Analysis
-
max time kernel
148s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 05:39
Static task
static1
Behavioral task
behavioral1
Sample
1032a3ed090f9abba2c1cba5f8412764.exe
Resource
win7-20231215-en
windows7-x64
General
-
Target
1032a3ed090f9abba2c1cba5f8412764.exe
-
Size
143KB
-
MD5
1032a3ed090f9abba2c1cba5f8412764
-
SHA1
fb287a0a8a222221a9042f0b8ae52174b09ebb71
-
SHA256
3a5d187a32e724419e9f09e614e24d2d16a68bfe30dff50c377a1e9286d219a9
-
SHA512
652a75b4eae898980a643e09989869e5b3552f326df3582966f057dd1d9856915a198bcaac458b1f7766520eb2698f040964dc10478a5a65195b157cf0f70b15
-
SSDEEP
3072:C69iSZOmD27rRavfCCY8feFgtV4dfFO5pctyhUeqovd3B3E:C/Sc1oykcFu3hUeqoJB0
Malware Config
Signatures
-
Gh0st RAT payload 3 IoCs
resource yara_rule behavioral1/files/0x0039000000015d50-5.dat family_gh0strat behavioral1/files/0x000d000000012251-10.dat family_gh0strat behavioral1/memory/2008-11-0x0000000000400000-0x000000000042A000-memory.dmp family_gh0strat -
Deletes itself 1 IoCs
pid Process 2932 svchost.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\123.jpg 1032a3ed090f9abba2c1cba5f8412764.exe File created C:\Windows\123.jpg 1032a3ed090f9abba2c1cba5f8412764.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2008 1032a3ed090f9abba2c1cba5f8412764.exe 2008 1032a3ed090f9abba2c1cba5f8412764.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 2008 1032a3ed090f9abba2c1cba5f8412764.exe Token: SeRestorePrivilege 2008 1032a3ed090f9abba2c1cba5f8412764.exe Token: SeBackupPrivilege 2008 1032a3ed090f9abba2c1cba5f8412764.exe Token: SeRestorePrivilege 2008 1032a3ed090f9abba2c1cba5f8412764.exe Token: SeBackupPrivilege 2008 1032a3ed090f9abba2c1cba5f8412764.exe Token: SeRestorePrivilege 2008 1032a3ed090f9abba2c1cba5f8412764.exe Token: SeBackupPrivilege 2008 1032a3ed090f9abba2c1cba5f8412764.exe Token: SeRestorePrivilege 2008 1032a3ed090f9abba2c1cba5f8412764.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1032a3ed090f9abba2c1cba5f8412764.exe"C:\Users\Admin\AppData\Local\Temp\1032a3ed090f9abba2c1cba5f8412764.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2008
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
PID:2932
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
101KB
MD5ca3d84abd2632b1575c754b4404ec695
SHA16657872f3b828024bd2bee272cbcf34448e0ca53
SHA256cb6e3f4a37bd4dde1ad468cc588f5d30a58ba2f91851ddfea4a5b96c06b3344f
SHA512f894f8feca666629a05334f22e77b96137160be867e6250dca6adbe08e845f708506792afe735e4b890b87402b26065f4759b2a111d62856e008a670646f1978
-
Filesize
145KB
MD5bed70841662c86d69488dd3f5f83bdbd
SHA1828b906c8d23edb97ee2fa86d26d70bc26895213
SHA256d07c46bb724b03a24726b3650f88f79cbe094797cbdc4b151254710e801f0661
SHA512f337b799da7b4fbe19a229e42b4720dac9130b928441750141ae33fa231b55099f7e3d619a0e3b081f1a53e9a8d611762ed4afeffdb3b42692ae258b6bdf9647
-
Filesize
85B
MD584e7de25b954e4383eca4cf4292f9487
SHA1b3a11c94067e85d663a24c8b56a5792574c19d53
SHA256f05513b5ae703bc9f4660a06fc3b41a7b90b36128ee5475661f029abbbc0b609
SHA512a1b4c43989d41e03d1e2a0e9c5a8b39953d990138cd50eb6bd9efe4843594f1d98654fd41e15793a7795e90a31f3c648bded6c180a53846856d04b0a8bf17f28
