Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
-
submitted
03-04-2023 08:55
General
-
Target
(电-子-发-票）.exe
-
Size
36KB
-
MD5
928c43415fa08992ecf34e90db8c2a5b
-
SHA1
b2bd43ff4005bce6d39fad9d8bf2c2f25a89f37c
-
SHA256
e9cc6d34b4e20a11e3af01182672a0ca71d111d1b89d73fc8584a5534d491d7e
-
SHA512
d1c847fbf19e5d7661ff90b365decc25142de94304c812c016719948901586378909d28424bb388f904f01b072f7840758d6baa4e75a7f857799333acab7976d
-
SSDEEP
384:4krtyExpPhFmSkkuJ0EKtU/lOgDTp4nuHD80sApEQDeT6lF:jVh93umEeUcgDTWujtP
Malware Config
Signatures
-
Gh0st RAT payload 4 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 1 IoCs
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL 1 IoCs
-
UPX packed file 17 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\(电-子-发-票）.exe"C:\Users\Admin\AppData\Local\Temp\(电-子-发-票）.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\ProgramData\Thunder\LiveUpdate.exeC:\ProgramData\Thunder\LiveUpdate.exe1⤵
- Executes dropped EXE
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD5317f9ff06c076e87e5b1d11242396d5f
SHA129868086fe5adb4b32c0216d953c419b596246c7
SHA2560e10625daf43a3f4c67f2840ced29d535d0307148819c8ec73a7e76241e9f644
SHA512ba2b12fc365fa232e6c96e1c8ebceb77bf9347fba2ffb4e3cee7d7be829cbab3cec17668cbf401b4904e5b831df3c6550821da1921f214166862dcc83ab44f07
-
Filesize
1.8MB
MD5317f9ff06c076e87e5b1d11242396d5f
SHA129868086fe5adb4b32c0216d953c419b596246c7
SHA2560e10625daf43a3f4c67f2840ced29d535d0307148819c8ec73a7e76241e9f644
SHA512ba2b12fc365fa232e6c96e1c8ebceb77bf9347fba2ffb4e3cee7d7be829cbab3cec17668cbf401b4904e5b831df3c6550821da1921f214166862dcc83ab44f07
-
Filesize
23KB
MD5f149d3f3ef0361ebe4d346811f29b527
SHA13f985657f0b93a58e9405d32eab4ee3957af12d2
SHA2560929342683de55e572e11428b0cb545f6582c705c59655c0872589ae16043235
SHA512331645f91cecb66fd8c04a26edc58d6e03ad44710b5b35161cbba3831e09855e02292ffb802d3a2c0ce1a4ecd9f301a580ff1d695ae06c7eda7d90ae72ef602c
-
Filesize
470KB
MD596e4b47a136910d6f588b40d872e7f9d
SHA10d2eae5df6a4bbf79ec8cd3505d00c4bdabf331e
SHA256f788ed739241f79688653d27aeefd18c9d8142a31fe0b5342535e392c040dd9b
SHA5126776e37c4ed134003cdfe1c75e6133e805ee5a8db002710a14735c829fe66d24c3754c5033da6d2fd3e84b85df672b2f4862279bc04915ebfb798334c7f61cb4
-
Filesize
1.1MB
MD5fd481828932e558a22651c092d8bc407
SHA10db0d90b2384197d4136643c11cc42091f2a4943
SHA256b607ba991b27cf9551ffbf51b3e1f2c6a6a63d9748ac9d5c89c4f1b95f76bfa1
SHA512934b78d80f88b2fe27bc2371b891c171852ceb465980e25bc96220edbd32cfd9e7057d59e3152a506baa862face14b7e1bc5221ce524c2845755c6f5b0514e61
-
Filesize
14B
MD588cc3e3a35ac7a57a2d9b2632c7fc5f8
SHA167a04a547a9add726932e00447e1c6939f1639fb
SHA25618739435f66131b1c596d73fada3d1219ea0a4f2d4ccee56573baef4161d5e43
SHA5121c40fc3635b2117a1a970778a8dcc11ba97d77a34cbb43583a018e43c1648138a5f8aacaf4d1767deed0b0e39879476e0069a43506b93d19c4997a10b3060038
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.5MB
-
Filesize
1.2MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB