Overview
overview
10Static
static
10123.exe
windows7-x64
1123.exe
windows10-2004-x64
1360sb.exe
windows7-x64
10360sb.exe
windows10-2004-x64
107000.32
ubuntu-18.04-amd64
17000.64
ubuntu-18.04-amd64
7Linux577
ubuntu-18.04-amd64
8Mh.exe
windows7-x64
7Mh.exe
windows10-2004-x64
10Mh1.exe
windows7-x64
7Mh1.exe
windows10-2004-x64
10Mh2.exe
windows7-x64
7Mh2.exe
windows10-2004-x64
10SETUP.exe
windows7-x64
SETUP.exe
windows10-2004-x64
TX98
ubuntu-18.04-amd64
1TX981
ubuntu-18.04-amd64
1TX982
ubuntu-18.04-amd64
7TX984
debian-9-armhf
7TX985
debian-9-mipsel
7TX986
debian-9-mips
7bjyk.exe
windows7-x64
10bjyk.exe
windows10-2004-x64
10ceshi.exe
windows7-x64
10ceshi.exe
windows10-2004-x64
10ddos.exe
windows7-x64
1ddos.exe
windows10-2004-x64
10dhl.exe
windows7-x64
7dhl.exe
windows10-2004-x64
10mh3.exe
windows7-x64
7mh3.exe
windows10-2004-x64
10server.exe
windows7-x64
10Analysis
-
max time kernel
128s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
27-03-2023 09:42
Behavioral task
behavioral1
Sample
123.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
123.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral3
Sample
360sb.exe
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
360sb.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
7000.32
Resource
ubuntu1804-amd64-20221111-en
Behavioral task
behavioral6
Sample
7000.64
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral7
Sample
Linux577
Resource
ubuntu1804-amd64-20221111-en
Behavioral task
behavioral8
Sample
Mh.exe
Resource
win7-20230220-en
Behavioral task
behavioral9
Sample
Mh.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral10
Sample
Mh1.exe
Resource
win7-20230220-en
Behavioral task
behavioral11
Sample
Mh1.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral12
Sample
Mh2.exe
Resource
win7-20230220-en
Behavioral task
behavioral13
Sample
Mh2.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral14
Sample
SETUP.exe
Resource
win7-20230220-en
Behavioral task
behavioral15
Sample
SETUP.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral16
Sample
TX98
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral17
Sample
TX981
Resource
ubuntu1804-amd64-20221111-en
Behavioral task
behavioral18
Sample
TX982
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral19
Sample
TX984
Resource
debian9-armhf-20221111-en
Behavioral task
behavioral20
Sample
TX985
Resource
debian9-mipsel-en-20211208
Behavioral task
behavioral21
Sample
TX986
Resource
debian9-mipsbe-20221111-en
Behavioral task
behavioral22
Sample
bjyk.exe
Resource
win7-20230220-en
Behavioral task
behavioral23
Sample
bjyk.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral24
Sample
ceshi.exe
Resource
win7-20230220-en
Behavioral task
behavioral25
Sample
ceshi.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral26
Sample
ddos.exe
Resource
win7-20230220-en
Behavioral task
behavioral27
Sample
ddos.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral28
Sample
dhl.exe
Resource
win7-20230220-en
Behavioral task
behavioral29
Sample
dhl.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral30
Sample
mh3.exe
Resource
win7-20230220-en
Behavioral task
behavioral31
Sample
mh3.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral32
Sample
server.exe
Resource
win7-20230220-en
General
-
Target
bjyk.exe
-
Size
377KB
-
MD5
ca7c977b5b315dd62b0189f2619764db
-
SHA1
42ce52b22e5017990660148ba6c5ff0097c5af01
-
SHA256
c6d90ced12fb16ca9ae112787ce6d29379b06e0ba0a90595e337c07453a571fa
-
SHA512
b7be48e4c7ca12e0059a6b0064eaa8e8c1f4bbd7ed62c2a34671a5875ba25715b45b780d54e58f5429b2cade56244f6a820a46c0a45b0f7e9d4567213a499427
-
SSDEEP
6144:xsItKnWUQpBTyPRqyhYPbncTBlhHrbndnkv0oX90Q1vPjrVCTH3mwVaYo7/8FaA/:OtWUzJq8YPbncT3+vXPjc3xVaYo7UFyO
Malware Config
Signatures
-
Gh0st RAT payload 10 IoCs
Processes:
resource yara_rule behavioral22/memory/1396-57-0x0000000000400000-0x0000000000432800-memory.dmp family_gh0strat behavioral22/memory/1396-63-0x0000000000400000-0x0000000000432800-memory.dmp family_gh0strat \Users\Admin\AppData\Local\epuokhxcrt family_gh0strat C:\Users\Admin\AppData\Local\epuokhxcrt family_gh0strat \??\c:\users\admin\appdata\local\epuokhxcrt family_gh0strat behavioral22/memory/556-80-0x0000000000400000-0x0000000000432800-memory.dmp family_gh0strat behavioral22/memory/556-82-0x0000000000400000-0x0000000000432800-memory.dmp family_gh0strat \??\c:\programdata\drm\%sessionname%\ubkbp.cc3 family_gh0strat \ProgramData\DRM\%SESSIONNAME%\ubkbp.cc3 family_gh0strat behavioral22/memory/556-95-0x0000000000400000-0x0000000000432800-memory.dmp family_gh0strat -
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\wak4E2.tmp acprotect \Users\Admin\AppData\Local\Temp\tmk80C5.tmp acprotect -
Deletes itself 1 IoCs
Processes:
epuokhxcrtpid process 556 epuokhxcrt -
Executes dropped EXE 1 IoCs
Processes:
epuokhxcrtpid process 556 epuokhxcrt -
Loads dropped DLL 4 IoCs
Processes:
bjyk.exeepuokhxcrtsvchost.exepid process 1396 bjyk.exe 1396 bjyk.exe 556 epuokhxcrt 1956 svchost.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
svchost.exedescription ioc process File opened for modification \??\PhysicalDrive0 svchost.exe -
Drops file in System32 directory 1 IoCs
Processes:
svchost.exedescription ioc process File created C:\Windows\SysWOW64\mvqcnucofy svchost.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe -
Modifies data under HKEY_USERS 6 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum\Version = "7" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum svchost.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
epuokhxcrtsvchost.exepid process 556 epuokhxcrt 1956 svchost.exe 1956 svchost.exe -
Suspicious use of AdjustPrivilegeToken 18 IoCs
Processes:
epuokhxcrtsvchost.exedescription pid process Token: SeRestorePrivilege 556 epuokhxcrt Token: SeBackupPrivilege 556 epuokhxcrt Token: SeBackupPrivilege 556 epuokhxcrt Token: SeRestorePrivilege 556 epuokhxcrt Token: SeBackupPrivilege 1956 svchost.exe Token: SeRestorePrivilege 1956 svchost.exe Token: SeBackupPrivilege 1956 svchost.exe Token: SeBackupPrivilege 1956 svchost.exe Token: SeSecurityPrivilege 1956 svchost.exe Token: SeSecurityPrivilege 1956 svchost.exe Token: SeBackupPrivilege 1956 svchost.exe Token: SeBackupPrivilege 1956 svchost.exe Token: SeSecurityPrivilege 1956 svchost.exe Token: SeBackupPrivilege 1956 svchost.exe Token: SeBackupPrivilege 1956 svchost.exe Token: SeSecurityPrivilege 1956 svchost.exe Token: SeBackupPrivilege 1956 svchost.exe Token: SeRestorePrivilege 1956 svchost.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
bjyk.exeepuokhxcrtpid process 1396 bjyk.exe 556 epuokhxcrt -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
bjyk.exedescription pid process target process PID 1396 wrote to memory of 556 1396 bjyk.exe epuokhxcrt PID 1396 wrote to memory of 556 1396 bjyk.exe epuokhxcrt PID 1396 wrote to memory of 556 1396 bjyk.exe epuokhxcrt PID 1396 wrote to memory of 556 1396 bjyk.exe epuokhxcrt PID 1396 wrote to memory of 556 1396 bjyk.exe epuokhxcrt PID 1396 wrote to memory of 556 1396 bjyk.exe epuokhxcrt PID 1396 wrote to memory of 556 1396 bjyk.exe epuokhxcrt
Processes
-
C:\Users\Admin\AppData\Local\Temp\bjyk.exe"C:\Users\Admin\AppData\Local\Temp\bjyk.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\epuokhxcrt"C:\Users\Admin\AppData\Local\Temp\bjyk.exe" a -sc:\users\admin\appdata\local\temp\bjyk.exe2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\epuokhxcrtFilesize
23.2MB
MD5e9c23674528a77777ced3cb12f0009cd
SHA1b506d6bb8006efe6ac56f19b3fc1a95c8907c931
SHA256306f06d4e7a742d32549da538dff06dc7c99881005bcf8f22c692b90d9991e3a
SHA51209ad68e2a0b9b222e134dcaa1133dfd63b5cbfb2bad71689d30c2d8aa7cf50f8c8e471e79ffc96a8123c9fdbb81bca2101950452f5fb40eba23926fb74d50c33
-
\??\c:\programdata\drm\%sessionname%\ubkbp.cc3Filesize
19.0MB
MD5ac0b6d89f1efdcdcff77f16266f3abf7
SHA12b100b00aca44b1dd653a75185e7e3bf28b46692
SHA2563211e72296ed087ee3d5b1968ff06250cf26a51f2ad4e175ef7c23486c4758dd
SHA512742c13aa287175d174cf972202a1f8a82902fd9fa9c41662cce89474e8aac1db46b8e9765f4c0f8961345a66f03644e57cdc76988b99fe9d6a0821c564ae9c5f
-
\??\c:\users\admin\appdata\local\epuokhxcrtFilesize
23.2MB
MD5e9c23674528a77777ced3cb12f0009cd
SHA1b506d6bb8006efe6ac56f19b3fc1a95c8907c931
SHA256306f06d4e7a742d32549da538dff06dc7c99881005bcf8f22c692b90d9991e3a
SHA51209ad68e2a0b9b222e134dcaa1133dfd63b5cbfb2bad71689d30c2d8aa7cf50f8c8e471e79ffc96a8123c9fdbb81bca2101950452f5fb40eba23926fb74d50c33
-
\ProgramData\DRM\%SESSIONNAME%\ubkbp.cc3Filesize
19.0MB
MD5ac0b6d89f1efdcdcff77f16266f3abf7
SHA12b100b00aca44b1dd653a75185e7e3bf28b46692
SHA2563211e72296ed087ee3d5b1968ff06250cf26a51f2ad4e175ef7c23486c4758dd
SHA512742c13aa287175d174cf972202a1f8a82902fd9fa9c41662cce89474e8aac1db46b8e9765f4c0f8961345a66f03644e57cdc76988b99fe9d6a0821c564ae9c5f
-
\Users\Admin\AppData\Local\Temp\tmk80C5.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
\Users\Admin\AppData\Local\Temp\wak4E2.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
\Users\Admin\AppData\Local\epuokhxcrtFilesize
23.2MB
MD5e9c23674528a77777ced3cb12f0009cd
SHA1b506d6bb8006efe6ac56f19b3fc1a95c8907c931
SHA256306f06d4e7a742d32549da538dff06dc7c99881005bcf8f22c692b90d9991e3a
SHA51209ad68e2a0b9b222e134dcaa1133dfd63b5cbfb2bad71689d30c2d8aa7cf50f8c8e471e79ffc96a8123c9fdbb81bca2101950452f5fb40eba23926fb74d50c33
-
memory/556-80-0x0000000000400000-0x0000000000432800-memory.dmpFilesize
202KB
-
memory/556-87-0x0000000000330000-0x00000000003A3000-memory.dmpFilesize
460KB
-
memory/556-94-0x0000000000330000-0x00000000003A3000-memory.dmpFilesize
460KB
-
memory/556-95-0x0000000000400000-0x0000000000432800-memory.dmpFilesize
202KB
-
memory/556-82-0x0000000000400000-0x0000000000432800-memory.dmpFilesize
202KB
-
memory/556-79-0x0000000000330000-0x00000000003A3000-memory.dmpFilesize
460KB
-
memory/1396-76-0x0000000000230000-0x000000000023D000-memory.dmpFilesize
52KB
-
memory/1396-58-0x0000000000230000-0x0000000000263000-memory.dmpFilesize
204KB
-
memory/1396-60-0x0000000000230000-0x0000000000263000-memory.dmpFilesize
204KB
-
memory/1396-74-0x0000000000360000-0x00000000003D3000-memory.dmpFilesize
460KB
-
memory/1396-63-0x0000000000400000-0x0000000000432800-memory.dmpFilesize
202KB
-
memory/1396-59-0x0000000000230000-0x0000000000263000-memory.dmpFilesize
204KB
-
memory/1396-57-0x0000000000400000-0x0000000000432800-memory.dmpFilesize
202KB
-
memory/1396-61-0x0000000000360000-0x00000000003D3000-memory.dmpFilesize
460KB
-
memory/1396-64-0x0000000000230000-0x0000000000263000-memory.dmpFilesize
204KB
-
memory/1956-96-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB