Analysis

  • max time kernel
    136s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    27/11/2022, 21:52

General

  • Target

    9b2b6247120ce84a41583b731b3403ab4ef08cb9617ea42862e678f3d8bd918a.exe

  • Size

    381KB

  • MD5

    a1b285b63059ceff8e321204d74108fe

  • SHA1

    ec6a41015e5f867a72b87e507cf15e4536bde9b5

  • SHA256

    9b2b6247120ce84a41583b731b3403ab4ef08cb9617ea42862e678f3d8bd918a

  • SHA512

    2eda9dbd8ba42d34e6c69f86e26746de01608e66e4f1e9cd61d512f8a70b234d502c3e06a93afc30a875e7f811160f95fe71647929cb7d964dbacb51cea03ae4

  • SSDEEP

    6144:sQWCHwoQsITVYqmG3ZdPSumGermxwcmHi3ETJVYlDebGQuS:sQ5Hwo8TDhJdPSumGKBXuYGK

Malware Config

Signatures

  • Gh0st RAT payload 2 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 2 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 23 IoCs
  • Suspicious use of AdjustPrivilegeToken 21 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9b2b6247120ce84a41583b731b3403ab4ef08cb9617ea42862e678f3d8bd918a.exe
    "C:\Users\Admin\AppData\Local\Temp\9b2b6247120ce84a41583b731b3403ab4ef08cb9617ea42862e678f3d8bd918a.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:956
    • C:\Users\Admin\AppData\Local\Temp\9b2b6247120ce84a41583b731b3403ab4ef08cb9617ea42862e678f3d8bd918aSrv.exe
      C:\Users\Admin\AppData\Local\Temp\9b2b6247120ce84a41583b731b3403ab4ef08cb9617ea42862e678f3d8bd918aSrv.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious use of AdjustPrivilegeToken
      PID:900
  • C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    1⤵
      PID:1628
    • \\?\C:\Windows\system32\wbem\WMIADAP.EXE
      wmiadap.exe /F /T /R
      1⤵
        PID:1840
      • C:\Windows\system32\sppsvc.exe
        C:\Windows\system32\sppsvc.exe
        1⤵
          PID:1764
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
          1⤵
            PID:1640
          • C:\Windows\Explorer.EXE
            C:\Windows\Explorer.EXE
            1⤵
              PID:1212
            • C:\Windows\system32\Dwm.exe
              "C:\Windows\system32\Dwm.exe"
              1⤵
                PID:1180
              • C:\Windows\system32\taskhost.exe
                "taskhost.exe"
                1⤵
                  PID:1128
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
                  1⤵
                    PID:1068
                  • C:\Windows\System32\spoolsv.exe
                    C:\Windows\System32\spoolsv.exe
                    1⤵
                      PID:656
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k NetworkService
                      1⤵
                        PID:296
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k netsvcs
                        1⤵
                          PID:872
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalService
                          1⤵
                            PID:848
                          • C:\Windows\System32\svchost.exe
                            C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
                            1⤵
                              PID:808
                            • C:\Windows\System32\svchost.exe
                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
                              1⤵
                                PID:748
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k RPCSS
                                1⤵
                                  PID:672
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k DcomLaunch
                                  1⤵
                                    PID:596
                                  • C:\Windows\system32\lsm.exe
                                    C:\Windows\system32\lsm.exe
                                    1⤵
                                      PID:484
                                    • C:\Windows\system32\lsass.exe
                                      C:\Windows\system32\lsass.exe
                                      1⤵
                                        PID:476
                                      • C:\Windows\system32\services.exe
                                        C:\Windows\system32\services.exe
                                        1⤵
                                          PID:460
                                        • C:\Windows\system32\winlogon.exe
                                          winlogon.exe
                                          1⤵
                                            PID:416
                                          • C:\Windows\system32\wininit.exe
                                            wininit.exe
                                            1⤵
                                              PID:376
                                            • C:\Windows\system32\csrss.exe
                                              %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
                                              1⤵
                                                PID:368

                                              Network

                                              MITRE ATT&CK Matrix

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              • C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\9B2B6247120CE84A41583B731B3403AB4EF08CB9617EA42862E678F3D8BD918ASRV.EXE

                                                Filesize

                                                55KB

                                                MD5

                                                ff5e1f27193ce51eec318714ef038bef

                                                SHA1

                                                b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

                                                SHA256

                                                fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

                                                SHA512

                                                c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

                                              • C:\Users\Admin\AppData\Local\Temp\9b2b6247120ce84a41583b731b3403ab4ef08cb9617ea42862e678f3d8bd918aSrv.exe

                                                Filesize

                                                55KB

                                                MD5

                                                ff5e1f27193ce51eec318714ef038bef

                                                SHA1

                                                b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

                                                SHA256

                                                fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

                                                SHA512

                                                c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

                                              • \Users\Admin\AppData\Local\Temp\9b2b6247120ce84a41583b731b3403ab4ef08cb9617ea42862e678f3d8bd918aSrv.exe

                                                Filesize

                                                55KB

                                                MD5

                                                ff5e1f27193ce51eec318714ef038bef

                                                SHA1

                                                b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

                                                SHA256

                                                fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

                                                SHA512

                                                c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

                                              • \Users\Admin\AppData\Local\Temp\jek2E61.tmp

                                                Filesize

                                                172KB

                                                MD5

                                                685f1cbd4af30a1d0c25f252d399a666

                                                SHA1

                                                6a1b978f5e6150b88c8634146f1406ed97d2f134

                                                SHA256

                                                0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

                                                SHA512

                                                6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

                                              • memory/900-65-0x0000000000240000-0x000000000024F000-memory.dmp

                                                Filesize

                                                60KB

                                              • memory/900-58-0x0000000074D81000-0x0000000074D83000-memory.dmp

                                                Filesize

                                                8KB

                                              • memory/900-66-0x000000007EFA0000-0x000000007EFAC000-memory.dmp

                                                Filesize

                                                48KB

                                              • memory/900-64-0x000000007EFA0000-0x000000007EFAC000-memory.dmp

                                                Filesize

                                                48KB

                                              • memory/900-63-0x0000000000400000-0x000000000042E000-memory.dmp

                                                Filesize

                                                184KB

                                              • memory/956-61-0x0000000000320000-0x0000000000393000-memory.dmp

                                                Filesize

                                                460KB

                                              • memory/956-62-0x00000000003A0000-0x00000000003CE000-memory.dmp

                                                Filesize

                                                184KB

                                              • memory/956-60-0x0000000000400000-0x0000000000436000-memory.dmp

                                                Filesize

                                                216KB

                                              • memory/956-67-0x00000000003A0000-0x00000000003CE000-memory.dmp

                                                Filesize

                                                184KB

                                              • memory/956-68-0x0000000000400000-0x0000000000436000-memory.dmp

                                                Filesize

                                                216KB

                                              • memory/956-69-0x0000000000320000-0x0000000000393000-memory.dmp

                                                Filesize

                                                460KB