Analysis
-
max time kernel
151s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 13:07
Static task
static1
Behavioral task
behavioral1
Sample
c9aa1f210b950b6f80307e2ae721aad064f268867918e5349ef8eb445291bcf5.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c9aa1f210b950b6f80307e2ae721aad064f268867918e5349ef8eb445291bcf5.exe
Resource
win10v2004-20220812-en
General
-
Target
c9aa1f210b950b6f80307e2ae721aad064f268867918e5349ef8eb445291bcf5.exe
-
Size
47KB
-
MD5
3da64e8399ac8cecda1a640205b46d64
-
SHA1
377f125b7611e1faded71161917d6bf4e3d74159
-
SHA256
c9aa1f210b950b6f80307e2ae721aad064f268867918e5349ef8eb445291bcf5
-
SHA512
a75aa3dac5b805689a402749bc6542145adc339c701cd7570745ba398fd5ce06ed7bd750b95aa763f1e2bfff404872695fbb19e8dac95a37cf3a21385018267e
-
SSDEEP
768:ADrYMB++TPVxPqwUrNLi0Tixor7TFKWRrJY+tvXeS2OowIuGGxKX0h42nhcW:ADLB+mVxMrY0Tix24WZJYavXeSewrQCd
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1456-140-0x0000000010000000-0x000000001001A000-memory.dmp family_gh0strat -
Sets DLL path for service in the registry 2 TTPs 1 IoCs
Processes:
c9aa1f210b950b6f80307e2ae721aad064f268867918e5349ef8eb445291bcf5.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\nt0drv\Parameters\ServiceDll = "C:\\Windows\\System32\\\\Rundll64.dll" c9aa1f210b950b6f80307e2ae721aad064f268867918e5349ef8eb445291bcf5.exe -
Processes:
resource yara_rule \??\c:\windows\SysWOW64\rundll64.dll upx C:\Windows\SysWOW64\Rundll64.dll upx behavioral2/memory/1456-139-0x0000000010000000-0x000000001001A000-memory.dmp upx behavioral2/memory/1456-140-0x0000000010000000-0x000000001001A000-memory.dmp upx -
Loads dropped DLL 1 IoCs
Processes:
svchost.exepid process 1456 svchost.exe -
Drops file in System32 directory 1 IoCs
Processes:
c9aa1f210b950b6f80307e2ae721aad064f268867918e5349ef8eb445291bcf5.exedescription ioc process File created C:\Windows\SysWOW64\Rundll64.dll c9aa1f210b950b6f80307e2ae721aad064f268867918e5349ef8eb445291bcf5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c9aa1f210b950b6f80307e2ae721aad064f268867918e5349ef8eb445291bcf5.exe"C:\Users\Admin\AppData\Local\Temp\c9aa1f210b950b6f80307e2ae721aad064f268867918e5349ef8eb445291bcf5.exe"1⤵
- Sets DLL path for service in the registry
- Drops file in System32 directory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\Rundll64.dllFilesize
34KB
MD57816e672ea553340ba9fe9fd51e5b94d
SHA1c3d71f8108ae81e6bb200b6fa19ec7548e69b9a9
SHA256b359f658581eb4b036fc0cb2b3dd96bb46b5c2873183cef69207723b0a692c7e
SHA512ef61ae487df4f25bffa7f4d03fc97c6bed7229b830c3292dbac62176282896969d3485bdfd108ec831cb4b3c46253cde6a8d6af3d44b8cbc7cf785a69f88e8e2
-
\??\c:\windows\SysWOW64\rundll64.dllFilesize
34KB
MD57816e672ea553340ba9fe9fd51e5b94d
SHA1c3d71f8108ae81e6bb200b6fa19ec7548e69b9a9
SHA256b359f658581eb4b036fc0cb2b3dd96bb46b5c2873183cef69207723b0a692c7e
SHA512ef61ae487df4f25bffa7f4d03fc97c6bed7229b830c3292dbac62176282896969d3485bdfd108ec831cb4b3c46253cde6a8d6af3d44b8cbc7cf785a69f88e8e2
-
memory/1456-139-0x0000000010000000-0x000000001001A000-memory.dmpFilesize
104KB
-
memory/1456-140-0x0000000010000000-0x000000001001A000-memory.dmpFilesize
104KB
-
memory/1556-132-0x0000000000400000-0x000000000041E27A-memory.dmpFilesize
120KB
-
memory/1556-133-0x0000000000400000-0x000000000041E27A-memory.dmpFilesize
120KB
-
memory/1556-134-0x0000000000400000-0x000000000041E27A-memory.dmpFilesize
120KB
-
memory/1556-135-0x0000000002380000-0x0000000002392000-memory.dmpFilesize
72KB
-
memory/1556-138-0x0000000000400000-0x000000000041E27A-memory.dmpFilesize
120KB