Analysis
-
max time kernel
152s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02/12/2022, 20:57
Behavioral task
behavioral1
Sample
5455595d598c012ef4f1c780380e9da5be6aac3391fc160e601b2313b3a3618e.dll
Resource
win7-20220812-en
windows7-x64
General
-
Target
5455595d598c012ef4f1c780380e9da5be6aac3391fc160e601b2313b3a3618e.dll
-
Size
101KB
-
MD5
ce984afa468ecf45378f560032f2fe30
-
SHA1
8ac533d69eee761236fe562af4ddead1f8cbaed1
-
SHA256
5455595d598c012ef4f1c780380e9da5be6aac3391fc160e601b2313b3a3618e
-
SHA512
526cf0ebdc96afffe9b3b30a8adc6b013c8bc011aa2d9ee5f93b25be4a2bd5da2af273849815f62f4153bf792f76730036d22b31da3be70a8317a319b3e667d7
-
SSDEEP
3072:CwZSQpKa3VGVnpUlCz764/9xpEEBqbZuwa5iG:JJVGpxx9b3wZuwa4G
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
resource yara_rule behavioral2/files/0x000c000000022e17-133.dat family_gh0strat behavioral2/files/0x000c000000022e17-134.dat family_gh0strat -
Loads dropped DLL 1 IoCs
pid Process 2584 svchost.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\123456.jpg rundll32.exe File created C:\Windows\123456.jpg rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe 2584 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 5072 rundll32.exe Token: SeRestorePrivilege 5072 rundll32.exe Token: SeBackupPrivilege 5072 rundll32.exe Token: SeRestorePrivilege 5072 rundll32.exe Token: SeBackupPrivilege 5072 rundll32.exe Token: SeRestorePrivilege 5072 rundll32.exe Token: SeBackupPrivilege 5072 rundll32.exe Token: SeRestorePrivilege 5072 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1800 wrote to memory of 5072 1800 rundll32.exe 78 PID 1800 wrote to memory of 5072 1800 rundll32.exe 78 PID 1800 wrote to memory of 5072 1800 rundll32.exe 78
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5455595d598c012ef4f1c780380e9da5be6aac3391fc160e601b2313b3a3618e.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5455595d598c012ef4f1c780380e9da5be6aac3391fc160e601b2313b3a3618e.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5072
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2584
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.4MB
MD5c501e0f1d5a14d4c8078d0cb2bc599dc
SHA112a1627fb98fe4f9eedd71e9c3ae36838ca76274
SHA2560fe3e5f06c6c7845c10f12eb05a73dbdff0e1f56c570f655bec9758f1780dcc1
SHA51276e247ecb5960ff3c5dbb7453981c6185d6920725a626f42b56d8fe6641d0ff649218aea8c95b222a7e851d3dd45363b7d5e90f7b2028a11f2afe723508c504a
-
Filesize
2.4MB
MD5c501e0f1d5a14d4c8078d0cb2bc599dc
SHA112a1627fb98fe4f9eedd71e9c3ae36838ca76274
SHA2560fe3e5f06c6c7845c10f12eb05a73dbdff0e1f56c570f655bec9758f1780dcc1
SHA51276e247ecb5960ff3c5dbb7453981c6185d6920725a626f42b56d8fe6641d0ff649218aea8c95b222a7e851d3dd45363b7d5e90f7b2028a11f2afe723508c504a
