Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19/09/2022, 03:47
Static task
static1
Behavioral task
behavioral1
Sample
38b588f69a1017a99b5a6abae7a393f3490a56100d5212cbc772d56df81c60d9.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
38b588f69a1017a99b5a6abae7a393f3490a56100d5212cbc772d56df81c60d9.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
38b588f69a1017a99b5a6abae7a393f3490a56100d5212cbc772d56df81c60d9.exe
-
Size
150KB
-
MD5
39923ebd4a9661eabd19f7fec11725c9
-
SHA1
fca894a2e20683ed018d4967a6f2ed457fa67d51
-
SHA256
38b588f69a1017a99b5a6abae7a393f3490a56100d5212cbc772d56df81c60d9
-
SHA512
11fd7ce3c0c413375b4498c5edac725c99693c4e07a3cecc7025790859b9cd0cba6a8bf5b6bca48f892aac30922cd3d7e14386e5fc2eb0356137880648392cbe
-
SSDEEP
3072:6ldlXTPtEgUJmh+aDY+puszTjGkZHKZApg0P77mag417WHFRlyAtd6AE:6RTPtEgTh+aDyszTKkZH1pg0P7rb7Wl4
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/memory/1900-64-0x0000000000400000-0x0000000000430000-memory.dmp family_gh0strat -
Executes dropped EXE 2 IoCs
pid Process 1900 2ECF.tmp 1988 inl57C4.tmp -
Loads dropped DLL 3 IoCs
pid Process 2028 38b588f69a1017a99b5a6abae7a393f3490a56100d5212cbc772d56df81c60d9.exe 1480 cmd.exe 1480 cmd.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\loader.dll 2ECF.tmp File created C:\Program Files\Common Files\lanmao.dll 2ECF.tmp -
Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\Logs\DPX\setupact.log expand.exe File opened for modification C:\Windows\Logs\DPX\setuperr.log expand.exe File created C:\Windows\Installer\6dc034.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIE35.tmp msiexec.exe File opened for modification C:\Windows\Installer\6dc036.ipi msiexec.exe File created C:\WINDOWS\vbcfg.ini 2ECF.tmp File opened for modification C:\Windows\Installer\6dc034.msi msiexec.exe File created C:\Windows\Installer\6dc036.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\6dc038.msi msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2028 38b588f69a1017a99b5a6abae7a393f3490a56100d5212cbc772d56df81c60d9.exe 1468 msiexec.exe 1468 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1888 msiexec.exe Token: SeIncreaseQuotaPrivilege 1888 msiexec.exe Token: SeRestorePrivilege 1468 msiexec.exe Token: SeTakeOwnershipPrivilege 1468 msiexec.exe Token: SeSecurityPrivilege 1468 msiexec.exe Token: SeCreateTokenPrivilege 1888 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1888 msiexec.exe Token: SeLockMemoryPrivilege 1888 msiexec.exe Token: SeIncreaseQuotaPrivilege 1888 msiexec.exe Token: SeMachineAccountPrivilege 1888 msiexec.exe Token: SeTcbPrivilege 1888 msiexec.exe Token: SeSecurityPrivilege 1888 msiexec.exe Token: SeTakeOwnershipPrivilege 1888 msiexec.exe Token: SeLoadDriverPrivilege 1888 msiexec.exe Token: SeSystemProfilePrivilege 1888 msiexec.exe Token: SeSystemtimePrivilege 1888 msiexec.exe Token: SeProfSingleProcessPrivilege 1888 msiexec.exe Token: SeIncBasePriorityPrivilege 1888 msiexec.exe Token: SeCreatePagefilePrivilege 1888 msiexec.exe Token: SeCreatePermanentPrivilege 1888 msiexec.exe Token: SeBackupPrivilege 1888 msiexec.exe Token: SeRestorePrivilege 1888 msiexec.exe Token: SeShutdownPrivilege 1888 msiexec.exe Token: SeDebugPrivilege 1888 msiexec.exe Token: SeAuditPrivilege 1888 msiexec.exe Token: SeSystemEnvironmentPrivilege 1888 msiexec.exe Token: SeChangeNotifyPrivilege 1888 msiexec.exe Token: SeRemoteShutdownPrivilege 1888 msiexec.exe Token: SeUndockPrivilege 1888 msiexec.exe Token: SeSyncAgentPrivilege 1888 msiexec.exe Token: SeEnableDelegationPrivilege 1888 msiexec.exe Token: SeManageVolumePrivilege 1888 msiexec.exe Token: SeImpersonatePrivilege 1888 msiexec.exe Token: SeCreateGlobalPrivilege 1888 msiexec.exe Token: SeIncBasePriorityPrivilege 2028 38b588f69a1017a99b5a6abae7a393f3490a56100d5212cbc772d56df81c60d9.exe Token: SeRestorePrivilege 1468 msiexec.exe Token: SeTakeOwnershipPrivilege 1468 msiexec.exe Token: SeRestorePrivilege 1468 msiexec.exe Token: SeTakeOwnershipPrivilege 1468 msiexec.exe Token: SeRestorePrivilege 1468 msiexec.exe Token: SeTakeOwnershipPrivilege 1468 msiexec.exe Token: SeRestorePrivilege 1468 msiexec.exe Token: SeTakeOwnershipPrivilege 1468 msiexec.exe Token: SeRestorePrivilege 1468 msiexec.exe Token: SeTakeOwnershipPrivilege 1468 msiexec.exe Token: SeRestorePrivilege 1468 msiexec.exe Token: SeTakeOwnershipPrivilege 1468 msiexec.exe Token: SeRestorePrivilege 1468 msiexec.exe Token: SeTakeOwnershipPrivilege 1468 msiexec.exe Token: SeRestorePrivilege 1468 msiexec.exe Token: SeTakeOwnershipPrivilege 1468 msiexec.exe Token: SeRestorePrivilege 1468 msiexec.exe Token: SeTakeOwnershipPrivilege 1468 msiexec.exe Token: SeRestorePrivilege 1468 msiexec.exe Token: SeTakeOwnershipPrivilege 1468 msiexec.exe Token: SeRestorePrivilege 1468 msiexec.exe Token: SeTakeOwnershipPrivilege 1468 msiexec.exe Token: SeRestorePrivilege 1468 msiexec.exe Token: SeTakeOwnershipPrivilege 1468 msiexec.exe Token: SeRestorePrivilege 1468 msiexec.exe Token: SeTakeOwnershipPrivilege 1468 msiexec.exe Token: SeRestorePrivilege 1468 msiexec.exe Token: SeTakeOwnershipPrivilege 1468 msiexec.exe Token: SeRestorePrivilege 1468 msiexec.exe -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 2028 wrote to memory of 1900 2028 38b588f69a1017a99b5a6abae7a393f3490a56100d5212cbc772d56df81c60d9.exe 27 PID 2028 wrote to memory of 1900 2028 38b588f69a1017a99b5a6abae7a393f3490a56100d5212cbc772d56df81c60d9.exe 27 PID 2028 wrote to memory of 1900 2028 38b588f69a1017a99b5a6abae7a393f3490a56100d5212cbc772d56df81c60d9.exe 27 PID 2028 wrote to memory of 1900 2028 38b588f69a1017a99b5a6abae7a393f3490a56100d5212cbc772d56df81c60d9.exe 27 PID 2028 wrote to memory of 1900 2028 38b588f69a1017a99b5a6abae7a393f3490a56100d5212cbc772d56df81c60d9.exe 27 PID 2028 wrote to memory of 1900 2028 38b588f69a1017a99b5a6abae7a393f3490a56100d5212cbc772d56df81c60d9.exe 27 PID 2028 wrote to memory of 1900 2028 38b588f69a1017a99b5a6abae7a393f3490a56100d5212cbc772d56df81c60d9.exe 27 PID 2028 wrote to memory of 1888 2028 38b588f69a1017a99b5a6abae7a393f3490a56100d5212cbc772d56df81c60d9.exe 28 PID 2028 wrote to memory of 1888 2028 38b588f69a1017a99b5a6abae7a393f3490a56100d5212cbc772d56df81c60d9.exe 28 PID 2028 wrote to memory of 1888 2028 38b588f69a1017a99b5a6abae7a393f3490a56100d5212cbc772d56df81c60d9.exe 28 PID 2028 wrote to memory of 1888 2028 38b588f69a1017a99b5a6abae7a393f3490a56100d5212cbc772d56df81c60d9.exe 28 PID 2028 wrote to memory of 1888 2028 38b588f69a1017a99b5a6abae7a393f3490a56100d5212cbc772d56df81c60d9.exe 28 PID 2028 wrote to memory of 1888 2028 38b588f69a1017a99b5a6abae7a393f3490a56100d5212cbc772d56df81c60d9.exe 28 PID 2028 wrote to memory of 1888 2028 38b588f69a1017a99b5a6abae7a393f3490a56100d5212cbc772d56df81c60d9.exe 28 PID 2028 wrote to memory of 1480 2028 38b588f69a1017a99b5a6abae7a393f3490a56100d5212cbc772d56df81c60d9.exe 30 PID 2028 wrote to memory of 1480 2028 38b588f69a1017a99b5a6abae7a393f3490a56100d5212cbc772d56df81c60d9.exe 30 PID 2028 wrote to memory of 1480 2028 38b588f69a1017a99b5a6abae7a393f3490a56100d5212cbc772d56df81c60d9.exe 30 PID 2028 wrote to memory of 1480 2028 38b588f69a1017a99b5a6abae7a393f3490a56100d5212cbc772d56df81c60d9.exe 30 PID 2028 wrote to memory of 1500 2028 38b588f69a1017a99b5a6abae7a393f3490a56100d5212cbc772d56df81c60d9.exe 33 PID 2028 wrote to memory of 1500 2028 38b588f69a1017a99b5a6abae7a393f3490a56100d5212cbc772d56df81c60d9.exe 33 PID 2028 wrote to memory of 1500 2028 38b588f69a1017a99b5a6abae7a393f3490a56100d5212cbc772d56df81c60d9.exe 33 PID 2028 wrote to memory of 1500 2028 38b588f69a1017a99b5a6abae7a393f3490a56100d5212cbc772d56df81c60d9.exe 33 PID 2028 wrote to memory of 1640 2028 38b588f69a1017a99b5a6abae7a393f3490a56100d5212cbc772d56df81c60d9.exe 34 PID 2028 wrote to memory of 1640 2028 38b588f69a1017a99b5a6abae7a393f3490a56100d5212cbc772d56df81c60d9.exe 34 PID 2028 wrote to memory of 1640 2028 38b588f69a1017a99b5a6abae7a393f3490a56100d5212cbc772d56df81c60d9.exe 34 PID 2028 wrote to memory of 1640 2028 38b588f69a1017a99b5a6abae7a393f3490a56100d5212cbc772d56df81c60d9.exe 34 PID 1480 wrote to memory of 1988 1480 cmd.exe 36 PID 1480 wrote to memory of 1988 1480 cmd.exe 36 PID 1480 wrote to memory of 1988 1480 cmd.exe 36 PID 1480 wrote to memory of 1988 1480 cmd.exe 36 PID 1500 wrote to memory of 1336 1500 cmd.exe 37 PID 1500 wrote to memory of 1336 1500 cmd.exe 37 PID 1500 wrote to memory of 1336 1500 cmd.exe 37 PID 1500 wrote to memory of 1336 1500 cmd.exe 37 PID 1468 wrote to memory of 1252 1468 msiexec.exe 40 PID 1468 wrote to memory of 1252 1468 msiexec.exe 40 PID 1468 wrote to memory of 1252 1468 msiexec.exe 40 PID 1468 wrote to memory of 1252 1468 msiexec.exe 40 PID 1468 wrote to memory of 1252 1468 msiexec.exe 40 PID 1468 wrote to memory of 1252 1468 msiexec.exe 40 PID 1468 wrote to memory of 1252 1468 msiexec.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\38b588f69a1017a99b5a6abae7a393f3490a56100d5212cbc772d56df81c60d9.exe"C:\Users\Admin\AppData\Local\Temp\38b588f69a1017a99b5a6abae7a393f3490a56100d5212cbc772d56df81c60d9.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Roaming\2ECF.tmpC:\Users\Admin\AppData\Roaming\2ECF.tmp2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
PID:1900
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i C:\Users\Admin\AppData\Local\Temp\INSCFE~1.INI /quiet2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:1888
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\run_dws_file.bat" "2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\inl57C4.tmpC:\Users\Admin\AppData\Local\Temp\inl57C4.tmp cdf1912.tmp3⤵
- Executes dropped EXE
PID:1988
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp_ext_favurl_cab.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\SysWOW64\expand.exeexpand.exe "C:\Users\Admin\AppData\Local\Temp\favorites_url.cab" -F:*.* "C:\Users\Admin\Favorites"3⤵
- Drops file in Windows directory
PID:1336
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\38B588~1.EXE > nul2⤵PID:1640
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 34DFA4D4C2B185A303710E8105FC29542⤵PID:1252
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66KB
MD5ef519027472d21cd940bad6dc207dc25
SHA144a92cf4b4ab34b44d3433653461db5b44240bb5
SHA25663cf51b5de9d0c6d12e7e3b485bf30bca2b71a2fa272d70ac27ea3da4294557b
SHA512bb20a4987f819514d4a8673fb82d70ac079f4c68befcf7191082ec3b2e87feafa5b0fbe92f91bee2b75c9c9e8596cc72ae005bf24c5cb6c493ad2e089f0aebd6
-
Filesize
768B
MD5d20d9eda31a2d0300e4589df7f352370
SHA179b46d2dbb489914cfedafdbc90e62951471b48e
SHA256d7a1d6a8cf5c3fbb85cd06147a599f5274630b86b1c89721f10a60c1bbe994d8
SHA512d28c5b69325a9833776ea362445b77b231a0ec9b9b8b4a2ad37a434ee8b2b0c1903d6ade1e372f73ac8ada951e0a24076cf23d9307d27fed5927f4bf8b0d0a5e
-
Filesize
122.8MB
MD5edfa56eeaab04b0f622e3f606ceff358
SHA10108f3bd8018f34cc73d2e90d2dcfad35c27d3ce
SHA25606ce274341ce90f16e307a6a31b2e387962081873c517759e8a0466a3c899275
SHA5128613f0ca8e9b216d9edc39fb111a27f6b3de4a9d875b62bde599e27dd53d3e2d4e6943e7043793b3b05f99460dee3bb3c6e16d5a29e554757b1218fbea2fbc3c
-
Filesize
122.8MB
MD5edfa56eeaab04b0f622e3f606ceff358
SHA10108f3bd8018f34cc73d2e90d2dcfad35c27d3ce
SHA25606ce274341ce90f16e307a6a31b2e387962081873c517759e8a0466a3c899275
SHA5128613f0ca8e9b216d9edc39fb111a27f6b3de4a9d875b62bde599e27dd53d3e2d4e6943e7043793b3b05f99460dee3bb3c6e16d5a29e554757b1218fbea2fbc3c
-
Filesize
57B
MD54e182d2c610614d431095807af6ff4c2
SHA11a32aa17c58f88623a6297baeccb64ac8f10a7cf
SHA25625f9bebf3fe67c8f2bd617c051f3e38c2e3c5a60e23daad005e2eb58be353b83
SHA512fd17e93e518e2a58988470ecbfa67c0fa403f33df00f81d58487956b8f16d30d13a9bc1cca686f129e487c7c942f0adc4d9a1a48eea5563448176e3a8cd9cd22
-
Filesize
98B
MD58663de6fce9208b795dc913d1a6a3f5b
SHA1882193f208cf012eaf22eeaa4fef3b67e7c67c15
SHA2562909ea8555f2fc19097c1070a1da8fcfd6dc6886aa1d99d7e0c05e53feeb5b61
SHA5129381063e0f85e874be54ae22675393b82c6ab54b223090148e4acbeff6f22393c96c90b83d6538461b695528af01d1f1231cf5dc719f07d6168386974b490688
-
Filesize
327.1MB
MD5576f9d5bb6dcfbecb2a0aab7b035f254
SHA19a69acccfd8bd1f58d84cf1f2d5b3708a454b690
SHA256b44f0d183ef4404508af41600afdf5ef83485699187fa1192f286abfbfe3de68
SHA5121ad7fece7d941cc72f21c6f828a255698862a5ba07335fb91b63b330341e32b267a3a627bbe393fdfe8dfe3604e621c635bc7cd0c1bad1b3c332fdf7fe48335a
-
Filesize
327.1MB
MD5576f9d5bb6dcfbecb2a0aab7b035f254
SHA19a69acccfd8bd1f58d84cf1f2d5b3708a454b690
SHA256b44f0d183ef4404508af41600afdf5ef83485699187fa1192f286abfbfe3de68
SHA5121ad7fece7d941cc72f21c6f828a255698862a5ba07335fb91b63b330341e32b267a3a627bbe393fdfe8dfe3604e621c635bc7cd0c1bad1b3c332fdf7fe48335a
-
Filesize
425B
MD5da68bc3b7c3525670a04366bc55629f5
SHA115fda47ecfead7db8f7aee6ca7570138ba7f1b71
SHA25673f3605192b676c92649034768378909a19d13883a7ea6f8ba1b096c78ffadb5
SHA5126fee416affcb6a74621479697bca6f14f5429b00de3aa595abe3c60c6b2e094877b59f8783bbe7bdd567fa565d0630bb02def5603f8f0ea92fe8f2c3ac5383c0
-
Filesize
122.8MB
MD5edfa56eeaab04b0f622e3f606ceff358
SHA10108f3bd8018f34cc73d2e90d2dcfad35c27d3ce
SHA25606ce274341ce90f16e307a6a31b2e387962081873c517759e8a0466a3c899275
SHA5128613f0ca8e9b216d9edc39fb111a27f6b3de4a9d875b62bde599e27dd53d3e2d4e6943e7043793b3b05f99460dee3bb3c6e16d5a29e554757b1218fbea2fbc3c
-
Filesize
122.8MB
MD5edfa56eeaab04b0f622e3f606ceff358
SHA10108f3bd8018f34cc73d2e90d2dcfad35c27d3ce
SHA25606ce274341ce90f16e307a6a31b2e387962081873c517759e8a0466a3c899275
SHA5128613f0ca8e9b216d9edc39fb111a27f6b3de4a9d875b62bde599e27dd53d3e2d4e6943e7043793b3b05f99460dee3bb3c6e16d5a29e554757b1218fbea2fbc3c
-
Filesize
327.1MB
MD5576f9d5bb6dcfbecb2a0aab7b035f254
SHA19a69acccfd8bd1f58d84cf1f2d5b3708a454b690
SHA256b44f0d183ef4404508af41600afdf5ef83485699187fa1192f286abfbfe3de68
SHA5121ad7fece7d941cc72f21c6f828a255698862a5ba07335fb91b63b330341e32b267a3a627bbe393fdfe8dfe3604e621c635bc7cd0c1bad1b3c332fdf7fe48335a