Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-06-2024 19:45

General

  • Target

    24c92589686140881da82af4492fce5956eabd7328cec787ea5785325c7b95ea.dll

  • Size

    137KB

  • MD5

    54242b49850eaa3361c1b62f569670c6

  • SHA1

    628d307897f84a7e984af60416191f9fc70d8066

  • SHA256

    24c92589686140881da82af4492fce5956eabd7328cec787ea5785325c7b95ea

  • SHA512

    17353222b58a32e6b934f8afb38dcf745fd8ea7259bad5522e47d02770c30114d6b33c4d9b7210073004774092d41401733290fb85fcb77843aedb8f7e5426c9

  • SSDEEP

    3072:5R02WMK8RJGInTlhnaBanONVk40rpg4yeF/TyUGSK9FrafcUksPxx6iTUuE:U25GgFny61mraW

Malware Config

Signatures

  • Gh0st RAT payload 3 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • Blocklisted process makes network request 1 IoCs
  • Registers new Print Monitor 2 TTPs 16 IoCs
  • Sets service image path in registry 2 TTPs 2 IoCs
  • ACProtect 1.3x - 1.4x DLL software 15 IoCs

    Detects file using ACProtect software.

  • Drops file in System32 directory 6 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 4 IoCs
  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 12 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\24c92589686140881da82af4492fce5956eabd7328cec787ea5785325c7b95ea.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4600
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\24c92589686140881da82af4492fce5956eabd7328cec787ea5785325c7b95ea.dll,#1
      2⤵
      • Blocklisted process makes network request
      • Registers new Print Monitor
      • Sets service image path in registry
      • Drops file in System32 directory
      • Suspicious use of SetThreadContext
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2104
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\system32\svchost.exe -k rundll32
        3⤵
        • Registers new Print Monitor
        • Sets service image path in registry
        • Drops file in System32 directory
        • Suspicious use of AdjustPrivilegeToken
        PID:2000
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 592
        3⤵
        • Program crash
        PID:1852
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2104 -ip 2104
    1⤵
      PID:1440
    • C:\Windows\system32\Spoolsv.exe
      Spoolsv.exe
      1⤵
      • Registers new Print Monitor
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:3124

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\AppPatch\ComBack.Dll

      Filesize

      137KB

      MD5

      dcb78c9145f5c60ebe94cae5d8c0124d

      SHA1

      cbe28d240f5a7b90550c6a4224eb3ac18091b60c

      SHA256

      09e6d176b30240413cd4b740858740f2c10d2d354d7f2851a074325fa663f731

      SHA512

      36e64630ffe73aab4264f0534e0361dcceea7ed1537ddf4d09dd8e4e058d3e1c1a89cef80c9cf785ce8d1a5ecc5fd76f8165d75c14b8d9dbc1066bf3a985f2ee

    • C:\Windows\SysWOW64\com\comb.dll

      Filesize

      128B

      MD5

      740dfa20f693c30668147e6c269612d0

      SHA1

      fb995bc846b760d40c5fb7f33c17c8284616ce94

      SHA256

      5acea348d7c0d6dedd3e465d80d2bbade0ed3a48c1482fbec817534b08b50bba

      SHA512

      0b83a08b3ca3c3013f0af1da1a8b7594c1758bafb4a79b69b3eb572812863d5d6e35ece13208d1aa8df8d0b84047f91536538f4a7c16ecbcf219437eee83bd1f

    • memory/2000-17-0x00000000006C0000-0x00000000006E3000-memory.dmp

      Filesize

      140KB

    • memory/2000-30-0x0000000000BD0000-0x0000000000BED000-memory.dmp

      Filesize

      116KB

    • memory/2000-35-0x0000000000A90000-0x0000000000AB7000-memory.dmp

      Filesize

      156KB

    • memory/2000-15-0x0000000000A90000-0x0000000000AB7000-memory.dmp

      Filesize

      156KB

    • memory/2000-28-0x0000000000BD0000-0x0000000000BED000-memory.dmp

      Filesize

      116KB

    • memory/2000-24-0x0000000000BD0000-0x0000000000BED000-memory.dmp

      Filesize

      116KB

    • memory/2000-25-0x0000000000BD0000-0x0000000000BED000-memory.dmp

      Filesize

      116KB

    • memory/2000-18-0x0000000000A90000-0x0000000000AB7000-memory.dmp

      Filesize

      156KB

    • memory/2000-27-0x0000000000BD0000-0x0000000000BED000-memory.dmp

      Filesize

      116KB

    • memory/2000-29-0x0000000000BD0000-0x0000000000BED000-memory.dmp

      Filesize

      116KB

    • memory/2104-9-0x0000000010000000-0x000000001001C000-memory.dmp

      Filesize

      112KB

    • memory/2104-14-0x0000000002EF0000-0x0000000002F0D000-memory.dmp

      Filesize

      116KB

    • memory/2104-12-0x0000000002EF0000-0x0000000002F0D000-memory.dmp

      Filesize

      116KB

    • memory/2104-4-0x0000000010000000-0x000000001001C000-memory.dmp

      Filesize

      112KB

    • memory/2104-16-0x0000000002EF0000-0x0000000002F0D000-memory.dmp

      Filesize

      116KB

    • memory/2104-13-0x0000000002EF0000-0x0000000002F0D000-memory.dmp

      Filesize

      116KB

    • memory/2104-5-0x0000000002EF0000-0x0000000002F0D000-memory.dmp

      Filesize

      116KB

    • memory/2104-32-0x0000000010000000-0x000000001001C000-memory.dmp

      Filesize

      112KB

    • memory/2104-34-0x0000000043E50000-0x0000000043E77000-memory.dmp

      Filesize

      156KB

    • memory/2104-11-0x0000000002EF0000-0x0000000002F0D000-memory.dmp

      Filesize

      116KB