Overview
overview
10Static
static
10123.exe
windows7-x64
1123.exe
windows10-2004-x64
1360sb.exe
windows7-x64
10360sb.exe
windows10-2004-x64
107000.32
ubuntu-18.04-amd64
17000.64
ubuntu-18.04-amd64
7Linux577
ubuntu-18.04-amd64
8Mh.exe
windows7-x64
7Mh.exe
windows10-2004-x64
10Mh1.exe
windows7-x64
7Mh1.exe
windows10-2004-x64
10Mh2.exe
windows7-x64
7Mh2.exe
windows10-2004-x64
10SETUP.exe
windows7-x64
SETUP.exe
windows10-2004-x64
TX98
ubuntu-18.04-amd64
1TX981
ubuntu-18.04-amd64
1TX982
ubuntu-18.04-amd64
7TX984
debian-9-armhf
7TX985
debian-9-mipsel
7TX986
debian-9-mips
7bjyk.exe
windows7-x64
10bjyk.exe
windows10-2004-x64
10ceshi.exe
windows7-x64
10ceshi.exe
windows10-2004-x64
10ddos.exe
windows7-x64
1ddos.exe
windows10-2004-x64
10dhl.exe
windows7-x64
7dhl.exe
windows10-2004-x64
10mh3.exe
windows7-x64
7mh3.exe
windows10-2004-x64
10server.exe
windows7-x64
10Analysis
-
max time kernel
149s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
27-03-2023 09:42
Behavioral task
behavioral1
Sample
123.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
123.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral3
Sample
360sb.exe
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
360sb.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
7000.32
Resource
ubuntu1804-amd64-20221111-en
Behavioral task
behavioral6
Sample
7000.64
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral7
Sample
Linux577
Resource
ubuntu1804-amd64-20221111-en
Behavioral task
behavioral8
Sample
Mh.exe
Resource
win7-20230220-en
Behavioral task
behavioral9
Sample
Mh.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral10
Sample
Mh1.exe
Resource
win7-20230220-en
Behavioral task
behavioral11
Sample
Mh1.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral12
Sample
Mh2.exe
Resource
win7-20230220-en
Behavioral task
behavioral13
Sample
Mh2.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral14
Sample
SETUP.exe
Resource
win7-20230220-en
Behavioral task
behavioral15
Sample
SETUP.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral16
Sample
TX98
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral17
Sample
TX981
Resource
ubuntu1804-amd64-20221111-en
Behavioral task
behavioral18
Sample
TX982
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral19
Sample
TX984
Resource
debian9-armhf-20221111-en
Behavioral task
behavioral20
Sample
TX985
Resource
debian9-mipsel-en-20211208
Behavioral task
behavioral21
Sample
TX986
Resource
debian9-mipsbe-20221111-en
Behavioral task
behavioral22
Sample
bjyk.exe
Resource
win7-20230220-en
Behavioral task
behavioral23
Sample
bjyk.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral24
Sample
ceshi.exe
Resource
win7-20230220-en
Behavioral task
behavioral25
Sample
ceshi.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral26
Sample
ddos.exe
Resource
win7-20230220-en
Behavioral task
behavioral27
Sample
ddos.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral28
Sample
dhl.exe
Resource
win7-20230220-en
Behavioral task
behavioral29
Sample
dhl.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral30
Sample
mh3.exe
Resource
win7-20230220-en
Behavioral task
behavioral31
Sample
mh3.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral32
Sample
server.exe
Resource
win7-20230220-en
General
-
Target
ceshi.exe
-
Size
303KB
-
MD5
3ddd0fe1b5a21d08007805185072bdd0
-
SHA1
174d3667b9f266b139f5892c961e7609a6134d79
-
SHA256
42676dd65d1dbd81f8f8e751790b4412c5a179feb7edb5460cf230463f141299
-
SHA512
2b633d6be693f46ac07e17c43a7389655e7e7e0ded027e9a82ca120139e0e44c68d1f76b32e34501bb9d4d3dcc9d44997c2803999b9aa1f2fec8f531464fdd9f
-
SSDEEP
6144:rt8nMnJqNMFSTLeYVvI8vw+Ie51BMz3VolJXUVLAW5w7wIAsKCEc4YgUFk6Oa7HS:doNMsy8I6KFojXUaWQ5KCqOvOaJt+
Malware Config
Signatures
-
Gh0st RAT payload 3 IoCs
Processes:
resource yara_rule \??\c:\windows\SysWOW64\winds.dll family_gh0strat \Windows\SysWOW64\Winds.dll family_gh0strat behavioral24/memory/912-61-0x0000000000400000-0x0000000000424000-memory.dmp family_gh0strat -
Sets DLL path for service in the registry 2 TTPs 1 IoCs
Processes:
ceshi.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\netsvcs_0x0\Parameters\ServiceDll = "C:\\Windows\\system32\\Winds.dll" ceshi.exe -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\mbkF7C.tmp acprotect -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 1088 svchost.exe -
Loads dropped DLL 2 IoCs
Processes:
ceshi.exesvchost.exepid process 912 ceshi.exe 1088 svchost.exe -
Drops file in System32 directory 1 IoCs
Processes:
ceshi.exedescription ioc process File created C:\Windows\SysWOW64\Winds.dll ceshi.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
ceshi.exepid process 912 ceshi.exe -
Suspicious behavior: MapViewOfSection 22 IoCs
Processes:
ceshi.exepid process 912 ceshi.exe 912 ceshi.exe 912 ceshi.exe 912 ceshi.exe 912 ceshi.exe 912 ceshi.exe 912 ceshi.exe 912 ceshi.exe 912 ceshi.exe 912 ceshi.exe 912 ceshi.exe 912 ceshi.exe 912 ceshi.exe 912 ceshi.exe 912 ceshi.exe 912 ceshi.exe 912 ceshi.exe 912 ceshi.exe 912 ceshi.exe 912 ceshi.exe 912 ceshi.exe 912 ceshi.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ceshi.exedescription pid process Token: SeDebugPrivilege 912 ceshi.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
ceshi.exepid process 912 ceshi.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ceshi.exedescription pid process target process PID 912 wrote to memory of 368 912 ceshi.exe wininit.exe PID 912 wrote to memory of 368 912 ceshi.exe wininit.exe PID 912 wrote to memory of 368 912 ceshi.exe wininit.exe PID 912 wrote to memory of 368 912 ceshi.exe wininit.exe PID 912 wrote to memory of 368 912 ceshi.exe wininit.exe PID 912 wrote to memory of 368 912 ceshi.exe wininit.exe PID 912 wrote to memory of 368 912 ceshi.exe wininit.exe PID 912 wrote to memory of 380 912 ceshi.exe csrss.exe PID 912 wrote to memory of 380 912 ceshi.exe csrss.exe PID 912 wrote to memory of 380 912 ceshi.exe csrss.exe PID 912 wrote to memory of 380 912 ceshi.exe csrss.exe PID 912 wrote to memory of 380 912 ceshi.exe csrss.exe PID 912 wrote to memory of 380 912 ceshi.exe csrss.exe PID 912 wrote to memory of 380 912 ceshi.exe csrss.exe PID 912 wrote to memory of 416 912 ceshi.exe winlogon.exe PID 912 wrote to memory of 416 912 ceshi.exe winlogon.exe PID 912 wrote to memory of 416 912 ceshi.exe winlogon.exe PID 912 wrote to memory of 416 912 ceshi.exe winlogon.exe PID 912 wrote to memory of 416 912 ceshi.exe winlogon.exe PID 912 wrote to memory of 416 912 ceshi.exe winlogon.exe PID 912 wrote to memory of 416 912 ceshi.exe winlogon.exe PID 912 wrote to memory of 460 912 ceshi.exe services.exe PID 912 wrote to memory of 460 912 ceshi.exe services.exe PID 912 wrote to memory of 460 912 ceshi.exe services.exe PID 912 wrote to memory of 460 912 ceshi.exe services.exe PID 912 wrote to memory of 460 912 ceshi.exe services.exe PID 912 wrote to memory of 460 912 ceshi.exe services.exe PID 912 wrote to memory of 460 912 ceshi.exe services.exe PID 912 wrote to memory of 476 912 ceshi.exe lsass.exe PID 912 wrote to memory of 476 912 ceshi.exe lsass.exe PID 912 wrote to memory of 476 912 ceshi.exe lsass.exe PID 912 wrote to memory of 476 912 ceshi.exe lsass.exe PID 912 wrote to memory of 476 912 ceshi.exe lsass.exe PID 912 wrote to memory of 476 912 ceshi.exe lsass.exe PID 912 wrote to memory of 476 912 ceshi.exe lsass.exe PID 912 wrote to memory of 484 912 ceshi.exe lsm.exe PID 912 wrote to memory of 484 912 ceshi.exe lsm.exe PID 912 wrote to memory of 484 912 ceshi.exe lsm.exe PID 912 wrote to memory of 484 912 ceshi.exe lsm.exe PID 912 wrote to memory of 484 912 ceshi.exe lsm.exe PID 912 wrote to memory of 484 912 ceshi.exe lsm.exe PID 912 wrote to memory of 484 912 ceshi.exe lsm.exe PID 912 wrote to memory of 580 912 ceshi.exe svchost.exe PID 912 wrote to memory of 580 912 ceshi.exe svchost.exe PID 912 wrote to memory of 580 912 ceshi.exe svchost.exe PID 912 wrote to memory of 580 912 ceshi.exe svchost.exe PID 912 wrote to memory of 580 912 ceshi.exe svchost.exe PID 912 wrote to memory of 580 912 ceshi.exe svchost.exe PID 912 wrote to memory of 580 912 ceshi.exe svchost.exe PID 912 wrote to memory of 660 912 ceshi.exe svchost.exe PID 912 wrote to memory of 660 912 ceshi.exe svchost.exe PID 912 wrote to memory of 660 912 ceshi.exe svchost.exe PID 912 wrote to memory of 660 912 ceshi.exe svchost.exe PID 912 wrote to memory of 660 912 ceshi.exe svchost.exe PID 912 wrote to memory of 660 912 ceshi.exe svchost.exe PID 912 wrote to memory of 660 912 ceshi.exe svchost.exe PID 912 wrote to memory of 744 912 ceshi.exe svchost.exe PID 912 wrote to memory of 744 912 ceshi.exe svchost.exe PID 912 wrote to memory of 744 912 ceshi.exe svchost.exe PID 912 wrote to memory of 744 912 ceshi.exe svchost.exe PID 912 wrote to memory of 744 912 ceshi.exe svchost.exe PID 912 wrote to memory of 744 912 ceshi.exe svchost.exe PID 912 wrote to memory of 744 912 ceshi.exe svchost.exe PID 912 wrote to memory of 812 912 ceshi.exe svchost.exe
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs2⤵
- Deletes itself
- Loads dropped DLL
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\wininit.exewininit.exe1⤵
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe1⤵
-
\\?\C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\ceshi.exe"C:\Users\Admin\AppData\Local\Temp\ceshi.exe"2⤵
- Sets DLL path for service in the registry
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\??\c:\windows\SysWOW64\winds.dllFilesize
96KB
MD52aa77acb6bbb0776f1c619cdc27374b6
SHA1f2afb28195caa694927977201ed14dd25827fb2b
SHA256c0338a019c36f33f9189d3a97f104e915acdc953be6b2c0bfb74453bf2fbf522
SHA512351aecaec4ddaced31921707faadd1f20b973526141c4944fa1e7b0ceed86e2af7f3eeddeb9e5af4388de25fc981a5eaf688c189e2ab07f774fedf44638d5fb6
-
\Users\Admin\AppData\Local\Temp\mbkF7C.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
\Windows\SysWOW64\Winds.dllFilesize
96KB
MD52aa77acb6bbb0776f1c619cdc27374b6
SHA1f2afb28195caa694927977201ed14dd25827fb2b
SHA256c0338a019c36f33f9189d3a97f104e915acdc953be6b2c0bfb74453bf2fbf522
SHA512351aecaec4ddaced31921707faadd1f20b973526141c4944fa1e7b0ceed86e2af7f3eeddeb9e5af4388de25fc981a5eaf688c189e2ab07f774fedf44638d5fb6
-
memory/912-60-0x0000000000220000-0x0000000000293000-memory.dmpFilesize
460KB
-
memory/912-61-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB