp\b1a54aa41872cf32808a7f8453edad44.exe"1⤵
- Sets DLL path for service in the registry
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\Admin\AppData\Local\Temp\b1a54aa41872cf32808a7f8453edad44.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 13⤵
- Runs ping.exe
PID:1132
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "serivces"1⤵PID:2004
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "serivces"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Windows\SysWOW64\serivces.exeC:\Windows\system32\serivces.exe "c:\windows\fonts\7085924.dll",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2032
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43KB
MD551138beea3e2c21ec44d0932c71762a8
SHA18939cf35447b22dd2c6e6f443446acc1bf986d58
SHA2565ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d
-
Filesize
43KB
MD551138beea3e2c21ec44d0932c71762a8
SHA18939cf35447b22dd2c6e6f443446acc1bf986d58
SHA2565ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d
-
Filesize
37KB
MD5bea37c754138109355b34f1ebc6defc5
SHA13efd45599dd8b2cb8034453a63d2c919eeded3e6
SHA25608c5a2bcfce6d00aebd9e3c41210e935a7fdc2bb6237fc53eb06c99edf0ac292
SHA512683aafeda26d3df844aaf1e74e4621f27f80ccf6a1b21865b78a134cde92119613a81ec774f184fc53fc387de097a07ff257ab91dadda5874d70ea84dfa2b64d
-
Filesize
37KB
MD5bea37c754138109355b34f1ebc6defc5
SHA13efd45599dd8b2cb8034453a63d2c919eeded3e6
SHA25608c5a2bcfce6d00aebd9e3c41210e935a7fdc2bb6237fc53eb06c99edf0ac292
SHA512683aafeda26d3df844aaf1e74e4621f27f80ccf6a1b21865b78a134cde92119613a81ec774f184fc53fc387de097a07ff257ab91dadda5874d70ea84dfa2b64d
-
Filesize
37KB
MD5bea37c754138109355b34f1ebc6defc5
SHA13efd45599dd8b2cb8034453a63d2c919eeded3e6
SHA25608c5a2bcfce6d00aebd9e3c41210e935a7fdc2bb6237fc53eb06c99edf0ac292
SHA512683aafeda26d3df844aaf1e74e4621f27f80ccf6a1b21865b78a134cde92119613a81ec774f184fc53fc387de097a07ff257ab91dadda5874d70ea84dfa2b64d
-
Filesize
37KB
MD5bea37c754138109355b34f1ebc6defc5
SHA13efd45599dd8b2cb8034453a63d2c919eeded3e6
SHA25608c5a2bcfce6d00aebd9e3c41210e935a7fdc2bb6237fc53eb06c99edf0ac292
SHA512683aafeda26d3df844aaf1e74e4621f27f80ccf6a1b21865b78a134cde92119613a81ec774f184fc53fc387de097a07ff257ab91dadda5874d70ea84dfa2b64d
-
Filesize
37KB
MD5bea37c754138109355b34f1ebc6defc5
SHA13efd45599dd8b2cb8034453a63d2c919eeded3e6
SHA25608c5a2bcfce6d00aebd9e3c41210e935a7fdc2bb6237fc53eb06c99edf0ac292
SHA512683aafeda26d3df844aaf1e74e4621f27f80ccf6a1b21865b78a134cde92119613a81ec774f184fc53fc387de097a07ff257ab91dadda5874d70ea84dfa2b64d
-
Filesize
37KB
MD5bea37c754138109355b34f1ebc6defc5
SHA13efd45599dd8b2cb8034453a63d2c919eeded3e6
SHA25608c5a2bcfce6d00aebd9e3c41210e935a7fdc2bb6237fc53eb06c99edf0ac292
SHA512683aafeda26d3df844aaf1e74e4621f27f80ccf6a1b21865b78a134cde92119613a81ec774f184fc53fc387de097a07ff257ab91dadda5874d70ea84dfa2b64d
-
Filesize
37KB
MD5bea37c754138109355b34f1ebc6defc5
SHA13efd45599dd8b2cb8034453a63d2c919eeded3e6
SHA25608c5a2bcfce6d00aebd9e3c41210e935a7fdc2bb6237fc53eb06c99edf0ac292
SHA512683aafeda26d3df844aaf1e74e4621f27f80ccf6a1b21865b78a134cde92119613a81ec774f184fc53fc387de097a07ff257ab91dadda5874d70ea84dfa2b64d
-
Filesize
43KB
MD551138beea3e2c21ec44d0932c71762a8
SHA18939cf35447b22dd2c6e6f443446acc1bf986d58
SHA2565ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d