Analysis
- max time kernel
140s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
10/05/2024, 04:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
eee4e4205df7ec3a29a3815ed3fc10c4b2efbdd5b5d55d3b21de530cdaa0f479.exe
Resource
win7-20240220-en
windows7-x64
11 signatures
150 seconds
General
- Target eee4e4205df7ec3a29a3815ed3fc10c4b2efbdd5b5d55d3b21de530cdaa0f479.exe
- Size 1.9MB
- Sample240510-e6nvrsee66
- SHA256 eee4e4205df7ec3a29a3815ed3fc10c4b2efbdd5b5d55d3b21de530cdaa0f479
- MD5 091779ad3d7924dc40ad20f3568c3159
- SHA1 7dc6e861d64bbdbdc5735809fcf75b03644434ed
- SHA512 ce17ba21f2eeb7ce24def92a7390c5bcfebe39c670cb7518df45d4f11f06c3fe5fba4405501c1e99bc4f14000588964cc80bc94d31864cbf8d70fa9c4b3dcf40
- SSDEEP 49152:+ug+S44ZGJ6ELP0Qx3Bvw5213X3ElAVUoNKXXltOIDB6BaalkWqod:+L4jJ6ED0Qx3K213X0lAVUoNKnuIcllj
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Gh0st RAT payload 2 IoCs
resource yara_rule behavioral2/memory/4016-42-0x0000000010000000-0x000000001007B000-memory.dmp family_gh0strat behavioral2/memory/4016-59-0x00000000023B0000-0x0000000002446000-memory.dmp family_gh0strat - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation eee4e4205df7ec3a29a3815ed3fc10c4b2efbdd5b5d55d3b21de530cdaa0f479.exe - Executes dropped EXE 1 IoCs
pid Process 4016 tapisrv.exe - Loads dropped DLL 4 IoCs
pid Process 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe - Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: tapisrv.exe File opened (read-only) \??\J: tapisrv.exe File opened (read-only) \??\L: tapisrv.exe File opened (read-only) \??\N: tapisrv.exe File opened (read-only) \??\W: tapisrv.exe File opened (read-only) \??\Y: tapisrv.exe File opened (read-only) \??\G: tapisrv.exe File opened (read-only) \??\H: tapisrv.exe File opened (read-only) \??\U: tapisrv.exe File opened (read-only) \??\R: tapisrv.exe File opened (read-only) \??\S: tapisrv.exe File opened (read-only) \??\T: tapisrv.exe File opened (read-only) \??\Z: tapisrv.exe File opened (read-only) \??\K: tapisrv.exe File opened (read-only) \??\M: tapisrv.exe File opened (read-only) \??\P: tapisrv.exe File opened (read-only) \??\O: tapisrv.exe File opened (read-only) \??\Q: tapisrv.exe File opened (read-only) \??\V: tapisrv.exe File opened (read-only) \??\B: tapisrv.exe File opened (read-only) \??\E: tapisrv.exe File opened (read-only) \??\I: tapisrv.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 34 pastebin.com 36 pastebin.com - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 tapisrv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz tapisrv.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe 4016 tapisrv.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 996 eee4e4205df7ec3a29a3815ed3fc10c4b2efbdd5b5d55d3b21de530cdaa0f479.exe 996 eee4e4205df7ec3a29a3815ed3fc10c4b2efbdd5b5d55d3b21de530cdaa0f479.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 996 wrote to memory of 4016 996 eee4e4205df7ec3a29a3815ed3fc10c4b2efbdd5b5d55d3b21de530cdaa0f479.exe 95 PID 996 wrote to memory of 4016 996 eee4e4205df7ec3a29a3815ed3fc10c4b2efbdd5b5d55d3b21de530cdaa0f479.exe 95 PID 996 wrote to memory of 4016 996 eee4e4205df7ec3a29a3815ed3fc10c4b2efbdd5b5d55d3b21de530cdaa0f479.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\eee4e4205df7ec3a29a3815ed3fc10c4b2efbdd5b5d55d3b21de530cdaa0f479.exe"C:\Users\Admin\AppData\Local\Temp\eee4e4205df7ec3a29a3815ed3fc10c4b2efbdd5b5d55d3b21de530cdaa0f479.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Users\Public\McAfee\tapisrv.exe"C:\Users\Public\McAfee\tapisrv.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4016
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Public\McAfee\donottrace.txt
- Size 576KB
- SHA256 9fae71b55d1843922f546bd4666406c9128329711417e2e6209a4ea1ecd52549
- MD5 679fe10aa7275641c731a6f14b5cbf5f
- SHA1 c5e5dede8cd779194d635ed003e3a62feade4f3e
- SHA512 c2b15709cedc17c33c748d31230dbf7e1630ca9b8c12152bdc931af5df5dc1eab8848bb67a6e6fb2c062198a43e157fb496a2a1e854cfcd7ee480de1bd29bce0
- SSDEEP 12288:5Wq8RHk6bPOH+V3jlfXoEH+J2oVU01GMjyZcKD+uZrhDNN:5MJbbR/fX+goV/GURKD+uxN
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Public\McAfee\libcurl.dll
- Size 377KB
- SHA256 c5bd8abdd303b97058d64df143ff96486248ee1279dacabebfef7be4c9181a7b
- MD5 4d7d113ab66c2d643d500dcac1552439
- SHA1 9abc74459102955d3994be09f26b12c592ca6a35
- SHA512 e0b4fea22d2eec9c2b1d4ff0b7ce703a35b5c3a6cf75aa8b654bcd01a529330f0c0c973eccae24214d22d0cbd27b64110a98e9c5a8aeba98713ec2c93d9fd668
- SSDEEP 6144:rKzCBBZcvw7UWm3fIWjZAQI2bZ7QaIQR7+elAZtgcgXDfqbAGi87F1yZohMzMxBw:LWvw73m3fIWjZAQI2bZcaIQR7+elAZt4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Public\McAfee\msvcp100.dll
- Size 411KB
- SHA256 b2ad109c15eaa92079582787b7772ba0a2f034f7d075907ff87028df0eaea671
- MD5 bc83108b18756547013ed443b8cdb31b
- SHA1 79bcaad3714433e01c7f153b05b781f8d7cb318d
- SHA512 6e72b2d40e47567b3e506be474dafa7cacd0b53cd2c2d160c3b5384f2f461fc91bb5fdb614a351f628d4e516b3bbdabc2cc6d4cb4710970146d2938a687dd011
- SSDEEP 12288:Seb8zxr1aWPaHX7dGP5frhUgiW6QR7t5qv3Ooc8UHkC2e7wx:Seb8Fpa6aHX7dGP5Gv3Ooc8UHkC2ekx
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Public\McAfee\msvcr100.dll
- Size 755KB
- SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
- MD5 0e37fbfa79d349d672456923ec5fbbe3
- SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
- SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
- SSDEEP 12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Public\McAfee\tapisrv.dat
- Size 61B
- SHA256 63082cf91ef670f97946e226dc8a48025ce142acd0e0afb9aa5a7eb0e96fe88d
- MD5 20d2e854d2b77d40486bbaa10694e857
- SHA1 66f9c6aa8d74152470053566029f075c40949b87
- SHA512 e08c11856d9b69c57dac8a505bb75fa472675fb7a730da5559d794cc7e16da0f06a2a380197dcf70ac17fad0f85e8141ac72605088022b0a509518fdfb15828e
- MD5 SHA1 SHA512
- Path C:\Users\Public\McAfee\tapisrv.exe
- Size 588KB
- SHA256 b63c0d7ca4501b0588b435f23578755b05057da59e9d62fa30203fe9b062b852
- MD5 d1fa4514de25b0566255cedf7d060942
- SHA1 868ec8ea80edeb8b4e7b1d3c965d4b8ce8221bf8
- SHA512 942f9713ac22f100c1bbc4e389ab84b1b1ba013af7dcb5f5635e06942670077a588fdb45826b5d054c654ca1fdba391194d149fd3f2a90e26f27d5dc44a765b3
- SSDEEP 12288:0Hv7sEbPxwuLpDkAOwZ6CPr4hgZc1nygq/8:0HrbaUOBCPragZc1ygq/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Public\McAfee\task.dat
- Size 78B
- SHA256 62d2e1553fd5d99b3b5c890978543312be3ae30d846490dc2d9a2b7b6f83c69c
- MD5 76ffd1d4c7b2b5bf292c6af21674647c
- SHA1 3a5e672d2904a370fd6cc4d0eae4a42fa3a48d17
- SHA512 8f5cfeaf1f4e06dec237df334021bdb488812ae5d2972f0ed9fcd6d7a55f17c45893e963e1b30ddef0661f94f8a2a28ed0cc4647d9d9ea6e3d53e322a0dafd59
- MD5 SHA1 SHA512