Analysis
-
max time kernel
77s -
max time network
84s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 22:50
Static task
static1
Behavioral task
behavioral1
Sample
85f885cd31216f52b7da4d0e557d74cb72c862637e722f2fb3a0cfc034657659.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
85f885cd31216f52b7da4d0e557d74cb72c862637e722f2fb3a0cfc034657659.exe
Resource
win10v2004-20221111-en
General
-
Target
85f885cd31216f52b7da4d0e557d74cb72c862637e722f2fb3a0cfc034657659.exe
-
Size
86KB
-
MD5
61cc92227b37d2ed26bcc250a3744cbd
-
SHA1
bf0e61b28a5c8c0cfe5fffa911ce7666459ecd61
-
SHA256
85f885cd31216f52b7da4d0e557d74cb72c862637e722f2fb3a0cfc034657659
-
SHA512
61fddda621b7686beccefe6c9fcdf620474a31a83b0ecb3dd1f246192bbbd846effdaf43ebae34e9fb079c6769412d1275685fa553e10d76ae75072f4a79b4cc
-
SSDEEP
1536:yMeiCP363g2x+Drtc4Jmy2WkhDTiXRPXBToPGUdswYTrK+1:0n15PJgNWkhDTiXR5ToPGKYn
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/384-59-0x0000000010000000-0x0000000010046000-memory.dmp family_gh0strat behavioral1/memory/384-61-0x0000000010000000-0x0000000010046000-memory.dmp family_gh0strat -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
85f885cd31216f52b7da4d0e557d74cb72c862637e722f2fb3a0cfc034657659.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 85f885cd31216f52b7da4d0e557d74cb72c862637e722f2fb3a0cfc034657659.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BE8F4EBA = "C:\\Windows\\BE8F4EBA\\svchsot.exe" 85f885cd31216f52b7da4d0e557d74cb72c862637e722f2fb3a0cfc034657659.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
85f885cd31216f52b7da4d0e557d74cb72c862637e722f2fb3a0cfc034657659.exepid process 384 85f885cd31216f52b7da4d0e557d74cb72c862637e722f2fb3a0cfc034657659.exe 384 85f885cd31216f52b7da4d0e557d74cb72c862637e722f2fb3a0cfc034657659.exe 384 85f885cd31216f52b7da4d0e557d74cb72c862637e722f2fb3a0cfc034657659.exe 384 85f885cd31216f52b7da4d0e557d74cb72c862637e722f2fb3a0cfc034657659.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
85f885cd31216f52b7da4d0e557d74cb72c862637e722f2fb3a0cfc034657659.exepid process 384 85f885cd31216f52b7da4d0e557d74cb72c862637e722f2fb3a0cfc034657659.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
85f885cd31216f52b7da4d0e557d74cb72c862637e722f2fb3a0cfc034657659.exedescription pid process Token: SeDebugPrivilege 384 85f885cd31216f52b7da4d0e557d74cb72c862637e722f2fb3a0cfc034657659.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
85f885cd31216f52b7da4d0e557d74cb72c862637e722f2fb3a0cfc034657659.exenet.exedescription pid process target process PID 384 wrote to memory of 856 384 85f885cd31216f52b7da4d0e557d74cb72c862637e722f2fb3a0cfc034657659.exe net.exe PID 384 wrote to memory of 856 384 85f885cd31216f52b7da4d0e557d74cb72c862637e722f2fb3a0cfc034657659.exe net.exe PID 384 wrote to memory of 856 384 85f885cd31216f52b7da4d0e557d74cb72c862637e722f2fb3a0cfc034657659.exe net.exe PID 384 wrote to memory of 856 384 85f885cd31216f52b7da4d0e557d74cb72c862637e722f2fb3a0cfc034657659.exe net.exe PID 856 wrote to memory of 1388 856 net.exe net1.exe PID 856 wrote to memory of 1388 856 net.exe net1.exe PID 856 wrote to memory of 1388 856 net.exe net1.exe PID 856 wrote to memory of 1388 856 net.exe net1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\85f885cd31216f52b7da4d0e557d74cb72c862637e722f2fb3a0cfc034657659.exe"C:\Users\Admin\AppData\Local\Temp\85f885cd31216f52b7da4d0e557d74cb72c862637e722f2fb3a0cfc034657659.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet start "Task Scheduler"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start "Task Scheduler"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/384-54-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/384-55-0x0000000074E01000-0x0000000074E03000-memory.dmpFilesize
8KB
-
memory/384-56-0x0000000000020000-0x000000000002A000-memory.dmpFilesize
40KB
-
memory/384-57-0x0000000010000000-0x0000000010046000-memory.dmpFilesize
280KB
-
memory/384-59-0x0000000010000000-0x0000000010046000-memory.dmpFilesize
280KB
-
memory/384-61-0x0000000010000000-0x0000000010046000-memory.dmpFilesize
280KB
-
memory/384-62-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/384-63-0x0000000000020000-0x000000000002A000-memory.dmpFilesize
40KB
-
memory/856-64-0x0000000000000000-mapping.dmp
-
memory/1388-65-0x0000000000000000-mapping.dmp