Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 03:03
Static task
static1
Behavioral task
behavioral1
Sample
1caf02f40057db3c21b0d0a69265a3eba23f9581091bbc3a581b0ed964c1a072.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
1caf02f40057db3c21b0d0a69265a3eba23f9581091bbc3a581b0ed964c1a072.exe
Resource
win10v2004-20240508-en
General
-
Target
1caf02f40057db3c21b0d0a69265a3eba23f9581091bbc3a581b0ed964c1a072.exe
-
Size
5.5MB
-
MD5
55dae4a8fe92a740d96600292eaa8e02
-
SHA1
de9df7080e7544e82a6d4e75e4a5b683ced264ff
-
SHA256
1caf02f40057db3c21b0d0a69265a3eba23f9581091bbc3a581b0ed964c1a072
-
SHA512
bb28ef8763b897796e51693caabd08491b47dcf02c8b1721c07c0e77c29315a491ce626d98c8dc61ef6c2879c2ec773c87af12bb3754e0074a9157564c529d48
-
SSDEEP
98304:y2SVMD8qnlEwmrf1LLwfQmaHMFykCHdyFmXBSimMWt86dPLifj4GTMQ:CAnlETrfZwGHCGHdfXB0zxzifs0V
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
Processes:
resource yara_rule C:\Windows\SysWOW64\240601656.bat family_gh0strat -
Sets DLL path for service in the registry 2 TTPs 1 IoCs
Processes:
look2.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\svchcst\Parameters\ServiceDll = "C:\\Windows\\system32\\240601656.bat" look2.exe -
Executes dropped EXE 3 IoCs
Processes:
look2.exeHD_1caf02f40057db3c21b0d0a69265a3eba23f9581091bbc3a581b0ed964c1a072.exesvchcst.exepid process 1484 look2.exe 1152 HD_1caf02f40057db3c21b0d0a69265a3eba23f9581091bbc3a581b0ed964c1a072.exe 4820 svchcst.exe -
Loads dropped DLL 3 IoCs
Processes:
look2.exesvchost.exesvchcst.exepid process 1484 look2.exe 836 svchost.exe 4820 svchcst.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Drops file in System32 directory 4 IoCs
Processes:
look2.exesvchost.exedescription ioc process File created C:\Windows\SysWOW64\240601656.bat look2.exe File opened for modification C:\Windows\SysWOW64\ini.ini look2.exe File created C:\Windows\SysWOW64\svchcst.exe svchost.exe File opened for modification C:\Windows\SysWOW64\svchcst.exe svchost.exe -
Drops file in Program Files directory 1 IoCs
Processes:
1caf02f40057db3c21b0d0a69265a3eba23f9581091bbc3a581b0ed964c1a072.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 1caf02f40057db3c21b0d0a69265a3eba23f9581091bbc3a581b0ed964c1a072.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
1caf02f40057db3c21b0d0a69265a3eba23f9581091bbc3a581b0ed964c1a072.exepid process 1872 1caf02f40057db3c21b0d0a69265a3eba23f9581091bbc3a581b0ed964c1a072.exe 1872 1caf02f40057db3c21b0d0a69265a3eba23f9581091bbc3a581b0ed964c1a072.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
1caf02f40057db3c21b0d0a69265a3eba23f9581091bbc3a581b0ed964c1a072.exejavaw.exepid process 1872 1caf02f40057db3c21b0d0a69265a3eba23f9581091bbc3a581b0ed964c1a072.exe 1872 1caf02f40057db3c21b0d0a69265a3eba23f9581091bbc3a581b0ed964c1a072.exe 2248 javaw.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
1caf02f40057db3c21b0d0a69265a3eba23f9581091bbc3a581b0ed964c1a072.exeHD_1caf02f40057db3c21b0d0a69265a3eba23f9581091bbc3a581b0ed964c1a072.exejavaw.exesvchost.exedescription pid process target process PID 1872 wrote to memory of 1484 1872 1caf02f40057db3c21b0d0a69265a3eba23f9581091bbc3a581b0ed964c1a072.exe look2.exe PID 1872 wrote to memory of 1484 1872 1caf02f40057db3c21b0d0a69265a3eba23f9581091bbc3a581b0ed964c1a072.exe look2.exe PID 1872 wrote to memory of 1484 1872 1caf02f40057db3c21b0d0a69265a3eba23f9581091bbc3a581b0ed964c1a072.exe look2.exe PID 1872 wrote to memory of 1152 1872 1caf02f40057db3c21b0d0a69265a3eba23f9581091bbc3a581b0ed964c1a072.exe HD_1caf02f40057db3c21b0d0a69265a3eba23f9581091bbc3a581b0ed964c1a072.exe PID 1872 wrote to memory of 1152 1872 1caf02f40057db3c21b0d0a69265a3eba23f9581091bbc3a581b0ed964c1a072.exe HD_1caf02f40057db3c21b0d0a69265a3eba23f9581091bbc3a581b0ed964c1a072.exe PID 1872 wrote to memory of 1152 1872 1caf02f40057db3c21b0d0a69265a3eba23f9581091bbc3a581b0ed964c1a072.exe HD_1caf02f40057db3c21b0d0a69265a3eba23f9581091bbc3a581b0ed964c1a072.exe PID 1152 wrote to memory of 2248 1152 HD_1caf02f40057db3c21b0d0a69265a3eba23f9581091bbc3a581b0ed964c1a072.exe javaw.exe PID 1152 wrote to memory of 2248 1152 HD_1caf02f40057db3c21b0d0a69265a3eba23f9581091bbc3a581b0ed964c1a072.exe javaw.exe PID 2248 wrote to memory of 3648 2248 javaw.exe icacls.exe PID 2248 wrote to memory of 3648 2248 javaw.exe icacls.exe PID 2248 wrote to memory of 1688 2248 javaw.exe cmd.exe PID 2248 wrote to memory of 1688 2248 javaw.exe cmd.exe PID 836 wrote to memory of 4820 836 svchost.exe svchcst.exe PID 836 wrote to memory of 4820 836 svchost.exe svchcst.exe PID 836 wrote to memory of 4820 836 svchost.exe svchcst.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1caf02f40057db3c21b0d0a69265a3eba23f9581091bbc3a581b0ed964c1a072.exe"C:\Users\Admin\AppData\Local\Temp\1caf02f40057db3c21b0d0a69265a3eba23f9581091bbc3a581b0ed964c1a072.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\look2.exeC:\Users\Admin\AppData\Local\Temp\\look2.exe2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Local\Temp\HD_1caf02f40057db3c21b0d0a69265a3eba23f9581091bbc3a581b0ed964c1a072.exeC:\Users\Admin\AppData\Local\Temp\HD_1caf02f40057db3c21b0d0a69265a3eba23f9581091bbc3a581b0ed964c1a072.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jdk-1.8\bin\javaw.exe"C:\Program Files\Java\jdk-1.8\bin\javaw.exe" -XX:MinHeapFreeRatio=5 -XX:MaxHeapFreeRatio=15 -jar "HD_1caf02f40057db3c21b0d0a69265a3eba23f9581091bbc3a581b0ed964c1a072.exe"3⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M4⤵
- Modifies file permissions
-
C:\Windows\SYSTEM32\cmd.execmd ver4⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "svchcst"1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "svchcst"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchcst.exeC:\Windows\system32\svchcst.exe "c:\windows\system32\240601656.bat",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Oracle\Java\.oracle_jre_usage\905ebba3a8fc8cc.timestampFilesize
50B
MD59323fc6e4654947c5f28d2129c8ca115
SHA1eb1784d9bacfacdc2812392e6a1bbe3d8edd0eb0
SHA256d033af99dd308b9e4c79adcaba9fd27292a79db2b6a3e41621e69356b7559d01
SHA5127fd910f08b932cf19a32b83d5ce6c614f7a8db3e3093f2b4ecb710527a2ed8502d4ed982834801f133513944a564367296fec7183e1ccee3a0e4b8067d573b5e
-
C:\Users\Admin\AppData\Local\Temp\HD_1caf02f40057db3c21b0d0a69265a3eba23f9581091bbc3a581b0ed964c1a072.exeFilesize
4.3MB
MD5b8bbba8cd778e2dae662aadd3f7c8a3f
SHA1b416350bd1f6d23e69b7b7ef7a4b69b7110d79bd
SHA256bd34d38fe56f0ed1337fedad96a4bb97a1ee1e5288766596d2e28c36e9e31924
SHA512abc83ac1d11d140236dcccd806d3546b1d46ec39d89e2dcbabe16352ca21d744b9dece7ecb602f09f0c193c3550c91c579251ea6013a0946a8b499f683966967
-
C:\Users\Admin\AppData\Local\Temp\HD_X.datFilesize
1.2MB
MD588131271b3a719be9922d80c187e95e8
SHA1b33b339db8ee42574c9a75d0399efbc899f06fc5
SHA256777305359ecceb2fa9e18e6202ce68571c7264a5cc87df8d8a538da49db576fe
SHA512b3e8d51ffadd6250e2848ef05c555d4c7b298b9cf38fe21f2860d5105f09b85d0ddd35cfdc5aeb3848053693d75a5656da093359e530135cfa4def69cf785e87
-
C:\Users\Admin\AppData\Local\Temp\hmcl.jsonFilesize
791B
MD5f5c6f3a15173a7b7161749176de5f4ff
SHA104bd484d9fe52c08c14c77b9792c512bf4802b40
SHA256ddf8a727518cb0ebc0173bb3c4104fbeb0d8ff45690a1cf8f00af7fc6d62a74d
SHA51206878a5bf3d8935f1334bab6181c7d6271d1a4a3fd4dc7b548f39f2a08ba660056439509425e4ed02d1677aa4913159db36469862a1116f0bfbd768be9d26d2f
-
C:\Users\Admin\AppData\Local\Temp\hmcl.jsonFilesize
798B
MD51f7e03f82a12064b503e789e266bb69f
SHA1b6568bbfb94687850396e239e1d7c761f213bc44
SHA2561024b17adb2c5d80f01d583380ab4dd03d9a716f450057391ac89bf7ad504a2e
SHA51200bc727c0774f5b17746d219be65fc16ffe61c16bdef0fe388d4b34131028d39052c357c3cf24b455ac6d66b34f7360b93667ec8b754e317eb889d0f6703b7a0
-
C:\Users\Admin\AppData\Local\Temp\look2.exeFilesize
337KB
MD52f3b6f16e33e28ad75f3fdaef2567807
SHA185e907340faf1edfc9210db85a04abd43d21b741
SHA25686492ebf2d6f471a5ee92977318d099b3ea86175b5b7ae522237ae01d07a4857
SHA512db17e99e2df918cfc9ccbe934adfe73f0777ce1ce9f28b57a4b24ecd821efe2e0b976a634853247b77b16627d2bb3af4ba20306059d1d25ef38ffada7da3e3a4
-
C:\Windows\SysWOW64\240601656.batFilesize
51KB
MD5ee7f0036a2a8dde6a5ed71426641f119
SHA1e705ec30778734574f432e74d616f0ed4425178e
SHA256892238ddeac8a805198eee018e761c977ce886042dbd3abd2bfb438a4ef69888
SHA51203f6473b6faad33050bb33a51de142ce88115a3947b7017c58abf5f5042cc1d8ba927a48acde75927a660a3b5cebc4298121e3bbc39853810017e70f9ef886ee
-
C:\Windows\SysWOW64\svchcst.exeFilesize
60KB
MD5889b99c52a60dd49227c5e485a016679
SHA18fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA2566cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA51208933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
-
memory/2248-137-0x0000020FF6030000-0x0000020FF6031000-memory.dmpFilesize
4KB
-
memory/2248-121-0x0000020FF6030000-0x0000020FF6031000-memory.dmpFilesize
4KB
-
memory/2248-113-0x0000020FF6030000-0x0000020FF6031000-memory.dmpFilesize
4KB
-
memory/2248-167-0x0000020FF6030000-0x0000020FF6031000-memory.dmpFilesize
4KB
-
memory/2248-173-0x0000020FF6030000-0x0000020FF6031000-memory.dmpFilesize
4KB
-
memory/2248-182-0x0000020FF6030000-0x0000020FF6031000-memory.dmpFilesize
4KB
-
memory/2248-79-0x0000020FF6030000-0x0000020FF6031000-memory.dmpFilesize
4KB
-
memory/2248-189-0x0000020FF6030000-0x0000020FF6031000-memory.dmpFilesize
4KB
-
memory/2248-41-0x0000020FF6030000-0x0000020FF6031000-memory.dmpFilesize
4KB
-
memory/2248-200-0x0000020FF6030000-0x0000020FF6031000-memory.dmpFilesize
4KB
-
memory/2248-201-0x0000020FF6030000-0x0000020FF6031000-memory.dmpFilesize
4KB
-
memory/2248-203-0x0000020FF6030000-0x0000020FF6031000-memory.dmpFilesize
4KB