Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 19:36
Static task
static1
Behavioral task
behavioral1
Sample
df15ee34b6debe4057dd9421d47ab814e89938d64f0c6ad37373aa4f4684bf1f.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
df15ee34b6debe4057dd9421d47ab814e89938d64f0c6ad37373aa4f4684bf1f.exe
Resource
win10v2004-20240508-en
General
-
Target
df15ee34b6debe4057dd9421d47ab814e89938d64f0c6ad37373aa4f4684bf1f.exe
-
Size
4.5MB
-
MD5
7fb9eee3c23c2e39cfd8bf52b109749c
-
SHA1
985c0f50ceb01dc43cd9ebdb7b34470f0670a6fd
-
SHA256
df15ee34b6debe4057dd9421d47ab814e89938d64f0c6ad37373aa4f4684bf1f
-
SHA512
03ddddd70eb04e85d8e8cfec3fbde2b744ce390d688b4f2ad6443fd6fee06ea11497354c47e683da7f01d4f6f4e502b411cf55cfd350af10a791537941fffe9c
-
SSDEEP
49152:UYREXSVMKi33bXsPNIULkmp1/j6AeXZG7wmpvGF1IP9z5WuHC4O8b8ITDnl27PLn:N2SVMK83bXsPN5kiQaZ56
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/files/0x0024000000015c3c-6.dat family_gh0strat -
Sets DLL path for service in the registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\svchcst\Parameters\ServiceDll = "C:\\Windows\\system32\\259429132.bat" look2.exe -
Executes dropped EXE 3 IoCs
pid Process 2616 look2.exe 2632 HD_df15ee34b6debe4057dd9421d47ab814e89938d64f0c6ad37373aa4f4684bf1f.exe 2400 svchcst.exe -
Loads dropped DLL 6 IoCs
pid Process 2612 df15ee34b6debe4057dd9421d47ab814e89938d64f0c6ad37373aa4f4684bf1f.exe 2616 look2.exe 2516 svchost.exe 2612 df15ee34b6debe4057dd9421d47ab814e89938d64f0c6ad37373aa4f4684bf1f.exe 2516 svchost.exe 2400 svchcst.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\259429132.bat look2.exe File opened for modification C:\Windows\SysWOW64\ini.ini look2.exe File created C:\Windows\SysWOW64\svchcst.exe svchost.exe File opened for modification C:\Windows\SysWOW64\svchcst.exe svchost.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe df15ee34b6debe4057dd9421d47ab814e89938d64f0c6ad37373aa4f4684bf1f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2612 df15ee34b6debe4057dd9421d47ab814e89938d64f0c6ad37373aa4f4684bf1f.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2612 df15ee34b6debe4057dd9421d47ab814e89938d64f0c6ad37373aa4f4684bf1f.exe 2612 df15ee34b6debe4057dd9421d47ab814e89938d64f0c6ad37373aa4f4684bf1f.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2612 wrote to memory of 2616 2612 df15ee34b6debe4057dd9421d47ab814e89938d64f0c6ad37373aa4f4684bf1f.exe 28 PID 2612 wrote to memory of 2616 2612 df15ee34b6debe4057dd9421d47ab814e89938d64f0c6ad37373aa4f4684bf1f.exe 28 PID 2612 wrote to memory of 2616 2612 df15ee34b6debe4057dd9421d47ab814e89938d64f0c6ad37373aa4f4684bf1f.exe 28 PID 2612 wrote to memory of 2616 2612 df15ee34b6debe4057dd9421d47ab814e89938d64f0c6ad37373aa4f4684bf1f.exe 28 PID 2612 wrote to memory of 2632 2612 df15ee34b6debe4057dd9421d47ab814e89938d64f0c6ad37373aa4f4684bf1f.exe 31 PID 2612 wrote to memory of 2632 2612 df15ee34b6debe4057dd9421d47ab814e89938d64f0c6ad37373aa4f4684bf1f.exe 31 PID 2612 wrote to memory of 2632 2612 df15ee34b6debe4057dd9421d47ab814e89938d64f0c6ad37373aa4f4684bf1f.exe 31 PID 2612 wrote to memory of 2632 2612 df15ee34b6debe4057dd9421d47ab814e89938d64f0c6ad37373aa4f4684bf1f.exe 31 PID 2516 wrote to memory of 2400 2516 svchost.exe 32 PID 2516 wrote to memory of 2400 2516 svchost.exe 32 PID 2516 wrote to memory of 2400 2516 svchost.exe 32 PID 2516 wrote to memory of 2400 2516 svchost.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\df15ee34b6debe4057dd9421d47ab814e89938d64f0c6ad37373aa4f4684bf1f.exe"C:\Users\Admin\AppData\Local\Temp\df15ee34b6debe4057dd9421d47ab814e89938d64f0c6ad37373aa4f4684bf1f.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\look2.exeC:\Users\Admin\AppData\Local\Temp\\look2.exe2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2616
-
-
C:\Users\Admin\AppData\Local\Temp\HD_df15ee34b6debe4057dd9421d47ab814e89938d64f0c6ad37373aa4f4684bf1f.exeC:\Users\Admin\AppData\Local\Temp\HD_df15ee34b6debe4057dd9421d47ab814e89938d64f0c6ad37373aa4f4684bf1f.exe2⤵
- Executes dropped EXE
PID:2632
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "svchcst"1⤵PID:2116
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "svchcst"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\svchcst.exeC:\Windows\system32\svchcst.exe "c:\windows\system32\259429132.bat",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2400
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD56b5bb738544cfb9d2bfdd86a870b961e
SHA11d0dbca908b965d7014ba0dbdedd746030215727
SHA256403fb962c097d2d398c6cfaabed804febf89fd730569d0fb7fabfd5a9ea14936
SHA512abe60af9e8fe96e836a23ae6a1246ca0c9d3e358555ea16458fae38619775b4384e41fbdb1e6838df96b1d552ea599773fddec3c6b9255e9d3a0658a822dc7de
-
\Users\Admin\AppData\Local\Temp\HD_df15ee34b6debe4057dd9421d47ab814e89938d64f0c6ad37373aa4f4684bf1f.exe
Filesize3.1MB
MD5fb083acd60fe5c3156dc25442be815e3
SHA161df59b8f3ebd8b3d29ca3aedc4995e23cacf6d8
SHA256f130b3789962d5c8b59aa250d6f26ad5945928f3905b32bf65aa7bd30348a794
SHA5127147337d2c1006bb15cfa967c9eea6826b63c8d343f866e7454d7368d25019f39e52cf179500810834244c3ca9644d6c0df0b2c3128a9051e9ee6b428fa926f6
-
Filesize
337KB
MD5fb66e1e31fa1e6dfb21a50ccd11e0409
SHA16c45a0a115ec896eb14a531a44809b2a22cf8934
SHA2565ea8c5455f0ebe884ed98834e78ead8b6c68814bbb1723370299fa44b88c0faa
SHA51258ee149f70438296a67d5ae5cbd6cb9f5b2510a0381466b8f09eec3835be1ce7cad6903ca8fbc9273105132e85952208e78c59f776416c5449b86cc62111154b
-
Filesize
51KB
MD5737c6b8009f447029f61d9689a907f67
SHA17cc60409731d1117710be79859a8ed5441ca8415
SHA2562287d29347c14fc482393a202393c0fec0e55615766b6d64207a277e76e3e5f8
SHA512dd13baf00f6665cc51650ffd3bdcafd381cc6f49a72a9d1bce8be563f96334937e05b003070481c343bf26ccf79c750be82d208ec5a09e2a56ef87fd0a266344
-
Filesize
43KB
MD551138beea3e2c21ec44d0932c71762a8
SHA18939cf35447b22dd2c6e6f443446acc1bf986d58
SHA2565ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d