Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
28/01/2024, 00:29
Behavioral task
behavioral1
Sample
7bae42064e90876fa11196bc204e5574.exe
Resource
win7-20231215-en
windows7-x64
General
-
Target
7bae42064e90876fa11196bc204e5574.exe
-
Size
138KB
-
MD5
7bae42064e90876fa11196bc204e5574
-
SHA1
379552396e31c91289a3a3ab9fcfc986b9ee02fa
-
SHA256
75663081d185025938ac1882d493f7ceca553aeaf020b0a7b76d19b5a5d1f186
-
SHA512
de029a8828184d62260697c30741c2915d7d00dff8970530423bdb3017a05e594112b49e1d444e19214e4711aa2f138fbf3a08d64e22649ae7446a50bd0662d8
-
SSDEEP
3072:AUqPeqovH7Wbwx0uPneIxypSmOePK4Nk7rybZuwY1Z:AUaeqoiGeIxQrKgQGZuwY
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
resource yara_rule behavioral2/files/0x00070000000231fa-3.dat family_gh0strat behavioral2/files/0x000d000000023119-12.dat family_gh0strat -
Loads dropped DLL 2 IoCs
pid Process 3100 7bae42064e90876fa11196bc204e5574.exe 1596 svchost.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\FileName.jpg 7bae42064e90876fa11196bc204e5574.exe File created C:\Windows\FileName.jpg 7bae42064e90876fa11196bc204e5574.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe -
Suspicious behavior: LoadsDriver 6 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 3100 7bae42064e90876fa11196bc204e5574.exe Token: SeRestorePrivilege 3100 7bae42064e90876fa11196bc204e5574.exe Token: SeBackupPrivilege 3100 7bae42064e90876fa11196bc204e5574.exe Token: SeRestorePrivilege 3100 7bae42064e90876fa11196bc204e5574.exe Token: SeBackupPrivilege 3100 7bae42064e90876fa11196bc204e5574.exe Token: SeRestorePrivilege 3100 7bae42064e90876fa11196bc204e5574.exe Token: SeBackupPrivilege 3100 7bae42064e90876fa11196bc204e5574.exe Token: SeRestorePrivilege 3100 7bae42064e90876fa11196bc204e5574.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7bae42064e90876fa11196bc204e5574.exe"C:\Users\Admin\AppData\Local\Temp\7bae42064e90876fa11196bc204e5574.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3100
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1596
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105KB
MD5416177d74aab0469963377b02cdbb49c
SHA119398899b3e97194d4ef59f531758b7970bc9f82
SHA256baff8f04977f0511ccfb0336622298aced89c8987acade9b985f69b2c17de91e
SHA512316a58b320631fbcac7ce2055ce996e58653a7edc0e199f9be5268349619df4cacdec0bbf3360ba17ed996fce62d52d3ffc45e850befb117e2439ca94c4af069
-
Filesize
4.4MB
MD58037d6c5e4f92de4c8f86c8bc764daf8
SHA143011f2d0ac893703c1d3b79ca03ba4af4355fad
SHA256858034d77d77f45d2242dba93a4edd07fb09c48cf80f5f4b3ba605c10093b5da
SHA512837c72dc47e90dea583895145cd2e6cdb03f73e4004916c1edc406f0f6630253332efcdc58a6469dc992d0095da8818a95d150bb80c851e0e2cfd7e50884c9d2
