Analysis
-
max time kernel
36s -
max time network
37s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
07/07/2023, 00:11
General
-
Target
Guduak Private.exe
-
Size
378KB
-
MD5
a770ebf2e59e29c7460a01241a0a493f
-
SHA1
97e59e483e1fa524a305828157a50203e918ada9
-
SHA256
ca89debe5dff34c2e2f56875d7dcde5e47565329d3aeb2f2f4a6a3e2248fe664
-
SHA512
4cf99a862fc6e2299e33113bb757dd31a0543c5b5716146de2051fbabe86a122e895a8ced9d4f2290ae82dd9f6093dc883abcb2a6747caa90e8fd46e061f6140
-
SSDEEP
6144:WsItKnWUQpBTyPRqyhYPbncTBlhHrbndnkv0oX90wRudOl1YTSgux1p2iPtGZ5da:btWUzJq8YPbncT3+bRHfYTSgS21NPE+S
Malware Config
Signatures
-
Gh0st RAT payload 10 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
ACProtect 1.3x - 1.4x DLL software 5 IoCs
Detects file using ACProtect software.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 7 IoCs
-
Drops file in System32 directory 6 IoCs
-
Program crash 3 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 17 IoCs
-
Suspicious use of AdjustPrivilegeToken 51 IoCs
-
Suspicious use of FindShellTrayWindow 41 IoCs
-
Suspicious use of SendNotifyMessage 40 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Guduak Private.exe"C:\Users\Admin\AppData\Local\Temp\Guduak Private.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\ijsirtytri"C:\Users\Admin\AppData\Local\Temp\Guduak Private.exe" a -sc:\users\admin\appdata\local\temp\guduak private.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 10282⤵
- Program crash
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3700 -ip 37001⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 11082⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2224 -ip 22241⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 9362⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2632 -ip 26321⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19.0MB
MD5cb9ba89f01ce8c35508632c618fad0a3
SHA1307bbd6e038f6c9ef15de98884cda3c82ac973e1
SHA256920d4fac40acdebe8612e65cea006933cbb4656eb8d42d7d9472fee76ce08a67
SHA5128fe6ccc085013d20956e557a044262c01208de04ef5af2e1be019aa8934f00cb05ed4c5197467146dcdc4b7d81662a06c854e70116d090b0e22cc5998a9c6158
-
Filesize
19.0MB
MD5cb9ba89f01ce8c35508632c618fad0a3
SHA1307bbd6e038f6c9ef15de98884cda3c82ac973e1
SHA256920d4fac40acdebe8612e65cea006933cbb4656eb8d42d7d9472fee76ce08a67
SHA5128fe6ccc085013d20956e557a044262c01208de04ef5af2e1be019aa8934f00cb05ed4c5197467146dcdc4b7d81662a06c854e70116d090b0e22cc5998a9c6158
-
Filesize
19.0MB
MD5cb9ba89f01ce8c35508632c618fad0a3
SHA1307bbd6e038f6c9ef15de98884cda3c82ac973e1
SHA256920d4fac40acdebe8612e65cea006933cbb4656eb8d42d7d9472fee76ce08a67
SHA5128fe6ccc085013d20956e557a044262c01208de04ef5af2e1be019aa8934f00cb05ed4c5197467146dcdc4b7d81662a06c854e70116d090b0e22cc5998a9c6158
-
Filesize
172KB
MD54f407b29d53e9eb54e22d096fce82aa7
SHA1a4ee25b066cac19ff679dd491f5791652bb71185
SHA256cf0ecf30fc95800a34105acb9bcb484bb594a35b3ef26ace8f122af4f9f888dc
SHA512325f7b599455195101e4c0dafd3654906d20ed2c1ce2a5f38784635e16ab545df6ee44a83bed6128239be2dee5be110552c7b246b7f52482ab31552e14b54183
-
Filesize
172KB
MD54f407b29d53e9eb54e22d096fce82aa7
SHA1a4ee25b066cac19ff679dd491f5791652bb71185
SHA256cf0ecf30fc95800a34105acb9bcb484bb594a35b3ef26ace8f122af4f9f888dc
SHA512325f7b599455195101e4c0dafd3654906d20ed2c1ce2a5f38784635e16ab545df6ee44a83bed6128239be2dee5be110552c7b246b7f52482ab31552e14b54183
-
Filesize
172KB
MD54f407b29d53e9eb54e22d096fce82aa7
SHA1a4ee25b066cac19ff679dd491f5791652bb71185
SHA256cf0ecf30fc95800a34105acb9bcb484bb594a35b3ef26ace8f122af4f9f888dc
SHA512325f7b599455195101e4c0dafd3654906d20ed2c1ce2a5f38784635e16ab545df6ee44a83bed6128239be2dee5be110552c7b246b7f52482ab31552e14b54183
-
Filesize
172KB
MD54f407b29d53e9eb54e22d096fce82aa7
SHA1a4ee25b066cac19ff679dd491f5791652bb71185
SHA256cf0ecf30fc95800a34105acb9bcb484bb594a35b3ef26ace8f122af4f9f888dc
SHA512325f7b599455195101e4c0dafd3654906d20ed2c1ce2a5f38784635e16ab545df6ee44a83bed6128239be2dee5be110552c7b246b7f52482ab31552e14b54183
-
Filesize
172KB
MD54f407b29d53e9eb54e22d096fce82aa7
SHA1a4ee25b066cac19ff679dd491f5791652bb71185
SHA256cf0ecf30fc95800a34105acb9bcb484bb594a35b3ef26ace8f122af4f9f888dc
SHA512325f7b599455195101e4c0dafd3654906d20ed2c1ce2a5f38784635e16ab545df6ee44a83bed6128239be2dee5be110552c7b246b7f52482ab31552e14b54183
-
Filesize
22.4MB
MD509480c49b23518809ba0e28a4be1690e
SHA137c4a6f4ed8199397f2cc31d72bbce2b0cc14bba
SHA256b36e043eb7b3f76855de20efc58aa41dd14e3ef121546878477870b51754a866
SHA512bf9138dd919d5898e9c0a965604bcffe09cc7647a28153186ddb6eee5ba8de559a6f9a667d5ad09679872e9da99651c7030deb5acad71d4aab9930a05188a930
-
Filesize
200B
MD529ca770366079590b48df3a0bf278e66
SHA1a35266f4bc17f89c7b6d284a11ff3a38da9fded1
SHA256e4841b63456b9e43527f5992bf9ebcc189bb046a38b3ba18746848e8c9039103
SHA512da21f7effc0814adff44ab7eb4866ef866159ada4da66a783d719e338d9b3409a31659aeed9a11b6c5cbf3c69083d278631c9c8d9ce631aa32d78d5bcf77f055
-
Filesize
300B
MD530416171d4948920916efbd4560933c7
SHA13d241d6efd0e718aad1ba9a91d66e591086c75b2
SHA2566c672d84b03688f31366a73e3e9418dfa523e696de88abffaf87c3ab0afa9ec8
SHA5121ec5e3859548a75e406381f3fa52cfc2bcdf0f095c159000627543a76dcb1c6c312bdb73123252c7a7cbc400fc4ff131edff9a1a9644c895c0fd16f28acf6526
-
Filesize
19.0MB
MD5cb9ba89f01ce8c35508632c618fad0a3
SHA1307bbd6e038f6c9ef15de98884cda3c82ac973e1
SHA256920d4fac40acdebe8612e65cea006933cbb4656eb8d42d7d9472fee76ce08a67
SHA5128fe6ccc085013d20956e557a044262c01208de04ef5af2e1be019aa8934f00cb05ed4c5197467146dcdc4b7d81662a06c854e70116d090b0e22cc5998a9c6158
-
Filesize
22.4MB
MD509480c49b23518809ba0e28a4be1690e
SHA137c4a6f4ed8199397f2cc31d72bbce2b0cc14bba
SHA256b36e043eb7b3f76855de20efc58aa41dd14e3ef121546878477870b51754a866
SHA512bf9138dd919d5898e9c0a965604bcffe09cc7647a28153186ddb6eee5ba8de559a6f9a667d5ad09679872e9da99651c7030deb5acad71d4aab9930a05188a930
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
202KB
-
Filesize
202KB
-
Filesize
464KB
-
Filesize
464KB
-
Filesize
202KB
-
Filesize
464KB
-
Filesize
464KB
-
Filesize
464KB
-
Filesize
202KB