Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
01/12/2022, 16:28
Static task
static1
Behavioral task
behavioral1
Sample
e8fef6ad5f55e124479e8ef7ec06303b88dc2de4392ba8b9676e38605e7fe4b3.exe
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral2
Sample
e8fef6ad5f55e124479e8ef7ec06303b88dc2de4392ba8b9676e38605e7fe4b3.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
General
-
Target
e8fef6ad5f55e124479e8ef7ec06303b88dc2de4392ba8b9676e38605e7fe4b3.exe
-
Size
150KB
-
MD5
6bcd47a4bf47dede2ce98ef91027daf8
-
SHA1
d5b64de74fd8814719ec1039ed7da0e12ce4e2ac
-
SHA256
e8fef6ad5f55e124479e8ef7ec06303b88dc2de4392ba8b9676e38605e7fe4b3
-
SHA512
4dae270472d29c8e6fa4a19544e62d427b4da998fcb24adcbb5e5c5dab76afbe3a0c2907fbab25fb746bcc3e2359fd40726b6605baf43d4170ff2f13d56492f9
-
SSDEEP
3072:6xmh61f5kl8BeiOilFW1IeZH6DAFYtmVEfsxHkR/arS4Vs:R6E8/29h0A+mVEfs0yW4W
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/memory/992-63-0x0000000000400000-0x0000000000430000-memory.dmp family_gh0strat -
Executes dropped EXE 2 IoCs
pid Process 992 2618.tmp 1520 inl1816.tmp -
Loads dropped DLL 3 IoCs
pid Process 1184 e8fef6ad5f55e124479e8ef7ec06303b88dc2de4392ba8b9676e38605e7fe4b3.exe 344 cmd.exe 344 cmd.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\B: msiexec.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\loader.dll 2618.tmp File created C:\Program Files\Common Files\lanmao.dll 2618.tmp -
Drops file in Windows directory 10 IoCs
description ioc Process File created C:\WINDOWS\vbcfg.ini 2618.tmp File created C:\Windows\Installer\6d1ae3.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\6d1ae5.msi msiexec.exe File opened for modification C:\Windows\Logs\DPX\setupact.log expand.exe File opened for modification C:\Windows\Logs\DPX\setuperr.log expand.exe File created C:\Windows\Installer\6d1ae1.msi msiexec.exe File opened for modification C:\Windows\Installer\6d1ae1.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI2147.tmp msiexec.exe File opened for modification C:\Windows\Installer\6d1ae3.ipi msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1184 e8fef6ad5f55e124479e8ef7ec06303b88dc2de4392ba8b9676e38605e7fe4b3.exe 1328 msiexec.exe 1328 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 660 msiexec.exe Token: SeIncreaseQuotaPrivilege 660 msiexec.exe Token: SeRestorePrivilege 1328 msiexec.exe Token: SeTakeOwnershipPrivilege 1328 msiexec.exe Token: SeSecurityPrivilege 1328 msiexec.exe Token: SeCreateTokenPrivilege 660 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 660 msiexec.exe Token: SeLockMemoryPrivilege 660 msiexec.exe Token: SeIncreaseQuotaPrivilege 660 msiexec.exe Token: SeMachineAccountPrivilege 660 msiexec.exe Token: SeTcbPrivilege 660 msiexec.exe Token: SeSecurityPrivilege 660 msiexec.exe Token: SeTakeOwnershipPrivilege 660 msiexec.exe Token: SeLoadDriverPrivilege 660 msiexec.exe Token: SeSystemProfilePrivilege 660 msiexec.exe Token: SeSystemtimePrivilege 660 msiexec.exe Token: SeProfSingleProcessPrivilege 660 msiexec.exe Token: SeIncBasePriorityPrivilege 660 msiexec.exe Token: SeCreatePagefilePrivilege 660 msiexec.exe Token: SeCreatePermanentPrivilege 660 msiexec.exe Token: SeBackupPrivilege 660 msiexec.exe Token: SeRestorePrivilege 660 msiexec.exe Token: SeShutdownPrivilege 660 msiexec.exe Token: SeDebugPrivilege 660 msiexec.exe Token: SeAuditPrivilege 660 msiexec.exe Token: SeSystemEnvironmentPrivilege 660 msiexec.exe Token: SeChangeNotifyPrivilege 660 msiexec.exe Token: SeRemoteShutdownPrivilege 660 msiexec.exe Token: SeUndockPrivilege 660 msiexec.exe Token: SeSyncAgentPrivilege 660 msiexec.exe Token: SeEnableDelegationPrivilege 660 msiexec.exe Token: SeManageVolumePrivilege 660 msiexec.exe Token: SeImpersonatePrivilege 660 msiexec.exe Token: SeCreateGlobalPrivilege 660 msiexec.exe Token: SeRestorePrivilege 1328 msiexec.exe Token: SeTakeOwnershipPrivilege 1328 msiexec.exe Token: SeRestorePrivilege 1328 msiexec.exe Token: SeTakeOwnershipPrivilege 1328 msiexec.exe Token: SeRestorePrivilege 1328 msiexec.exe Token: SeTakeOwnershipPrivilege 1328 msiexec.exe Token: SeRestorePrivilege 1328 msiexec.exe Token: SeTakeOwnershipPrivilege 1328 msiexec.exe Token: SeRestorePrivilege 1328 msiexec.exe Token: SeTakeOwnershipPrivilege 1328 msiexec.exe Token: SeRestorePrivilege 1328 msiexec.exe Token: SeTakeOwnershipPrivilege 1328 msiexec.exe Token: SeRestorePrivilege 1328 msiexec.exe Token: SeTakeOwnershipPrivilege 1328 msiexec.exe Token: SeRestorePrivilege 1328 msiexec.exe Token: SeTakeOwnershipPrivilege 1328 msiexec.exe Token: SeRestorePrivilege 1328 msiexec.exe Token: SeTakeOwnershipPrivilege 1328 msiexec.exe Token: SeRestorePrivilege 1328 msiexec.exe Token: SeTakeOwnershipPrivilege 1328 msiexec.exe Token: SeRestorePrivilege 1328 msiexec.exe Token: SeTakeOwnershipPrivilege 1328 msiexec.exe Token: SeRestorePrivilege 1328 msiexec.exe Token: SeTakeOwnershipPrivilege 1328 msiexec.exe Token: SeRestorePrivilege 1328 msiexec.exe Token: SeTakeOwnershipPrivilege 1328 msiexec.exe Token: SeRestorePrivilege 1328 msiexec.exe Token: SeTakeOwnershipPrivilege 1328 msiexec.exe Token: SeRestorePrivilege 1328 msiexec.exe Token: SeTakeOwnershipPrivilege 1328 msiexec.exe -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 1184 wrote to memory of 992 1184 e8fef6ad5f55e124479e8ef7ec06303b88dc2de4392ba8b9676e38605e7fe4b3.exe 27 PID 1184 wrote to memory of 992 1184 e8fef6ad5f55e124479e8ef7ec06303b88dc2de4392ba8b9676e38605e7fe4b3.exe 27 PID 1184 wrote to memory of 992 1184 e8fef6ad5f55e124479e8ef7ec06303b88dc2de4392ba8b9676e38605e7fe4b3.exe 27 PID 1184 wrote to memory of 992 1184 e8fef6ad5f55e124479e8ef7ec06303b88dc2de4392ba8b9676e38605e7fe4b3.exe 27 PID 1184 wrote to memory of 992 1184 e8fef6ad5f55e124479e8ef7ec06303b88dc2de4392ba8b9676e38605e7fe4b3.exe 27 PID 1184 wrote to memory of 992 1184 e8fef6ad5f55e124479e8ef7ec06303b88dc2de4392ba8b9676e38605e7fe4b3.exe 27 PID 1184 wrote to memory of 992 1184 e8fef6ad5f55e124479e8ef7ec06303b88dc2de4392ba8b9676e38605e7fe4b3.exe 27 PID 1184 wrote to memory of 660 1184 e8fef6ad5f55e124479e8ef7ec06303b88dc2de4392ba8b9676e38605e7fe4b3.exe 28 PID 1184 wrote to memory of 660 1184 e8fef6ad5f55e124479e8ef7ec06303b88dc2de4392ba8b9676e38605e7fe4b3.exe 28 PID 1184 wrote to memory of 660 1184 e8fef6ad5f55e124479e8ef7ec06303b88dc2de4392ba8b9676e38605e7fe4b3.exe 28 PID 1184 wrote to memory of 660 1184 e8fef6ad5f55e124479e8ef7ec06303b88dc2de4392ba8b9676e38605e7fe4b3.exe 28 PID 1184 wrote to memory of 660 1184 e8fef6ad5f55e124479e8ef7ec06303b88dc2de4392ba8b9676e38605e7fe4b3.exe 28 PID 1184 wrote to memory of 660 1184 e8fef6ad5f55e124479e8ef7ec06303b88dc2de4392ba8b9676e38605e7fe4b3.exe 28 PID 1184 wrote to memory of 660 1184 e8fef6ad5f55e124479e8ef7ec06303b88dc2de4392ba8b9676e38605e7fe4b3.exe 28 PID 1328 wrote to memory of 544 1328 msiexec.exe 30 PID 1328 wrote to memory of 544 1328 msiexec.exe 30 PID 1328 wrote to memory of 544 1328 msiexec.exe 30 PID 1328 wrote to memory of 544 1328 msiexec.exe 30 PID 1328 wrote to memory of 544 1328 msiexec.exe 30 PID 1328 wrote to memory of 544 1328 msiexec.exe 30 PID 1328 wrote to memory of 544 1328 msiexec.exe 30 PID 1184 wrote to memory of 344 1184 e8fef6ad5f55e124479e8ef7ec06303b88dc2de4392ba8b9676e38605e7fe4b3.exe 31 PID 1184 wrote to memory of 344 1184 e8fef6ad5f55e124479e8ef7ec06303b88dc2de4392ba8b9676e38605e7fe4b3.exe 31 PID 1184 wrote to memory of 344 1184 e8fef6ad5f55e124479e8ef7ec06303b88dc2de4392ba8b9676e38605e7fe4b3.exe 31 PID 1184 wrote to memory of 344 1184 e8fef6ad5f55e124479e8ef7ec06303b88dc2de4392ba8b9676e38605e7fe4b3.exe 31 PID 1184 wrote to memory of 792 1184 e8fef6ad5f55e124479e8ef7ec06303b88dc2de4392ba8b9676e38605e7fe4b3.exe 33 PID 1184 wrote to memory of 792 1184 e8fef6ad5f55e124479e8ef7ec06303b88dc2de4392ba8b9676e38605e7fe4b3.exe 33 PID 1184 wrote to memory of 792 1184 e8fef6ad5f55e124479e8ef7ec06303b88dc2de4392ba8b9676e38605e7fe4b3.exe 33 PID 1184 wrote to memory of 792 1184 e8fef6ad5f55e124479e8ef7ec06303b88dc2de4392ba8b9676e38605e7fe4b3.exe 33 PID 1184 wrote to memory of 1072 1184 e8fef6ad5f55e124479e8ef7ec06303b88dc2de4392ba8b9676e38605e7fe4b3.exe 35 PID 1184 wrote to memory of 1072 1184 e8fef6ad5f55e124479e8ef7ec06303b88dc2de4392ba8b9676e38605e7fe4b3.exe 35 PID 1184 wrote to memory of 1072 1184 e8fef6ad5f55e124479e8ef7ec06303b88dc2de4392ba8b9676e38605e7fe4b3.exe 35 PID 1184 wrote to memory of 1072 1184 e8fef6ad5f55e124479e8ef7ec06303b88dc2de4392ba8b9676e38605e7fe4b3.exe 35 PID 792 wrote to memory of 1668 792 cmd.exe 37 PID 792 wrote to memory of 1668 792 cmd.exe 37 PID 792 wrote to memory of 1668 792 cmd.exe 37 PID 792 wrote to memory of 1668 792 cmd.exe 37 PID 344 wrote to memory of 1520 344 cmd.exe 38 PID 344 wrote to memory of 1520 344 cmd.exe 38 PID 344 wrote to memory of 1520 344 cmd.exe 38 PID 344 wrote to memory of 1520 344 cmd.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8fef6ad5f55e124479e8ef7ec06303b88dc2de4392ba8b9676e38605e7fe4b3.exe"C:\Users\Admin\AppData\Local\Temp\e8fef6ad5f55e124479e8ef7ec06303b88dc2de4392ba8b9676e38605e7fe4b3.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Roaming\2618.tmpC:\Users\Admin\AppData\Roaming\2618.tmp2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
PID:992
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i C:\Users\Admin\AppData\Local\Temp\INSDB0~1.INI /quiet2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:660
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\run_dws_file.bat" "2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:344 -
C:\Users\Admin\AppData\Local\Temp\inl1816.tmpC:\Users\Admin\AppData\Local\Temp\inl1816.tmp cdf1912.tmp3⤵
- Executes dropped EXE
PID:1520
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp_ext_favurl_cab.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Windows\SysWOW64\expand.exeexpand.exe "C:\Users\Admin\AppData\Local\Temp\favorites_url.cab" -F:*.* "C:\Users\Admin\Favorites"3⤵
- Drops file in Windows directory
PID:1668
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\E8FEF6~1.EXE > nul2⤵PID:1072
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E929DC20D44956DDC4A41738D9A818A32⤵PID:544
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66KB
MD544e179b88b108b638e30f6e635c0e045
SHA1212f5fad034a425969df12ca46b9adbfa1751b5c
SHA256c8a1f33be704dac0711d9eeaf8f34013ce3c9aa179058770d7e266451ac20a94
SHA512ef6e697cec833e36f9afbc46324f283f9fb5a344d919a50d7f5784b71619bbb1a553dd91c2849c25cf5c82b5e509d67432181f56e2a2c2251d92b81504a85925
-
Filesize
765B
MD5a4a4219ce5fdbaf2864b04ca4e453ac9
SHA198bf1383e8b2f4db0388ee139ae7fe06ff7a67a9
SHA2567ce64a6d79d1772713cf59d6575aec39f9fa00690d4c84cd2f160081b0d412c6
SHA51222f5668719a58a4c1692ceb8aae48af9d5a53527d96431410587fa1f3f67ec9b5f0660c87fa9d931343e1be9b0f56f03c3fcd431cc2d67b104450b2ef792baa8
-
Filesize
85.0MB
MD57249403fd1a0d4cb7ea8832a9cc13164
SHA18f94d1619f2d3f1c9262009f179828c749ceae9f
SHA256f716c962ac0bbd75d4025bcfae5fac75f5761efd44326d69fc7f426348ab1e9f
SHA51278df8b964b9a80c2084d214183fb85d15af7a624af25acae6767952dc48c417b48822a5c69b10dbbc6f74abaf17cafee6f8edf9bb38898e132cdb0bda3056f0f
-
Filesize
86.7MB
MD5723527f4a071396bafed91f1d77d5ec4
SHA16cf0d9a7950ab54c94dec5f1e4f352fd6262eed4
SHA2569609d54108dd8037e3254dd761499dff0b80acdf466086b152a4b995ef8e776b
SHA512bceac69bb72ab64a1945802c26b2fd315ff4815ea68f63ef955b204cd39a330720d98a741aae1c4167fc800906b3fb714819a800e4acff9b04158898175cbcb5
-
Filesize
57B
MD52b047a2b2920c4aede848b88bf8697ab
SHA181dcf899af8d252ea3aaf135e92771bebcb7fd78
SHA25650e80935924fd795dbb7c0c4a8a5cbb300bea60afd3c8f63c73c97c49e3adbbe
SHA512218d450d401ab536686474cba1f6f75854392d8415f49056e8e61570a832c5fa0d3fdf855d4f6eb2189759c99fa82370ec29b77109122febd25475a468c8b485
-
Filesize
98B
MD58663de6fce9208b795dc913d1a6a3f5b
SHA1882193f208cf012eaf22eeaa4fef3b67e7c67c15
SHA2562909ea8555f2fc19097c1070a1da8fcfd6dc6886aa1d99d7e0c05e53feeb5b61
SHA5129381063e0f85e874be54ae22675393b82c6ab54b223090148e4acbeff6f22393c96c90b83d6538461b695528af01d1f1231cf5dc719f07d6168386974b490688
-
Filesize
230.8MB
MD59948ad7ac395e846172e5094197b8988
SHA137a23c9e3f49d86c6402a2b1442a718ca9962ce8
SHA25618427da950a6fc6d0f3b7a1dfea3d43a2fc783be6f5f64eb70028b6f6bd31693
SHA51214c1541d739f01a268f2c30bd972c85e946704bc109898de6a8b5d836b6436053272c4011c6c688c74717c2624f9386aa1d79d5d03abad1489316c7ab3479524
-
Filesize
228.1MB
MD5626a7015772fbdd1e6c4244bb9fd46dc
SHA1080ff56d81c6e0c5c19ecdad78a0109c991bf3f7
SHA256811d6ae5563938ea13473a951cb1ddf0c750a7783fc44dfd83041a8dd7d6acde
SHA51295823a4f3c9e36ded0952ce6625776245f819ebdbbee0864beea3781b8957548c1f6c2987acfcbe67c712fe0a3ece940748ac342bc9f1bedc2b2d39047bee7f1
-
Filesize
425B
MD5da68bc3b7c3525670a04366bc55629f5
SHA115fda47ecfead7db8f7aee6ca7570138ba7f1b71
SHA25673f3605192b676c92649034768378909a19d13883a7ea6f8ba1b096c78ffadb5
SHA5126fee416affcb6a74621479697bca6f14f5429b00de3aa595abe3c60c6b2e094877b59f8783bbe7bdd567fa565d0630bb02def5603f8f0ea92fe8f2c3ac5383c0
-
Filesize
87.6MB
MD5e65f6d8dfeec7c5cba07d81ce52ddfb4
SHA1c59bbec1cf5c4bf63a40ec36f723b13a8eedea5a
SHA256d18884c44471afe3196cc2b4915515935265e3f55cc54d0686d1c907ba5cc7b3
SHA512dd97a0fc338a5befb8abfd5f78a573e9196dec37b000ae5c2a804c5a7984409e343f82a632bcf241bfdda9f0f10851357dfae827870e4040b97c7fc138027119
-
Filesize
85.4MB
MD5f13e15af09d99fb825cd62148605da2e
SHA149d92eb125ec8597148b97d75bdb13adcf0bdf79
SHA256cd0a4ddfd93d191ddb23889671be68cf4bbf29320288bc12f123d985df83f2e7
SHA512c4a3ffeaea092c4c397910da9f9b138506cf71279a1e7da1ba8dc78ab61ef53276b5f0d479683b6ab22654f172594828f03259b189ffdf620fe79f7823425817
-
Filesize
231.1MB
MD52d84db4754a54b806557d0433a78ab52
SHA1695976c04257ab8944f9cbe6fea8bdedaaadf52f
SHA256997d29eb86d9a34d718b57bc18e6e8c7f7d130e02d1ef728b39238ab7a16477b
SHA512be9eee5874e4d759b5260b2acca7ca3e466d01226fbad2f0bec7fd07e7730f0ce338f8a9451a0c46260b6370c0b9fad70673e27a2adefd57e012c239d6617d9c