Analysis
-
max time kernel
150s -
max time network
189s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 05:38
Behavioral task
behavioral1
Sample
8de105771e5779ae9121f7cad873cdbf4df9dc5c609d81b121239b9271c007ff.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
8de105771e5779ae9121f7cad873cdbf4df9dc5c609d81b121239b9271c007ff.exe
Resource
win10v2004-20220812-en
General
-
Target
8de105771e5779ae9121f7cad873cdbf4df9dc5c609d81b121239b9271c007ff.exe
-
Size
725KB
-
MD5
a7c949ddd028f01f2a0ed3f282da4301
-
SHA1
6d109cf2cdf680308a351c8452b04778841cef79
-
SHA256
8de105771e5779ae9121f7cad873cdbf4df9dc5c609d81b121239b9271c007ff
-
SHA512
6ddcd3ffa5cb47cc2976f7b9c5275724e55c0a58dfb3929384b34cc3fa73e01f158b5e65c89276895eee3fbd2e95502f4794ba67f9d1c07f9b17179ce32f856a
-
SSDEEP
12288:QYV2TIO4zmHlccqhILjmZLBr8tVWBr3ts1E:B209mHycNSLBx8
Malware Config
Signatures
-
Gh0st RAT payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/2068-132-0x0000000000400000-0x0000000000562000-memory.dmp family_gh0strat behavioral2/memory/2068-137-0x0000000000400000-0x0000000000562000-memory.dmp family_gh0strat behavioral2/memory/5084-138-0x0000000000400000-0x0000000000562000-memory.dmp family_gh0strat behavioral2/memory/5084-140-0x0000000000400000-0x0000000000562000-memory.dmp family_gh0strat C:\Users\Admin\AppData\Local\Temp\240591109_lang.dll family_gh0strat -
Executes dropped EXE 1 IoCs
Processes:
inzkcszdo.exepid process 5084 inzkcszdo.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
8de105771e5779ae9121f7cad873cdbf4df9dc5c609d81b121239b9271c007ff.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{hwfuylj2-d3bm-7n84-ndj2-1vx72bpji2ey} 8de105771e5779ae9121f7cad873cdbf4df9dc5c609d81b121239b9271c007ff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{hwfuylj2-d3bm-7n84-ndj2-1vx72bpji2ey}\stubpath = "C:\\Windows\\system32\\inzkcszdo.exe" 8de105771e5779ae9121f7cad873cdbf4df9dc5c609d81b121239b9271c007ff.exe -
Processes:
resource yara_rule behavioral2/memory/2068-132-0x0000000000400000-0x0000000000562000-memory.dmp vmprotect C:\Windows\SysWOW64\inzkcszdo.exe vmprotect behavioral2/memory/2068-137-0x0000000000400000-0x0000000000562000-memory.dmp vmprotect C:\Windows\SysWOW64\inzkcszdo.exe vmprotect behavioral2/memory/5084-138-0x0000000000400000-0x0000000000562000-memory.dmp vmprotect behavioral2/memory/5084-140-0x0000000000400000-0x0000000000562000-memory.dmp vmprotect -
Loads dropped DLL 1 IoCs
Processes:
inzkcszdo.exepid process 5084 inzkcszdo.exe -
Drops file in System32 directory 3 IoCs
Processes:
8de105771e5779ae9121f7cad873cdbf4df9dc5c609d81b121239b9271c007ff.exedescription ioc process File opened for modification C:\Windows\SysWOW64\inzkcszdo.exe_lang.ini 8de105771e5779ae9121f7cad873cdbf4df9dc5c609d81b121239b9271c007ff.exe File created C:\Windows\SysWOW64\inzkcszdo.exe 8de105771e5779ae9121f7cad873cdbf4df9dc5c609d81b121239b9271c007ff.exe File created C:\Windows\SysWOW64\syslog.dat 8de105771e5779ae9121f7cad873cdbf4df9dc5c609d81b121239b9271c007ff.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
8de105771e5779ae9121f7cad873cdbf4df9dc5c609d81b121239b9271c007ff.exeinzkcszdo.exepid process 2068 8de105771e5779ae9121f7cad873cdbf4df9dc5c609d81b121239b9271c007ff.exe 2068 8de105771e5779ae9121f7cad873cdbf4df9dc5c609d81b121239b9271c007ff.exe 5084 inzkcszdo.exe 5084 inzkcszdo.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
8de105771e5779ae9121f7cad873cdbf4df9dc5c609d81b121239b9271c007ff.exeinzkcszdo.exedescription pid process Token: 85899345940 2068 8de105771e5779ae9121f7cad873cdbf4df9dc5c609d81b121239b9271c007ff.exe Token: 85899345940 5084 inzkcszdo.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
inzkcszdo.exepid process 5084 inzkcszdo.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
8de105771e5779ae9121f7cad873cdbf4df9dc5c609d81b121239b9271c007ff.exedescription pid process target process PID 2068 wrote to memory of 5084 2068 8de105771e5779ae9121f7cad873cdbf4df9dc5c609d81b121239b9271c007ff.exe inzkcszdo.exe PID 2068 wrote to memory of 5084 2068 8de105771e5779ae9121f7cad873cdbf4df9dc5c609d81b121239b9271c007ff.exe inzkcszdo.exe PID 2068 wrote to memory of 5084 2068 8de105771e5779ae9121f7cad873cdbf4df9dc5c609d81b121239b9271c007ff.exe inzkcszdo.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8de105771e5779ae9121f7cad873cdbf4df9dc5c609d81b121239b9271c007ff.exe"C:\Users\Admin\AppData\Local\Temp\8de105771e5779ae9121f7cad873cdbf4df9dc5c609d81b121239b9271c007ff.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\inzkcszdo.exeC:\Windows\system32\inzkcszdo.exe ZhuDongdelC:\Users\Admin\AppData\Local\Temp\8de105771e5779ae9121f7cad873cdbf4df9dc5c609d81b121239b9271c007ff.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\240591109_lang.dllFilesize
119KB
MD51caeb438be2a702eb8338c2617db8bbc
SHA1ca58249e907410108dba82b832ceb8145ec81e09
SHA256eb9c569a935ab4ba383c7129bb2212e9440ebe7e4dbcc7e7edaa573f99376847
SHA512e633d17a347aa676724e2516252c48c8527857ab9fa4927bc7181a863d7889fe4946e27ddb002ee8ddc4374bc828938e27a09dbda573493290b0b2f2ca27f988
-
C:\Windows\SysWOW64\inzkcszdo.exeFilesize
725KB
MD5ff506a1a09d50ad5bc9a3dee42ea1c01
SHA1cdceabbdf1d98c4a974a8b28fab06d1df2273327
SHA2560b5cd76f8acd374ea1721a1b04a213cf63e4e67e97e88678bf3c387d8a300964
SHA51275df94714679e3a9618881bf1882d6bedb687d5673badea4f7f0188b5028a2d9d99f907112d55cdcc28a957bc5661ff1163359938581850bd3b7ac08473a07d4
-
C:\Windows\SysWOW64\inzkcszdo.exeFilesize
725KB
MD5ff506a1a09d50ad5bc9a3dee42ea1c01
SHA1cdceabbdf1d98c4a974a8b28fab06d1df2273327
SHA2560b5cd76f8acd374ea1721a1b04a213cf63e4e67e97e88678bf3c387d8a300964
SHA51275df94714679e3a9618881bf1882d6bedb687d5673badea4f7f0188b5028a2d9d99f907112d55cdcc28a957bc5661ff1163359938581850bd3b7ac08473a07d4
-
memory/2068-132-0x0000000000400000-0x0000000000562000-memory.dmpFilesize
1.4MB
-
memory/2068-137-0x0000000000400000-0x0000000000562000-memory.dmpFilesize
1.4MB
-
memory/5084-134-0x0000000000000000-mapping.dmp
-
memory/5084-138-0x0000000000400000-0x0000000000562000-memory.dmpFilesize
1.4MB
-
memory/5084-140-0x0000000000400000-0x0000000000562000-memory.dmpFilesize
1.4MB