Overview
overview
10Static
static
10客户端(...EY.exe
windows7-x64
9客户端(...EY.exe
windows10-2004-x64
906432
ubuntu-18.04-amd64
91.exe
windows7-x64
1.exe
windows10-2004-x64
518_2.exe
windows7-x64
4518_2.exe
windows10-2004-x64
4520.exe
windows7-x64
4520.exe
windows10-2004-x64
4Drkv
ubuntu-18.04-amd64
9FCK_RSC.dll
windows7-x64
1FCK_RSC.dll
windows10-2004-x64
1FUCK360.exe
windows7-x64
7FUCK360.exe
windows10-2004-x64
10GetPass.exe
windows7-x64
3GetPass.exe
windows10-2004-x64
3HkMh.exe
windows7-x64
10HkMh.exe
windows10-2004-x64
10HkMh_2.exe
windows7-x64
7HkMh_2.exe
windows10-2004-x64
10HkMh_3.exe
windows7-x64
10HkMh_3.exe
windows10-2004-x64
10Killbash.x
ubuntu-18.04-amd64
7ShellCodeDec.exe
windows7-x64
ShellCodeDec.exe
windows10-2004-x64
TSmm
ubuntu-18.04-amd64
1Trustr
ubuntu-18.04-amd64
1UDP.exe
windows7-x64
1UDP.exe
windows10-2004-x64
1a
ubuntu-18.04-amd64
1arm1
debian-9-armhf
1bj.exe
windows7-x64
10Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
27-03-2023 09:33
Behavioral task
behavioral1
Sample
客户端(Client)_KEY.exe
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral2
Sample
客户端(Client)_KEY.exe
Resource
win10v2004-20230221-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
06432
Resource
ubuntu1804-amd64-en-20211208
ubuntu-18.04-amd64
Behavioral task
behavioral4
Sample
1.exe
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral5
Sample
1.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
518_2.exe
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral7
Sample
518_2.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
520.exe
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral9
Sample
520.exe
Resource
win10v2004-20230221-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
Drkv
Resource
ubuntu1804-amd64-en-20211208
ubuntu-18.04-amd64
Behavioral task
behavioral11
Sample
FCK_RSC.dll
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral12
Sample
FCK_RSC.dll
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
FUCK360.exe
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral14
Sample
FUCK360.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
GetPass.exe
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral16
Sample
GetPass.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
HkMh.exe
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral18
Sample
HkMh.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
HkMh_2.exe
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral20
Sample
HkMh_2.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
HkMh_3.exe
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral22
Sample
HkMh_3.exe
Resource
win10v2004-20230221-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
Killbash.x
Resource
ubuntu1804-amd64-en-20211208
ubuntu-18.04-amd64
Behavioral task
behavioral24
Sample
ShellCodeDec.exe
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral25
Sample
ShellCodeDec.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
TSmm
Resource
ubuntu1804-amd64-20221111-en
ubuntu-18.04-amd64
Behavioral task
behavioral27
Sample
Trustr
Resource
ubuntu1804-amd64-en-20211208
ubuntu-18.04-amd64
Behavioral task
behavioral28
Sample
UDP.exe
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral29
Sample
UDP.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
a
Resource
ubuntu1804-amd64-20221111-en
ubuntu-18.04-amd64
Behavioral task
behavioral31
Sample
arm1
Resource
debian9-armhf-en-20211208
debian-9-armhf
Behavioral task
behavioral32
Sample
bj.exe
Resource
win7-20230220-en
windows7-x64
General
-
Target
HkMh.exe
-
Size
332KB
-
MD5
1cd12a8269d6ed7af46c6d82dbf0db28
-
SHA1
cf47e4ce299999ce9b584e29f29cd3942d8abf27
-
SHA256
83e96c76e59b2d12849e2f92306c76bb90687194326b79546ac9ed2a1d8b6162
-
SHA512
20106eba738c1e0ef1f544879b4036b81cf19aba8c6d581aa6c546af68c819bd7f283138ba9fed55f82feacfcb4c4dd4ba1e0b5af8bf8de481444292109a9baa
-
SSDEEP
6144:xBcBaz+oA9IxnN8veMdpRTAZbl/NMe5F+/fAsluDXKVBopxC1rUniJ734maajc3A:sBaz+oA9IxnN8WmAZbRNZOAy3BUHniJX
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
resource yara_rule behavioral17/memory/1428-57-0x0000000010000000-0x0000000010024000-memory.dmp family_gh0strat behavioral17/memory/1428-61-0x0000000000400000-0x000000000042C000-memory.dmp family_gh0strat -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral17/files/0x000b0000000122de-55.dat acprotect -
Loads dropped DLL 1 IoCs
pid Process 1428 HkMh.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1428 HkMh.exe 1428 HkMh.exe -
Suspicious behavior: MapViewOfSection 22 IoCs
pid Process 1428 HkMh.exe 1428 HkMh.exe 1428 HkMh.exe 1428 HkMh.exe 1428 HkMh.exe 1428 HkMh.exe 1428 HkMh.exe 1428 HkMh.exe 1428 HkMh.exe 1428 HkMh.exe 1428 HkMh.exe 1428 HkMh.exe 1428 HkMh.exe 1428 HkMh.exe 1428 HkMh.exe 1428 HkMh.exe 1428 HkMh.exe 1428 HkMh.exe 1428 HkMh.exe 1428 HkMh.exe 1428 HkMh.exe 1428 HkMh.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1428 HkMh.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1428 HkMh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1428 wrote to memory of 360 1428 HkMh.exe 5 PID 1428 wrote to memory of 360 1428 HkMh.exe 5 PID 1428 wrote to memory of 360 1428 HkMh.exe 5 PID 1428 wrote to memory of 360 1428 HkMh.exe 5 PID 1428 wrote to memory of 360 1428 HkMh.exe 5 PID 1428 wrote to memory of 360 1428 HkMh.exe 5 PID 1428 wrote to memory of 360 1428 HkMh.exe 5 PID 1428 wrote to memory of 380 1428 HkMh.exe 4 PID 1428 wrote to memory of 380 1428 HkMh.exe 4 PID 1428 wrote to memory of 380 1428 HkMh.exe 4 PID 1428 wrote to memory of 380 1428 HkMh.exe 4 PID 1428 wrote to memory of 380 1428 HkMh.exe 4 PID 1428 wrote to memory of 380 1428 HkMh.exe 4 PID 1428 wrote to memory of 380 1428 HkMh.exe 4 PID 1428 wrote to memory of 420 1428 HkMh.exe 3 PID 1428 wrote to memory of 420 1428 HkMh.exe 3 PID 1428 wrote to memory of 420 1428 HkMh.exe 3 PID 1428 wrote to memory of 420 1428 HkMh.exe 3 PID 1428 wrote to memory of 420 1428 HkMh.exe 3 PID 1428 wrote to memory of 420 1428 HkMh.exe 3 PID 1428 wrote to memory of 420 1428 HkMh.exe 3 PID 1428 wrote to memory of 464 1428 HkMh.exe 2 PID 1428 wrote to memory of 464 1428 HkMh.exe 2 PID 1428 wrote to memory of 464 1428 HkMh.exe 2 PID 1428 wrote to memory of 464 1428 HkMh.exe 2 PID 1428 wrote to memory of 464 1428 HkMh.exe 2 PID 1428 wrote to memory of 464 1428 HkMh.exe 2 PID 1428 wrote to memory of 464 1428 HkMh.exe 2 PID 1428 wrote to memory of 480 1428 HkMh.exe 1 PID 1428 wrote to memory of 480 1428 HkMh.exe 1 PID 1428 wrote to memory of 480 1428 HkMh.exe 1 PID 1428 wrote to memory of 480 1428 HkMh.exe 1 PID 1428 wrote to memory of 480 1428 HkMh.exe 1 PID 1428 wrote to memory of 480 1428 HkMh.exe 1 PID 1428 wrote to memory of 480 1428 HkMh.exe 1 PID 1428 wrote to memory of 488 1428 HkMh.exe 8 PID 1428 wrote to memory of 488 1428 HkMh.exe 8 PID 1428 wrote to memory of 488 1428 HkMh.exe 8 PID 1428 wrote to memory of 488 1428 HkMh.exe 8 PID 1428 wrote to memory of 488 1428 HkMh.exe 8 PID 1428 wrote to memory of 488 1428 HkMh.exe 8 PID 1428 wrote to memory of 488 1428 HkMh.exe 8 PID 1428 wrote to memory of 596 1428 HkMh.exe 11 PID 1428 wrote to memory of 596 1428 HkMh.exe 11 PID 1428 wrote to memory of 596 1428 HkMh.exe 11 PID 1428 wrote to memory of 596 1428 HkMh.exe 11 PID 1428 wrote to memory of 596 1428 HkMh.exe 11 PID 1428 wrote to memory of 596 1428 HkMh.exe 11 PID 1428 wrote to memory of 596 1428 HkMh.exe 11 PID 1428 wrote to memory of 672 1428 HkMh.exe 9 PID 1428 wrote to memory of 672 1428 HkMh.exe 9 PID 1428 wrote to memory of 672 1428 HkMh.exe 9 PID 1428 wrote to memory of 672 1428 HkMh.exe 9 PID 1428 wrote to memory of 672 1428 HkMh.exe 9 PID 1428 wrote to memory of 672 1428 HkMh.exe 9 PID 1428 wrote to memory of 672 1428 HkMh.exe 9 PID 1428 wrote to memory of 756 1428 HkMh.exe 10 PID 1428 wrote to memory of 756 1428 HkMh.exe 10 PID 1428 wrote to memory of 756 1428 HkMh.exe 10 PID 1428 wrote to memory of 756 1428 HkMh.exe 10 PID 1428 wrote to memory of 756 1428 HkMh.exe 10 PID 1428 wrote to memory of 756 1428 HkMh.exe 10 PID 1428 wrote to memory of 756 1428 HkMh.exe 10 PID 1428 wrote to memory of 800 1428 HkMh.exe 12
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:480
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵PID:464
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵PID:672
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵PID:756
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵PID:596
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe3⤵PID:2044
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵PID:800
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"3⤵PID:1168
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵PID:836
-
\\?\C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R3⤵PID:2000
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵PID:960
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵PID:1864
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵PID:1664
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵PID:1116
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵PID:1052
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵PID:292
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵PID:108
-
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:420
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:380
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:360
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:488
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\HkMh.exe"C:\Users\Admin\AppData\Local\Temp\HkMh.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1428
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9