Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
08-03-2023 12:17
Behavioral task
behavioral1
Sample
0.exe
Resource
win7-20230220-en
General
-
Target
0.exe
-
Size
71KB
-
MD5
2a9d0d06d292a4cbbe4a95da4650ed54
-
SHA1
44c32dfae9ac971c3651adbd82c821971a5400dc
-
SHA256
09a1c17ac55cde962b4f3bcd61140d752d86362296ee74736000a6a647c73d8c
-
SHA512
ed15670a18bffa1c5c1d79f1a5a653d6b2bde649164c955473580321f4ab3d048124c26e1a92e9d8ba0edaf754617d2d2c13d8db92323e09957b6de225b5314d
-
SSDEEP
1536:jWZpTtLcWyeYd4//yEZc1GJf7/QP4uirySj5e:+pZTvnyEZiGJ7/QguiryS5e
Malware Config
Signatures
-
Gh0st RAT payload 5 IoCs
Processes:
resource yara_rule C:\138700.dll family_gh0strat C:\138700.dll family_gh0strat \??\c:\windows\filename.jpg family_gh0strat C:\Windows\FileName.jpg family_gh0strat C:\138700.dll family_gh0strat -
Loads dropped DLL 2 IoCs
Processes:
0.exesvchost.exepid process 1312 0.exe 4388 svchost.exe -
Drops file in Windows directory 2 IoCs
Processes:
0.exedescription ioc process File opened for modification C:\Windows\FileName.jpg 0.exe File created C:\Windows\FileName.jpg 0.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe 4388 svchost.exe -
Suspicious behavior: LoadsDriver 6 IoCs
Processes:
pid 4 4 4 4 4 664 -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
0.exedescription pid process Token: SeBackupPrivilege 1312 0.exe Token: SeRestorePrivilege 1312 0.exe Token: SeBackupPrivilege 1312 0.exe Token: SeRestorePrivilege 1312 0.exe Token: SeBackupPrivilege 1312 0.exe Token: SeRestorePrivilege 1312 0.exe Token: SeBackupPrivilege 1312 0.exe Token: SeRestorePrivilege 1312 0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0.exe"C:\Users\Admin\AppData\Local\Temp\0.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\138700.dllFilesize
64KB
MD545dc749351fd65d71da89ca2ed2766cb
SHA1e080faf81157b7f867cb56938c5e579c206af9b9
SHA256391109432ba2df9f3ebc74e0144f42a490405f7c8ecb51da01b4ce793be72f25
SHA5127e63d8778a4656a19397849a6edb483993f1183257fb8c0793ad4b5c625ed69d1b9472969bac6dfc98938e19baed7e3e61ab80085a1a6edd8a50ca660ce3bf74
-
C:\138700.dllFilesize
64KB
MD545dc749351fd65d71da89ca2ed2766cb
SHA1e080faf81157b7f867cb56938c5e579c206af9b9
SHA256391109432ba2df9f3ebc74e0144f42a490405f7c8ecb51da01b4ce793be72f25
SHA5127e63d8778a4656a19397849a6edb483993f1183257fb8c0793ad4b5c625ed69d1b9472969bac6dfc98938e19baed7e3e61ab80085a1a6edd8a50ca660ce3bf74
-
C:\138700.dllFilesize
64KB
MD545dc749351fd65d71da89ca2ed2766cb
SHA1e080faf81157b7f867cb56938c5e579c206af9b9
SHA256391109432ba2df9f3ebc74e0144f42a490405f7c8ecb51da01b4ce793be72f25
SHA5127e63d8778a4656a19397849a6edb483993f1183257fb8c0793ad4b5c625ed69d1b9472969bac6dfc98938e19baed7e3e61ab80085a1a6edd8a50ca660ce3bf74
-
C:\Windows\FileName.jpgFilesize
4.8MB
MD565650a007fcb9e10305c32b43eda3cd8
SHA196e7367a7772314bb2c74f82552718fd1dddb201
SHA2567b13ac6defdc9f33e56a8a707508d4f93c12ff22488b91526e3392cdcae92f48
SHA512c178e6430f1a98339543b46d9ba8c4d9cd4b9efb8e489c71441acec5b5d195685f49f4927d486e5012a4db601e18b8d799fe7d907a1c6d9a6a5cdbe725731881
-
\??\c:\NT_Path.jpgFilesize
53B
MD529e685d8f71e4f6814db1d06a44c2a76
SHA1bd261a426a5912dffdb0c4a832437af76a0a4940
SHA256faa6ffbe12a04c76808e2740a4349f4ec6d911161cfc34fc7d9f9c7f0e1f3e2c
SHA512f1a8fa5fd49ae1dae534b52f24ea1ab25112635fb864d329aecca314d8d132fadb8455554333dcffb497d3e2f10902d3b32fb829748daec4b7e136eb6dc2f41a
-
\??\c:\windows\filename.jpgFilesize
4.8MB
MD565650a007fcb9e10305c32b43eda3cd8
SHA196e7367a7772314bb2c74f82552718fd1dddb201
SHA2567b13ac6defdc9f33e56a8a707508d4f93c12ff22488b91526e3392cdcae92f48
SHA512c178e6430f1a98339543b46d9ba8c4d9cd4b9efb8e489c71441acec5b5d195685f49f4927d486e5012a4db601e18b8d799fe7d907a1c6d9a6a5cdbe725731881