Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 17:19
Static task
static1
Behavioral task
behavioral1
Sample
a3cace651438d9a28198010f4a4352e65b9301d5106c7087a48eb329dfe9552e.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
a3cace651438d9a28198010f4a4352e65b9301d5106c7087a48eb329dfe9552e.exe
Resource
win10v2004-20240426-en
General
-
Target
a3cace651438d9a28198010f4a4352e65b9301d5106c7087a48eb329dfe9552e.exe
-
Size
1.2MB
-
MD5
95cedef4b8492769934502aa8347d4f8
-
SHA1
ed871d8bac626be91f9bab49745e6be458b9b2f7
-
SHA256
a3cace651438d9a28198010f4a4352e65b9301d5106c7087a48eb329dfe9552e
-
SHA512
c5040b8f24fb12ca1e52a0ec4255857e455db4dff6c212ae470846c13abe33c6472515466e7f051567d487916aabe30f3188d6632aa4f380f47a4e8cf76a88c5
-
SSDEEP
24576:TEdksIGN71VVbzYEL+5dNmZG8RRl9T7tmMKTM6I9B7:TEywVVvUji3TsMKTM6Y7
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
Processes:
resource yara_rule C:\Windows\SysWOW64\240593265.bat family_gh0strat -
Sets DLL path for service in the registry 2 TTPs 1 IoCs
Processes:
GLk.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\svchist\Parameters\ServiceDll = "C:\\Windows\\system32\\240593265.bat" GLk.exe -
Executes dropped EXE 2 IoCs
Processes:
GLk.exesvchist.exepid process 2208 GLk.exe 4840 svchist.exe -
Loads dropped DLL 3 IoCs
Processes:
GLk.exesvchost.exesvchist.exepid process 2208 GLk.exe 4856 svchost.exe 4840 svchist.exe -
Drops file in System32 directory 4 IoCs
Processes:
GLk.exesvchost.exedescription ioc process File created C:\Windows\SysWOW64\240593265.bat GLk.exe File opened for modification C:\Windows\SysWOW64\ini.ini GLk.exe File created C:\Windows\SysWOW64\svchist.exe svchost.exe File opened for modification C:\Windows\SysWOW64\svchist.exe svchost.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
a3cace651438d9a28198010f4a4352e65b9301d5106c7087a48eb329dfe9552e.exepid process 4412 a3cace651438d9a28198010f4a4352e65b9301d5106c7087a48eb329dfe9552e.exe 4412 a3cace651438d9a28198010f4a4352e65b9301d5106c7087a48eb329dfe9552e.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
a3cace651438d9a28198010f4a4352e65b9301d5106c7087a48eb329dfe9552e.exesvchost.exedescription pid process target process PID 4412 wrote to memory of 2208 4412 a3cace651438d9a28198010f4a4352e65b9301d5106c7087a48eb329dfe9552e.exe GLk.exe PID 4412 wrote to memory of 2208 4412 a3cace651438d9a28198010f4a4352e65b9301d5106c7087a48eb329dfe9552e.exe GLk.exe PID 4412 wrote to memory of 2208 4412 a3cace651438d9a28198010f4a4352e65b9301d5106c7087a48eb329dfe9552e.exe GLk.exe PID 4856 wrote to memory of 4840 4856 svchost.exe svchist.exe PID 4856 wrote to memory of 4840 4856 svchost.exe svchist.exe PID 4856 wrote to memory of 4840 4856 svchost.exe svchist.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3cace651438d9a28198010f4a4352e65b9301d5106c7087a48eb329dfe9552e.exe"C:\Users\Admin\AppData\Local\Temp\a3cace651438d9a28198010f4a4352e65b9301d5106c7087a48eb329dfe9552e.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\GLk.exeC:\Users\Admin\AppData\Local\Temp\\GLk.exe2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2208
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "svchist"1⤵PID:1168
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "svchist"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\svchist.exeC:\Windows\system32\svchist.exe "c:\windows\system32\240593265.bat",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4840
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\GLk.exeFilesize
337KB
MD5b8e58a96761799f4ad0548dba39d650c
SHA1c00032d40cfbe4ccfd3ce3e4c8defb2a2ef9fc1f
SHA256334e8e7c65b087985766d652f70b710bdba6aea55a2fa17b97ba2961e8eee9df
SHA5121cd94994ed3f6594e37e6cd1d266ff96bb37c5e99d9ce6fd4637ed615ee8c6496b54a025fdccced6fca200f8f2da8011177c67c943676b30bfb0655393765fe3
-
C:\Users\Admin\AppData\Local\Temp\HD_X.datFilesize
1.2MB
MD595cedef4b8492769934502aa8347d4f8
SHA1ed871d8bac626be91f9bab49745e6be458b9b2f7
SHA256a3cace651438d9a28198010f4a4352e65b9301d5106c7087a48eb329dfe9552e
SHA512c5040b8f24fb12ca1e52a0ec4255857e455db4dff6c212ae470846c13abe33c6472515466e7f051567d487916aabe30f3188d6632aa4f380f47a4e8cf76a88c5
-
C:\Windows\SysWOW64\240593265.batFilesize
51KB
MD595dc3f17fb66a45e504e8db1d69cf99c
SHA15a450b29134937b6fb45a59c5481b4c9b82e0950
SHA256477a382a28ab1b53d6132bb75afafc9879ef24d8ca7aa5672a193dd435b84d83
SHA5122eba18e4c73420c3325c854e24fa5e5fec151babc9c5ad288454c73adc3f5aebfaa5e7867af8b6e03473aa08335a4f4803cf3d51f64d7f7884f0baac1fef3346
-
C:\Windows\SysWOW64\svchist.exeFilesize
60KB
MD5889b99c52a60dd49227c5e485a016679
SHA18fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA2566cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA51208933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641