Analysis
-
max time kernel
167s -
max time network
171s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03-10-2022 00:30
Static task
static1
Behavioral task
behavioral1
Sample
eb71cb4f8955cb0f0f4f56605fc76c6c6b7e5f655c0f34e34c83648b20711584.exe
Resource
win7-20220812-en
General
-
Target
eb71cb4f8955cb0f0f4f56605fc76c6c6b7e5f655c0f34e34c83648b20711584.exe
-
Size
192KB
-
MD5
702395713f991c8ef6189f0c62d465f5
-
SHA1
c2a01fb4fc43fe709732bafaf334bbb98755af5a
-
SHA256
eb71cb4f8955cb0f0f4f56605fc76c6c6b7e5f655c0f34e34c83648b20711584
-
SHA512
a17d03afe1011f1b199c1428a69c6b7d5dc536dadbf2fbbaeda362dd2fc6993139aa6ab5242223416b3b682e7e29712b32b1098f3a5543fd708c6affb3a811bc
-
SSDEEP
3072:lSB23ZRnWUWXzg5KHbFxlAPHX7JC2J/IPe25L/IV8/dHb7nslSlq:lFPnWUWX05KH3lAP37JC2J/IPeiD/Rjt
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
Processes:
resource yara_rule \??\c:\progra~3\applic~1\storm\update\fyxvl.dlc family_gh0strat \ProgramData\Storm\update\fyxvl.dlc family_gh0strat -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 1076 svchost.exe -
Loads dropped DLL 1 IoCs
Processes:
svchost.exepid process 1076 svchost.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
svchost.exedescription ioc process File opened for modification \??\PhysicalDrive0 svchost.exe -
Drops file in System32 directory 2 IoCs
Processes:
svchost.exedescription ioc process File created C:\Windows\SysWOW64\cudqxqucxb svchost.exe File created C:\Windows\SysWOW64\clvinggqlc svchost.exe -
Drops file in Program Files directory 1 IoCs
Processes:
eb71cb4f8955cb0f0f4f56605fc76c6c6b7e5f655c0f34e34c83648b20711584.exedescription ioc process File opened for modification C:\PROGRA~3\APPLIC~1\Storm\update\fyxvl.dlc eb71cb4f8955cb0f0f4f56605fc76c6c6b7e5f655c0f34e34c83648b20711584.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe -
Modifies data under HKEY_USERS 5 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7" svchost.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
svchost.exepid process 1076 svchost.exe 1076 svchost.exe -
Suspicious use of AdjustPrivilegeToken 22 IoCs
Processes:
eb71cb4f8955cb0f0f4f56605fc76c6c6b7e5f655c0f34e34c83648b20711584.exesvchost.exedescription pid process Token: SeBackupPrivilege 1112 eb71cb4f8955cb0f0f4f56605fc76c6c6b7e5f655c0f34e34c83648b20711584.exe Token: SeRestorePrivilege 1112 eb71cb4f8955cb0f0f4f56605fc76c6c6b7e5f655c0f34e34c83648b20711584.exe Token: SeBackupPrivilege 1112 eb71cb4f8955cb0f0f4f56605fc76c6c6b7e5f655c0f34e34c83648b20711584.exe Token: SeRestorePrivilege 1112 eb71cb4f8955cb0f0f4f56605fc76c6c6b7e5f655c0f34e34c83648b20711584.exe Token: SeBackupPrivilege 1112 eb71cb4f8955cb0f0f4f56605fc76c6c6b7e5f655c0f34e34c83648b20711584.exe Token: SeRestorePrivilege 1112 eb71cb4f8955cb0f0f4f56605fc76c6c6b7e5f655c0f34e34c83648b20711584.exe Token: SeBackupPrivilege 1112 eb71cb4f8955cb0f0f4f56605fc76c6c6b7e5f655c0f34e34c83648b20711584.exe Token: SeRestorePrivilege 1112 eb71cb4f8955cb0f0f4f56605fc76c6c6b7e5f655c0f34e34c83648b20711584.exe Token: SeBackupPrivilege 1076 svchost.exe Token: SeRestorePrivilege 1076 svchost.exe Token: SeBackupPrivilege 1076 svchost.exe Token: SeBackupPrivilege 1076 svchost.exe Token: SeSecurityPrivilege 1076 svchost.exe Token: SeSecurityPrivilege 1076 svchost.exe Token: SeBackupPrivilege 1076 svchost.exe Token: SeBackupPrivilege 1076 svchost.exe Token: SeSecurityPrivilege 1076 svchost.exe Token: SeBackupPrivilege 1076 svchost.exe Token: SeBackupPrivilege 1076 svchost.exe Token: SeSecurityPrivilege 1076 svchost.exe Token: SeBackupPrivilege 1076 svchost.exe Token: SeRestorePrivilege 1076 svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb71cb4f8955cb0f0f4f56605fc76c6c6b7e5f655c0f34e34c83648b20711584.exe"C:\Users\Admin\AppData\Local\Temp\eb71cb4f8955cb0f0f4f56605fc76c6c6b7e5f655c0f34e34c83648b20711584.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Deletes itself
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\??\c:\progra~3\applic~1\storm\update\fyxvl.dlcFilesize
832KB
MD5d7aaa1d6ae110fcd1d2cacf03fc2b872
SHA1facd15a103e5900c2ca6659897511000b0a1df1a
SHA2568d952b7b09cb8972abebc2f050d73bbc0811517979e0fc04896cf0010034be28
SHA5126e53075a01e3fc214f0802be740ddd080977914777666665b9a81cf9db01e2731658219810788243da5e3816331c339ad5b8d9808cbc3e4db98195686c107a65
-
\ProgramData\Storm\update\fyxvl.dlcFilesize
832KB
MD5d7aaa1d6ae110fcd1d2cacf03fc2b872
SHA1facd15a103e5900c2ca6659897511000b0a1df1a
SHA2568d952b7b09cb8972abebc2f050d73bbc0811517979e0fc04896cf0010034be28
SHA5126e53075a01e3fc214f0802be740ddd080977914777666665b9a81cf9db01e2731658219810788243da5e3816331c339ad5b8d9808cbc3e4db98195686c107a65
-
memory/1076-56-0x0000000075F51000-0x0000000075F53000-memory.dmpFilesize
8KB