Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
16-08-2023 14:57
Behavioral task
behavioral1
Sample
0.exe
Resource
win7-20230712-en
General
-
Target
0.exe
-
Size
71KB
-
MD5
2a9d0d06d292a4cbbe4a95da4650ed54
-
SHA1
44c32dfae9ac971c3651adbd82c821971a5400dc
-
SHA256
09a1c17ac55cde962b4f3bcd61140d752d86362296ee74736000a6a647c73d8c
-
SHA512
ed15670a18bffa1c5c1d79f1a5a653d6b2bde649164c955473580321f4ab3d048124c26e1a92e9d8ba0edaf754617d2d2c13d8db92323e09957b6de225b5314d
-
SSDEEP
1536:jWZpTtLcWyeYd4//yEZc1GJf7/QP4uirySj5e:+pZTvnyEZiGJ7/QguiryS5e
Malware Config
Signatures
-
Gh0st RAT payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1196-54-0x0000000000400000-0x0000000000413000-memory.dmp family_gh0strat C:\Windows\FileName.jpg family_gh0strat \??\c:\windows\filename.jpg family_gh0strat C:\1249400.dll family_gh0strat -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 2528 svchost.exe -
Drops file in Windows directory 2 IoCs
Processes:
0.exedescription ioc process File opened for modification C:\Windows\FileName.jpg 0.exe File created C:\Windows\FileName.jpg 0.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
0.exedescription pid process Token: SeBackupPrivilege 1196 0.exe Token: SeRestorePrivilege 1196 0.exe Token: SeBackupPrivilege 1196 0.exe Token: SeRestorePrivilege 1196 0.exe Token: SeBackupPrivilege 1196 0.exe Token: SeRestorePrivilege 1196 0.exe Token: SeBackupPrivilege 1196 0.exe Token: SeRestorePrivilege 1196 0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0.exe"C:\Users\Admin\AppData\Local\Temp\0.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\1249400.dllFilesize
64KB
MD545dc749351fd65d71da89ca2ed2766cb
SHA1e080faf81157b7f867cb56938c5e579c206af9b9
SHA256391109432ba2df9f3ebc74e0144f42a490405f7c8ecb51da01b4ce793be72f25
SHA5127e63d8778a4656a19397849a6edb483993f1183257fb8c0793ad4b5c625ed69d1b9472969bac6dfc98938e19baed7e3e61ab80085a1a6edd8a50ca660ce3bf74
-
C:\Windows\FileName.jpgFilesize
6.1MB
MD5fe9da11b0087b1c1280ea27b446d9e5a
SHA1fa053d3e7fba4444b64b39419abb843fab38f78b
SHA25679088af204609f77930741f00695e1209c5238395d6e33e155ccf2b3413467b3
SHA51223ef126e19b273e09a752fe1178bfc25202d4c1e3e2044769bade80f0e1ca13ba124d87f28e63fd429b8a0f1b4f88f71b05d55a2d973f8475d1ad71564d482b8
-
\??\c:\NT_Path.jpgFilesize
54B
MD558c3d419edf708722ce3d22ebb48e04a
SHA18b553f1462a8ca9f0903fbdbb3e31d2d04cf1128
SHA2561c0966aff64b7b6a4bb48058f76f0d6eab7e6689a411cfed018c8ac6b5cc9925
SHA512270682fd5d5c63c97e5a1e0894b0192da0ee4a2b01aae42361b283cc1c7236d7fb48c2d314ef59d0654c3200ae8438c56d8115c1da98b31a1140b666c96312ca
-
\??\c:\windows\filename.jpgFilesize
6.1MB
MD5fe9da11b0087b1c1280ea27b446d9e5a
SHA1fa053d3e7fba4444b64b39419abb843fab38f78b
SHA25679088af204609f77930741f00695e1209c5238395d6e33e155ccf2b3413467b3
SHA51223ef126e19b273e09a752fe1178bfc25202d4c1e3e2044769bade80f0e1ca13ba124d87f28e63fd429b8a0f1b4f88f71b05d55a2d973f8475d1ad71564d482b8
-
memory/1196-54-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB