Analysis
-
max time kernel
600s -
max time network
577s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
23-02-2024 00:40
General
-
Target
0.exe
-
Size
71KB
-
MD5
2a9d0d06d292a4cbbe4a95da4650ed54
-
SHA1
44c32dfae9ac971c3651adbd82c821971a5400dc
-
SHA256
09a1c17ac55cde962b4f3bcd61140d752d86362296ee74736000a6a647c73d8c
-
SHA512
ed15670a18bffa1c5c1d79f1a5a653d6b2bde649164c955473580321f4ab3d048124c26e1a92e9d8ba0edaf754617d2d2c13d8db92323e09957b6de225b5314d
-
SSDEEP
1536:jWZpTtLcWyeYd4//yEZc1GJf7/QP4uirySj5e:+pZTvnyEZiGJ7/QguiryS5e
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
Processes:
resource yara_rule C:\2158400.dll family_gh0strat \??\c:\windows\filename.jpg family_gh0strat -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 1552 svchost.exe -
Loads dropped DLL 2 IoCs
Processes:
0.exesvchost.exepid process 4072 0.exe 1552 svchost.exe -
Drops file in Windows directory 2 IoCs
Processes:
0.exedescription ioc process File opened for modification C:\Windows\FileName.jpg 0.exe File created C:\Windows\FileName.jpg 0.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe -
Suspicious behavior: LoadsDriver 6 IoCs
Processes:
pid 4 4 4 4 4 676 -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
0.exedescription pid process Token: SeBackupPrivilege 4072 0.exe Token: SeRestorePrivilege 4072 0.exe Token: SeBackupPrivilege 4072 0.exe Token: SeRestorePrivilege 4072 0.exe Token: SeBackupPrivilege 4072 0.exe Token: SeRestorePrivilege 4072 0.exe Token: SeBackupPrivilege 4072 0.exe Token: SeRestorePrivilege 4072 0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0.exe"C:\Users\Admin\AppData\Local\Temp\0.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Deletes itself
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\2158400.dllFilesize
64KB
MD545dc749351fd65d71da89ca2ed2766cb
SHA1e080faf81157b7f867cb56938c5e579c206af9b9
SHA256391109432ba2df9f3ebc74e0144f42a490405f7c8ecb51da01b4ce793be72f25
SHA5127e63d8778a4656a19397849a6edb483993f1183257fb8c0793ad4b5c625ed69d1b9472969bac6dfc98938e19baed7e3e61ab80085a1a6edd8a50ca660ce3bf74
-
\??\c:\NT_Path.jpgFilesize
54B
MD5775d025811b2ca4241d54d22f67883d9
SHA1bc2e6b76e9dd5b2d9c2dcf0e68f54e46e248da1d
SHA2568daa53415eea1758c851024363a017856fa8d30e7a75f807ce46e80354043e32
SHA512ff37abd04b7d863c5a33aa5ab4757964bf854aa8af8b064ca5409f11a37c20ed0eaabeedefb343aa7a81cda2864cb2057eb5b96bfa5ed6c0a74a2dac7deb6867
-
\??\c:\windows\filename.jpgFilesize
5.6MB
MD5373d131a97ac86a0d6f428c27aa6b11c
SHA1d635eaeafd7b8f578493f37878a1e97e6fce28b8
SHA2561f22c03a8be99d090358cc6351e45b28113b1848fee06d0355b4cbdbfc4ae666
SHA51256d6fd87e4a1df705540d7f02fb2d99a4a116e82f08ca98e0ad823fa3d9d3a1ce01084b8f0c8e1b6b2f16b37d2b9976e5c101b528eaef735357f3046effb6897