Analysis
-
max time kernel
68s -
max time network
71s -
platform
windows10-2004_x64 -
resource
win10v2004-20230824-en -
resource tags
arch:x64arch:x86image:win10v2004-20230824-enlocale:en-usos:windows10-2004-x64system -
submitted
26-08-2023 22:36
Behavioral task
behavioral1
Sample
0.exe
Resource
win7-20230712-en
General
-
Target
0.exe
-
Size
71KB
-
MD5
2a9d0d06d292a4cbbe4a95da4650ed54
-
SHA1
44c32dfae9ac971c3651adbd82c821971a5400dc
-
SHA256
09a1c17ac55cde962b4f3bcd61140d752d86362296ee74736000a6a647c73d8c
-
SHA512
ed15670a18bffa1c5c1d79f1a5a653d6b2bde649164c955473580321f4ab3d048124c26e1a92e9d8ba0edaf754617d2d2c13d8db92323e09957b6de225b5314d
-
SSDEEP
1536:jWZpTtLcWyeYd4//yEZc1GJf7/QP4uirySj5e:+pZTvnyEZiGJ7/QguiryS5e
Malware Config
Signatures
-
Gh0st RAT payload 5 IoCs
Processes:
resource yara_rule C:\2844900.dll family_gh0strat C:\2844900.dll family_gh0strat \??\c:\windows\filename.jpg family_gh0strat C:\Windows\FileName.jpg family_gh0strat C:\2844900.dll family_gh0strat -
Loads dropped DLL 2 IoCs
Processes:
0.exesvchost.exepid process 1512 0.exe 3456 svchost.exe -
Drops file in Windows directory 2 IoCs
Processes:
0.exedescription ioc process File opened for modification C:\Windows\FileName.jpg 0.exe File created C:\Windows\FileName.jpg 0.exe -
Suspicious behavior: EnumeratesProcesses 58 IoCs
Processes:
svchost.exepid process 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe 3456 svchost.exe -
Suspicious behavior: LoadsDriver 6 IoCs
Processes:
pid 4 4 4 4 4 676 -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
0.exedescription pid process Token: SeBackupPrivilege 1512 0.exe Token: SeRestorePrivilege 1512 0.exe Token: SeBackupPrivilege 1512 0.exe Token: SeRestorePrivilege 1512 0.exe Token: SeBackupPrivilege 1512 0.exe Token: SeRestorePrivilege 1512 0.exe Token: SeBackupPrivilege 1512 0.exe Token: SeRestorePrivilege 1512 0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0.exe"C:\Users\Admin\AppData\Local\Temp\0.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\2844900.dllFilesize
64KB
MD545dc749351fd65d71da89ca2ed2766cb
SHA1e080faf81157b7f867cb56938c5e579c206af9b9
SHA256391109432ba2df9f3ebc74e0144f42a490405f7c8ecb51da01b4ce793be72f25
SHA5127e63d8778a4656a19397849a6edb483993f1183257fb8c0793ad4b5c625ed69d1b9472969bac6dfc98938e19baed7e3e61ab80085a1a6edd8a50ca660ce3bf74
-
C:\2844900.dllFilesize
64KB
MD545dc749351fd65d71da89ca2ed2766cb
SHA1e080faf81157b7f867cb56938c5e579c206af9b9
SHA256391109432ba2df9f3ebc74e0144f42a490405f7c8ecb51da01b4ce793be72f25
SHA5127e63d8778a4656a19397849a6edb483993f1183257fb8c0793ad4b5c625ed69d1b9472969bac6dfc98938e19baed7e3e61ab80085a1a6edd8a50ca660ce3bf74
-
C:\2844900.dllFilesize
64KB
MD545dc749351fd65d71da89ca2ed2766cb
SHA1e080faf81157b7f867cb56938c5e579c206af9b9
SHA256391109432ba2df9f3ebc74e0144f42a490405f7c8ecb51da01b4ce793be72f25
SHA5127e63d8778a4656a19397849a6edb483993f1183257fb8c0793ad4b5c625ed69d1b9472969bac6dfc98938e19baed7e3e61ab80085a1a6edd8a50ca660ce3bf74
-
C:\Windows\FileName.jpgFilesize
6.2MB
MD59d404d79b3eefcac9a0a32b05ef5fe07
SHA172f852ff6e46415c8d6688fbf46507e81e019f65
SHA256d63e79fee0ff94ad8b7c0eb570b6bfeb9655d91821e814ca9f3883038cc99904
SHA5120837169d5eb34df9ec87130998906b98c198abc7769cee918ce66e16a9f29b18125cac98bec53bbf48bcb5606952d0f70e9e7e7faa6226b5322874c1b50a9bee
-
\??\c:\NT_Path.jpgFilesize
54B
MD526a58f4ca3ed7e28dae7519d7a7734ee
SHA118cc118b4c21c7bc506a01ebaecb7d4e1d433188
SHA2565c0c4af65ea8bf27feade185008e19c5390a1051bf0ec2db3ca1bcacb9507a4b
SHA512b5fff72e9c684d48f83c8448853ace60110280b7cd5e11f9b68902ae2feca5b88d90ae17f739ccb666e2a5e23c03119b4b9174d1f80cfa5632c9c64b285a4665
-
\??\c:\windows\filename.jpgFilesize
6.2MB
MD59d404d79b3eefcac9a0a32b05ef5fe07
SHA172f852ff6e46415c8d6688fbf46507e81e019f65
SHA256d63e79fee0ff94ad8b7c0eb570b6bfeb9655d91821e814ca9f3883038cc99904
SHA5120837169d5eb34df9ec87130998906b98c198abc7769cee918ce66e16a9f29b18125cac98bec53bbf48bcb5606952d0f70e9e7e7faa6226b5322874c1b50a9bee