Overview

overview

10

Static

static

10

0.exe

windows10-1703-x64

10

Analysis

  • max time kernel
    48s
  • max time network
    50s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    19-06-2023 08:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0.exe

  • Size

    71KB

  • MD5

    2a9d0d06d292a4cbbe4a95da4650ed54

  • SHA1

    44c32dfae9ac971c3651adbd82c821971a5400dc

  • SHA256

    09a1c17ac55cde962b4f3bcd61140d752d86362296ee74736000a6a647c73d8c

  • SHA512

    ed15670a18bffa1c5c1d79f1a5a653d6b2bde649164c955473580321f4ab3d048124c26e1a92e9d8ba0edaf754617d2d2c13d8db92323e09957b6de225b5314d

  • SSDEEP

    1536:jWZpTtLcWyeYd4//yEZc1GJf7/QP4uirySj5e:+pZTvnyEZiGJ7/QguiryS5e

Score
10/10
gh0stratrat

Malware Config

Signatures

  • Gh0st RAT payload 3 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat
  • Deletes itself 1 IoCs
  • Drops file in Windows directory 4 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious behavior: LoadsDriver 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0.exe
    "C:\Users\Admin\AppData\Local\Temp\0.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:352
  • \??\c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k localservice -s SstpSvc
    1⤵
      PID:1792
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
      1⤵
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:4136
    • \??\c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
      1⤵
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:4316
    • \??\c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s RasMan
      1⤵
        PID:2100
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\SysWOW64\svchost.exe -k imgsvc
        1⤵
        • Deletes itself
        • Suspicious behavior: EnumeratesProcesses
        PID:3076

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Persistence

      Privilege Escalation

      Defense Evasion

      Credential Access

      Discovery

      Query Registry

      1
      T1012

      Peripheral Device Discovery

      1
      T1120

      System Information Discovery

      1
      T1082

      Lateral Movement

      Collection

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\2236900.dll
        Filesize

        64KB

        MD5

        45dc749351fd65d71da89ca2ed2766cb

        SHA1

        e080faf81157b7f867cb56938c5e579c206af9b9

        SHA256

        391109432ba2df9f3ebc74e0144f42a490405f7c8ecb51da01b4ce793be72f25

        SHA512

        7e63d8778a4656a19397849a6edb483993f1183257fb8c0793ad4b5c625ed69d1b9472969bac6dfc98938e19baed7e3e61ab80085a1a6edd8a50ca660ce3bf74

        Download Submit
      • C:\2236900.dll
        Filesize

        64KB

        MD5

        45dc749351fd65d71da89ca2ed2766cb

        SHA1

        e080faf81157b7f867cb56938c5e579c206af9b9

        SHA256

        391109432ba2df9f3ebc74e0144f42a490405f7c8ecb51da01b4ce793be72f25

        SHA512

        7e63d8778a4656a19397849a6edb483993f1183257fb8c0793ad4b5c625ed69d1b9472969bac6dfc98938e19baed7e3e61ab80085a1a6edd8a50ca660ce3bf74

        Download Submit
      • C:\Windows\INF\netrasa.PNF
        Filesize

        22KB

        MD5

        80648b43d233468718d717d10187b68d

        SHA1

        a1736e8f0e408ce705722ce097d1adb24ebffc45

        SHA256

        8ab9a39457507e405ade5ef9d723e0f89bc46d8d8b33d354b00d95847f098380

        SHA512

        eec0ac7e7abcf87b3f0f4522b0dd95c658327afb866ceecff3c9ff0812a521201d729dd71d43f3ac46536f8435d4a49ac157b6282077c7c1940a6668f3b3aea9

        Download Submit
      • C:\Windows\INF\netsstpa.PNF
        Filesize

        6KB

        MD5

        01e21456e8000bab92907eec3b3aeea9

        SHA1

        39b34fe438352f7b095e24c89968fca48b8ce11c

        SHA256

        35ad0403fdef3fce3ef5cd311c72fef2a95a317297a53c02735cda4bd6e0c74f

        SHA512

        9d5153450e8fe3f51f20472bae4a2ab2fed43fad61a89b04a70325559f6ffed935dd72212671cc6cfc0288458d359bc71567f0d9af8e5770d696adc5bdadd7ec

        Download Submit
      • \??\c:\NT_Path.jpg
        Filesize

        54B

        MD5

        a00837d86d645a5639b2e6327bb4fe89

        SHA1

        da8b4821bd06252275af8761ff86a9224883bc94

        SHA256

        f1d3a57b267da9fddbebc4caf9e88995f667c5a22ca3e3ecd6f825f4b10921f0

        SHA512

        70ba10ca48e7a7622a45155aa61027144ef103ba5ab8fa59e60274c04f7bd0388e7e56a3d5f81c2feecff74e20403df056302b6aad89c9a08a2a5295de691885

        Download Submit
      • \??\c:\windows\filename.jpg
        Filesize

        10.0MB

        MD5

        927c9f69d0599a9ab4cafdf7d0306519

        SHA1

        bb0469d26c179c6042b7b9cbe1d94c9d4006443c

        SHA256

        c430a65447c4823a69c412d73a045198e8af0d5d4a46f203e2f8f206c0abfdbd

        SHA512

        f9c162ae4063ce9bce91261997e51d9ef3bee2fe93e7e1dc708f6674478b9c5a21b395c7bc1112ac49053b15f0f872ac5deed8d31698e3c0a45ecf82c670ca45

        Download Submit