Analysis
-
max time kernel
140s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26-01-2024 11:28
Behavioral task
behavioral1
Sample
829567da24356078abb1ff8beb1b53e460cb4f1d67fab2b1d605912b8b7c438c.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
829567da24356078abb1ff8beb1b53e460cb4f1d67fab2b1d605912b8b7c438c.exe
Resource
win10v2004-20231222-en
General
-
Target
829567da24356078abb1ff8beb1b53e460cb4f1d67fab2b1d605912b8b7c438c.exe
-
Size
108KB
-
MD5
98cbe8668a8e12416cb4dd7041ae5a1f
-
SHA1
2bfea256de980a9faeada753725b9bcb368efcd8
-
SHA256
e1a5558088d6f241331f2f443e098f8293c14843d580a1e0971dbde7ff2e6c6c
-
SHA512
54413adf88c300d372f3cfe6c057f204d2a70a714ec84dbe566e2c32475774518c89a584954da6a55e338d0b0e5338456b969f6b472bfab310c44bac32f64d77
-
SSDEEP
1536:lqEA70HzLJksPEOajozLElnqiO2+dgPb:lXTLJkQ7zAV3XPb
Malware Config
Extracted
gh0strat
p.f2pool.info
Signatures
-
Gh0st RAT payload 1 IoCs
Processes:
resource yara_rule \Windows\SysWOW64\259416620.dll family_gh0strat -
RunningRat
RunningRat is a remote access trojan first seen in 2018.
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
Processes:
829567da24356078abb1ff8beb1b53e460cb4f1d67fab2b1d605912b8b7c438c.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\serivces\Parameters\ServiceDll = "C:\\Windows\\system32\\259416620.dll" 829567da24356078abb1ff8beb1b53e460cb4f1d67fab2b1d605912b8b7c438c.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2688 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
serivces.exepid process 2928 serivces.exe -
Loads dropped DLL 7 IoCs
Processes:
829567da24356078abb1ff8beb1b53e460cb4f1d67fab2b1d605912b8b7c438c.exesvchost.exeserivces.exepid process 3028 829567da24356078abb1ff8beb1b53e460cb4f1d67fab2b1d605912b8b7c438c.exe 2712 svchost.exe 2712 svchost.exe 2928 serivces.exe 2928 serivces.exe 2928 serivces.exe 2928 serivces.exe -
Creates a Windows Service
-
Drops file in System32 directory 3 IoCs
Processes:
svchost.exe829567da24356078abb1ff8beb1b53e460cb4f1d67fab2b1d605912b8b7c438c.exedescription ioc process File created C:\Windows\SysWOW64\serivces.exe svchost.exe File opened for modification C:\Windows\SysWOW64\serivces.exe svchost.exe File created C:\Windows\SysWOW64\259416620.dll 829567da24356078abb1ff8beb1b53e460cb4f1d67fab2b1d605912b8b7c438c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
829567da24356078abb1ff8beb1b53e460cb4f1d67fab2b1d605912b8b7c438c.exepid process 3028 829567da24356078abb1ff8beb1b53e460cb4f1d67fab2b1d605912b8b7c438c.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
829567da24356078abb1ff8beb1b53e460cb4f1d67fab2b1d605912b8b7c438c.exedescription pid process Token: SeIncBasePriorityPrivilege 3028 829567da24356078abb1ff8beb1b53e460cb4f1d67fab2b1d605912b8b7c438c.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
829567da24356078abb1ff8beb1b53e460cb4f1d67fab2b1d605912b8b7c438c.exepid process 3028 829567da24356078abb1ff8beb1b53e460cb4f1d67fab2b1d605912b8b7c438c.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
829567da24356078abb1ff8beb1b53e460cb4f1d67fab2b1d605912b8b7c438c.execmd.exesvchost.exedescription pid process target process PID 3028 wrote to memory of 2688 3028 829567da24356078abb1ff8beb1b53e460cb4f1d67fab2b1d605912b8b7c438c.exe cmd.exe PID 3028 wrote to memory of 2688 3028 829567da24356078abb1ff8beb1b53e460cb4f1d67fab2b1d605912b8b7c438c.exe cmd.exe PID 3028 wrote to memory of 2688 3028 829567da24356078abb1ff8beb1b53e460cb4f1d67fab2b1d605912b8b7c438c.exe cmd.exe PID 3028 wrote to memory of 2688 3028 829567da24356078abb1ff8beb1b53e460cb4f1d67fab2b1d605912b8b7c438c.exe cmd.exe PID 2688 wrote to memory of 2880 2688 cmd.exe PING.EXE PID 2688 wrote to memory of 2880 2688 cmd.exe PING.EXE PID 2688 wrote to memory of 2880 2688 cmd.exe PING.EXE PID 2688 wrote to memory of 2880 2688 cmd.exe PING.EXE PID 2712 wrote to memory of 2928 2712 svchost.exe serivces.exe PID 2712 wrote to memory of 2928 2712 svchost.exe serivces.exe PID 2712 wrote to memory of 2928 2712 svchost.exe serivces.exe PID 2712 wrote to memory of 2928 2712 svchost.exe serivces.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\829567da24356078abb1ff8beb1b53e460cb4f1d67fab2b1d605912b8b7c438c.exe"C:\Users\Admin\AppData\Local\Temp\829567da24356078abb1ff8beb1b53e460cb4f1d67fab2b1d605912b8b7c438c.exe"1⤵
- Sets DLL path for service in the registry
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\Admin\AppData\Local\Temp\829567da24356078abb1ff8beb1b53e460cb4f1d67fab2b1d605912b8b7c438c.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 13⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "serivces"1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "serivces"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\serivces.exeC:\Windows\system32\serivces.exe "c:\windows\system32\259416620.dll",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Windows\SysWOW64\259416620.dllFilesize
37KB
MD5930fe8d5aca539f7b32d2bd1b0bffcff
SHA12061bb9069cef64c98da6339b82d356a5991415c
SHA25656d548aed25b26a26990a4985272fd466bc44b67fd6269d6af3f7e7c2ae7b1a5
SHA512aac894efb15048b47995faec9c26171508142374e1e032d183dc17eae88d56e92c4a1c85c024b60e0db97c7699f54e2640f071aa1655f863143a2d9be81055f5
-
\Windows\SysWOW64\serivces.exeFilesize
43KB
MD551138beea3e2c21ec44d0932c71762a8
SHA18939cf35447b22dd2c6e6f443446acc1bf986d58
SHA2565ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d