Analysis
-
max time kernel
152s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
02/12/2022, 20:56
Behavioral task
behavioral1
Sample
8338240f4cba8d057eb3456311aa6b184378ca2aac293de8da4e102975d6ec4a.dll
Resource
win7-20221111-en
windows7-x64
General
-
Target
8338240f4cba8d057eb3456311aa6b184378ca2aac293de8da4e102975d6ec4a.dll
-
Size
133KB
-
MD5
1f644c6e35dc1971c3df858e9d59d610
-
SHA1
e9fd37d2bc1f48a6d566c9e37ef03922b80c0746
-
SHA256
8338240f4cba8d057eb3456311aa6b184378ca2aac293de8da4e102975d6ec4a
-
SHA512
07e1e21335492bedb6eeba8ace5a81b735f8d211d5d118f353de6adc39caa3b52d661caf7d37ccf528ccb00317545833d681c052263260bd3ad6c83b1e8bded9
-
SSDEEP
3072:bixrcYyNNBxIf58d6UuSMhXk22T94oz7vEEZzcEaJO:aANBxIxh0u4TSg7vECzcZ0
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
resource yara_rule behavioral2/files/0x000a000000022e50-133.dat family_gh0strat behavioral2/files/0x000a000000022e50-134.dat family_gh0strat -
Loads dropped DLL 1 IoCs
pid Process 3872 svchost.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Uqrs\Aqrstuvwx.bmp rundll32.exe File created C:\Program Files (x86)\Uqrs\Aqrstuvwx.bmp rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe 3872 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 3688 rundll32.exe Token: SeRestorePrivilege 3688 rundll32.exe Token: SeBackupPrivilege 3688 rundll32.exe Token: SeRestorePrivilege 3688 rundll32.exe Token: SeBackupPrivilege 3688 rundll32.exe Token: SeRestorePrivilege 3688 rundll32.exe Token: SeBackupPrivilege 3688 rundll32.exe Token: SeRestorePrivilege 3688 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2040 wrote to memory of 3688 2040 rundll32.exe 84 PID 2040 wrote to memory of 3688 2040 rundll32.exe 84 PID 2040 wrote to memory of 3688 2040 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8338240f4cba8d057eb3456311aa6b184378ca2aac293de8da4e102975d6ec4a.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8338240f4cba8d057eb3456311aa6b184378ca2aac293de8da4e102975d6ec4a.dll,#12⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3688
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3872
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.7MB
MD5a487c09374621f2951a40d47710fa478
SHA18ea3d730282a27b115f86b82e4272f11c7b80710
SHA256e30fd140e5f18f86fe381b2229fb79f5216912216471bf746d0c8c7057b30dd7
SHA5126c5819ffef931de2d7a197c1bc5cae6dfb8157a0fec4a536353604045fbcb9e0f776ca29602d65b30a5c35c8dbaad41d336a8d28b4cc05bbf1a331702fe95eee
-
Filesize
7.7MB
MD5a487c09374621f2951a40d47710fa478
SHA18ea3d730282a27b115f86b82e4272f11c7b80710
SHA256e30fd140e5f18f86fe381b2229fb79f5216912216471bf746d0c8c7057b30dd7
SHA5126c5819ffef931de2d7a197c1bc5cae6dfb8157a0fec4a536353604045fbcb9e0f776ca29602d65b30a5c35c8dbaad41d336a8d28b4cc05bbf1a331702fe95eee
