Analysis
-
max time kernel
208s -
max time network
216s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 16:11
Behavioral task
behavioral1
Sample
7bae42064e90876fa11196bc204e5574.exe
Resource
win7-20231129-en
windows7-x64
General
-
Target
7bae42064e90876fa11196bc204e5574.exe
-
Size
138KB
-
MD5
7bae42064e90876fa11196bc204e5574
-
SHA1
379552396e31c91289a3a3ab9fcfc986b9ee02fa
-
SHA256
75663081d185025938ac1882d493f7ceca553aeaf020b0a7b76d19b5a5d1f186
-
SHA512
de029a8828184d62260697c30741c2915d7d00dff8970530423bdb3017a05e594112b49e1d444e19214e4711aa2f138fbf3a08d64e22649ae7446a50bd0662d8
-
SSDEEP
3072:AUqPeqovH7Wbwx0uPneIxypSmOePK4Nk7rybZuwY1Z:AUaeqoiGeIxQrKgQGZuwY
Malware Config
Signatures
-
Gh0st RAT payload 3 IoCs
resource yara_rule behavioral2/files/0x00070000000231ed-3.dat family_gh0strat behavioral2/files/0x000b0000000231fd-12.dat family_gh0strat behavioral2/files/0x000b0000000231fd-13.dat family_gh0strat -
Loads dropped DLL 2 IoCs
pid Process 4304 7bae42064e90876fa11196bc204e5574.exe 3356 svchost.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\FileName.jpg 7bae42064e90876fa11196bc204e5574.exe File created C:\Windows\FileName.jpg 7bae42064e90876fa11196bc204e5574.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe 3356 svchost.exe -
Suspicious behavior: LoadsDriver 6 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 652 Process not Found -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 4304 7bae42064e90876fa11196bc204e5574.exe Token: SeRestorePrivilege 4304 7bae42064e90876fa11196bc204e5574.exe Token: SeBackupPrivilege 4304 7bae42064e90876fa11196bc204e5574.exe Token: SeRestorePrivilege 4304 7bae42064e90876fa11196bc204e5574.exe Token: SeBackupPrivilege 4304 7bae42064e90876fa11196bc204e5574.exe Token: SeRestorePrivilege 4304 7bae42064e90876fa11196bc204e5574.exe Token: SeBackupPrivilege 4304 7bae42064e90876fa11196bc204e5574.exe Token: SeRestorePrivilege 4304 7bae42064e90876fa11196bc204e5574.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7bae42064e90876fa11196bc204e5574.exe"C:\Users\Admin\AppData\Local\Temp\7bae42064e90876fa11196bc204e5574.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4304
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3356
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105KB
MD5416177d74aab0469963377b02cdbb49c
SHA119398899b3e97194d4ef59f531758b7970bc9f82
SHA256baff8f04977f0511ccfb0336622298aced89c8987acade9b985f69b2c17de91e
SHA512316a58b320631fbcac7ce2055ce996e58653a7edc0e199f9be5268349619df4cacdec0bbf3360ba17ed996fce62d52d3ffc45e850befb117e2439ca94c4af069
-
Filesize
2.0MB
MD5370c12b480bc3589f90bc8617398b1a2
SHA1613586ece80964e873842e362814fc64d497dca6
SHA2562c09921fe2f576f211657b4ea03bbb70d5a4da75fe0a283424c8c8c1849cb752
SHA512e43758bdd14d552029262aa56f3360acd492d28f2001646918aa4193a950fcd5c5763a5ab36bff32e5797d7b2d59efd5514fe6e9df0abe77c12008880999de9d
-
Filesize
867KB
MD51964e0dd261bc9be0162a25c8a7b6d52
SHA15c183c5f1104be21ad070b9686c994f5a6193065
SHA256a2dbb94bfd71f07e0841a860f8a5959332c233b9f9b6178aba121d49dbff62f3
SHA5125dd70537ffffa424bb251aa67e349f408b2abf1e313d37592e62c48128b82bf14a87007aed8e056ed82b0e3970c79d8447877f8274dd46f2ab7fe5c29b6211cd
