Analysis
-
max time kernel
152s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 16:59
Static task
static1
Behavioral task
behavioral1
Sample
669520409fd3023eba153aec3bbe336341a2dda051c3a4de94ef3a7c0069bc39.exe
Resource
win7-20220812-en
General
-
Target
669520409fd3023eba153aec3bbe336341a2dda051c3a4de94ef3a7c0069bc39.exe
-
Size
141KB
-
MD5
7be1af4218d5d4bd82fede84a3a4ade3
-
SHA1
2fd7a697203f63f2addca95ae6175ae55e3526c2
-
SHA256
669520409fd3023eba153aec3bbe336341a2dda051c3a4de94ef3a7c0069bc39
-
SHA512
4a60517621089e75f392dbe85fc15b8c5736c0434f3ee30460bd903d3d7049efb5cf1acceb5e56b5fe028c5ac268675f79619314aac0d0c3fa1ea2b55933c988
-
SSDEEP
3072:vbdO1Vt7QxB3S/ponvyjtd9DTn8f8N6dO282nA:DdGQiPb9DT8f8N6cLX
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1356-55-0x0000000010000000-0x0000000010019000-memory.dmp family_gh0strat -
Executes dropped EXE 1 IoCs
Processes:
iwuiiqm.pifpid process 1728 iwuiiqm.pif -
Deletes itself 1 IoCs
Processes:
WScript.exepid process 964 WScript.exe -
Drops file in Windows directory 2 IoCs
Processes:
669520409fd3023eba153aec3bbe336341a2dda051c3a4de94ef3a7c0069bc39.exedescription ioc process File created C:\Windows\iwuiiqm.pif 669520409fd3023eba153aec3bbe336341a2dda051c3a4de94ef3a7c0069bc39.exe File opened for modification C:\Windows\iwuiiqm.pif 669520409fd3023eba153aec3bbe336341a2dda051c3a4de94ef3a7c0069bc39.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
669520409fd3023eba153aec3bbe336341a2dda051c3a4de94ef3a7c0069bc39.exeiwuiiqm.pifpid process 1356 669520409fd3023eba153aec3bbe336341a2dda051c3a4de94ef3a7c0069bc39.exe 1728 iwuiiqm.pif -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
669520409fd3023eba153aec3bbe336341a2dda051c3a4de94ef3a7c0069bc39.exedescription pid process target process PID 1356 wrote to memory of 964 1356 669520409fd3023eba153aec3bbe336341a2dda051c3a4de94ef3a7c0069bc39.exe WScript.exe PID 1356 wrote to memory of 964 1356 669520409fd3023eba153aec3bbe336341a2dda051c3a4de94ef3a7c0069bc39.exe WScript.exe PID 1356 wrote to memory of 964 1356 669520409fd3023eba153aec3bbe336341a2dda051c3a4de94ef3a7c0069bc39.exe WScript.exe PID 1356 wrote to memory of 964 1356 669520409fd3023eba153aec3bbe336341a2dda051c3a4de94ef3a7c0069bc39.exe WScript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\669520409fd3023eba153aec3bbe336341a2dda051c3a4de94ef3a7c0069bc39.exe"C:\Users\Admin\AppData\Local\Temp\669520409fd3023eba153aec3bbe336341a2dda051c3a4de94ef3a7c0069bc39.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\5956.vbs"2⤵
- Deletes itself
PID:964
-
C:\Windows\iwuiiqm.pifC:\Windows\iwuiiqm.pif1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1728
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
500B
MD5d7b83cb4d2056535e6505a78a2426976
SHA185272f5803de27c995952121e91173b15eb6c931
SHA2569f147db95db7ee6811f5f10acd641266bacf5d437522fe5cf54763d2de099b7c
SHA512fdf9f4664b25b9734826bc171652f9c742d5c7bd9c2a9ecdc6b4351296b8cfd33ea75b50baee7e45a0c1512c2feeaaa64adf83904bdc1ad69df72b20aa7c249a
-
Filesize
141KB
MD57be1af4218d5d4bd82fede84a3a4ade3
SHA12fd7a697203f63f2addca95ae6175ae55e3526c2
SHA256669520409fd3023eba153aec3bbe336341a2dda051c3a4de94ef3a7c0069bc39
SHA5124a60517621089e75f392dbe85fc15b8c5736c0434f3ee30460bd903d3d7049efb5cf1acceb5e56b5fe028c5ac268675f79619314aac0d0c3fa1ea2b55933c988
-
Filesize
141KB
MD57be1af4218d5d4bd82fede84a3a4ade3
SHA12fd7a697203f63f2addca95ae6175ae55e3526c2
SHA256669520409fd3023eba153aec3bbe336341a2dda051c3a4de94ef3a7c0069bc39
SHA5124a60517621089e75f392dbe85fc15b8c5736c0434f3ee30460bd903d3d7049efb5cf1acceb5e56b5fe028c5ac268675f79619314aac0d0c3fa1ea2b55933c988