Analysis
-
max time kernel
141s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
25-03-2023 14:09
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20230220-en
General
-
Target
tmp.exe
-
Size
161KB
-
MD5
f35b17916d8f7aaffa2e4c2db4597015
-
SHA1
2e4fbfa5bcd58c62be0df7cbea92b65264993743
-
SHA256
52091de74be387b3409cb595306fef4ef8129c0cd4e4867659140218495c7aa4
-
SHA512
f48ef1aa21805e8bca91b6ee87f338c8388d2c8dff6422955704a9c352877f8ad665c139fc3febd6f8c2d64a44ce9d6153e35c8d46b59b4a505ac381b3ad1a5e
-
SSDEEP
3072:6yIpG2/iDbYeZqFU+D+mlVP93L22cYl71tmAY1n68g1UphQi5UJs:rIposeKUoP93LeI71smuhQXJs
Malware Config
Extracted
gh0strat
154.9.24.101
Signatures
-
Gh0st RAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4764-134-0x0000000010000000-0x0000000010015000-memory.dmp family_gh0strat behavioral2/memory/4764-139-0x0000000000400000-0x0000000000471000-memory.dmp family_gh0strat -
Processes:
resource yara_rule behavioral2/memory/4764-133-0x0000000000400000-0x0000000000471000-memory.dmp upx behavioral2/memory/4764-139-0x0000000000400000-0x0000000000471000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
tmp.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp.exe" tmp.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
tmp.exedescription ioc process File opened (read-only) \??\R: tmp.exe File opened (read-only) \??\V: tmp.exe File opened (read-only) \??\B: tmp.exe File opened (read-only) \??\F: tmp.exe File opened (read-only) \??\H: tmp.exe File opened (read-only) \??\N: tmp.exe File opened (read-only) \??\O: tmp.exe File opened (read-only) \??\Q: tmp.exe File opened (read-only) \??\W: tmp.exe File opened (read-only) \??\Y: tmp.exe File opened (read-only) \??\G: tmp.exe File opened (read-only) \??\I: tmp.exe File opened (read-only) \??\M: tmp.exe File opened (read-only) \??\S: tmp.exe File opened (read-only) \??\T: tmp.exe File opened (read-only) \??\U: tmp.exe File opened (read-only) \??\Z: tmp.exe File opened (read-only) \??\J: tmp.exe File opened (read-only) \??\E: tmp.exe File opened (read-only) \??\K: tmp.exe File opened (read-only) \??\L: tmp.exe File opened (read-only) \??\P: tmp.exe File opened (read-only) \??\X: tmp.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
tmp.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 tmp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz tmp.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
tmp.exepid process 4764 tmp.exe 4764 tmp.exe 4764 tmp.exe 4764 tmp.exe 4764 tmp.exe 4764 tmp.exe 4764 tmp.exe 4764 tmp.exe