Analysis
- max time kernel
120s - max time network
132s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
12/06/2024, 18:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
mm.exe
Resource
win7-20240611-en
windows7-x64
16 signatures
150 seconds
General
- Target mm.exe
- Size 4.4MB
- Sample240612-wtql9syckm
- SHA256 77886cc8a951bb0bb843e54324012ec508f0ba79b5ad7512d0b34e3076c2cd10
- MD5 cc58647d7c7350b22545296ead2f7f18
- SHA1 9d4309057b798e0b4b117b53b49c1202669aa38f
- SHA512 26bbb33509edcf17cf24b7b3dea2b91195cee463510879ea3351f5f3168011de3c27bbc100c4045d1539323cc1a29d70830e489b7cce3bd4bcbe9619af5281c4
- SSDEEP 98304:YKTt04clJg+Kmd4kgEDm8m4xoKmet04clrJxBgRDm8m4xoKmoEunKY:Yk04lmdDdm4xpmY04qBGm4xpmEKY
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Gh0st RAT payload 7 IoCs
resource yara_rule behavioral2/memory/4552-37-0x0000000010000000-0x000000001034B000-memory.dmp family_gh0strat behavioral2/memory/4552-40-0x0000000010000000-0x000000001034B000-memory.dmp family_gh0strat behavioral2/memory/4552-38-0x0000000010000000-0x000000001034B000-memory.dmp family_gh0strat behavioral2/memory/392-52-0x0000000010000000-0x000000001034B000-memory.dmp family_gh0strat behavioral2/memory/392-53-0x0000000010000000-0x000000001034B000-memory.dmp family_gh0strat behavioral2/memory/3320-59-0x0000000010000000-0x000000001034B000-memory.dmp family_gh0strat behavioral2/memory/3320-58-0x0000000010000000-0x000000001034B000-memory.dmp family_gh0strat - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation mm.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation conhostdhfw.exe - Executes dropped EXE 5 IoCs
pid Process 4552 conhostdhfw.exe 392 conhostdhfw.exe 3320 conhostdhfw.exe 4996 conhostdhfw.exe 3804 conhostdhfw.exe -
resource yara_rule behavioral2/memory/4552-37-0x0000000010000000-0x000000001034B000-memory.dmp upx behavioral2/memory/4552-35-0x0000000010000000-0x000000001034B000-memory.dmp upx behavioral2/memory/4552-40-0x0000000010000000-0x000000001034B000-memory.dmp upx behavioral2/memory/4552-38-0x0000000010000000-0x000000001034B000-memory.dmp upx behavioral2/memory/392-52-0x0000000010000000-0x000000001034B000-memory.dmp upx behavioral2/memory/392-53-0x0000000010000000-0x000000001034B000-memory.dmp upx behavioral2/memory/3320-55-0x0000000010000000-0x000000001034B000-memory.dmp upx behavioral2/memory/3320-59-0x0000000010000000-0x000000001034B000-memory.dmp upx behavioral2/memory/3320-58-0x0000000010000000-0x000000001034B000-memory.dmp upx - Drops file in System32 directory 16 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AD5F118F7897046E8CA970AE6A6AB70B_D2FDAF9311DEB8FADA8D338E3BD2071D conhostdhfw.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 conhostdhfw.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE conhostdhfw.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 conhostdhfw.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft conhostdhfw.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_896832C6BC857CFAEA9E59E166B13E2C conhostdhfw.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache conhostdhfw.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData conhostdhfw.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CF14D1855652602540DFCFECD21854DB_71F4740D37287A91812B9479338ACF24 conhostdhfw.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_896832C6BC857CFAEA9E59E166B13E2C conhostdhfw.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AD5F118F7897046E8CA970AE6A6AB70B_D2FDAF9311DEB8FADA8D338E3BD2071D conhostdhfw.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies conhostdhfw.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_786387CC77858B88BA3234B304062475 conhostdhfw.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content conhostdhfw.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_786387CC77858B88BA3234B304062475 conhostdhfw.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CF14D1855652602540DFCFECD21854DB_71F4740D37287A91812B9479338ACF24 conhostdhfw.exe - Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files\AppPatch\8.77.dll conhostdhfw.exe File opened for modification C:\Program Files\AppPatch\8.77.dll conhostdhfw.exe File created C:\Program Files (x86)\Windows NT\conhostdhfw.exe conhostdhfw.exe File opened for modification C:\Program Files (x86)\Windows NT\conhostdhfw.exe conhostdhfw.exe - Drops file in Windows directory 23 IoCs
description ioc Process File created C:\Windows\apppatch\Custom\Custom64\conhostdhfw.exe mm.exe File created C:\Windows\apppatch\Custom\Custom64\dllhost.exe mm.exe File opened for modification C:\Windows\apppatch\Custom\Custom64\GoogleUpdateTaskMachineUA{16BC37E5-3A02-401D-B8D2-176130sdlvse.xml mm.exe File opened for modification C:\Windows\apppatch\Custom\Custom64\libcurllvse.exe mm.exe File opened for modification C:\Windows\apppatch\Custom\Custom64\svchost.exe mm.exe File created C:\Windows\apppatch\Custom\Custom64\GoogleUpdateTaskMachineUA{E67DA9CE-6D58-456B-9EBF-9366B90dllll.xml mm.exe File created C:\Windows\apppatch\Custom\Custom64\svchost.exe mm.exe File opened for modification C:\Windows\apppatch\Custom\Custom64\conhost dhlvse.exe mm.exe File opened for modification C:\Windows\apppatch\Custom\Custom64\conhotsdlvse.exe mm.exe File opened for modification C:\Windows\apppatch\Custom\Custom64\dllhost.exe mm.exe File created C:\Windows\apppatch\Custom\Custom64\GoogleUpdateTaskMachineUA{16BC37E5-3A02-401D-B8D2-176130sdlvse.xml mm.exe File created C:\Windows\apppatch\Custom\Custom64\GoogleUpdateTaskMachineUA{16BC37E5-3A02-401D-B8D2-176130svc.xml mm.exe File created C:\Windows\apppatch\Custom\Custom64\conhost dhlvse.exe mm.exe File created C:\Windows\apppatch\Custom\Custom64\__tmp_rar_sfx_access_check_240597109 mm.exe File created C:\Windows\apppatch\Custom\Custom64\GoogleUpdateTaskMachineUA{16BC37E5-3A02-401D-B8D2-176130bin lvse.xml mm.exe File opened for modification C:\Windows\apppatch\Custom\Custom64\GoogleUpdateTaskMachineUA{16BC37E5-3A02-401D-B8D2-176130svc.xml mm.exe File opened for modification C:\Windows\apppatch\Custom\Custom64\GoogleUpdateTaskMachineUA{E67DA9CE-6D58-456B-9EBF-9366B90dllll.xml mm.exe File created C:\Windows\apppatch\Custom\Custom64\libcurllvse.exe mm.exe File opened for modification C:\Windows\apppatch\Custom\Custom64\conhostdhfw.exe mm.exe File created C:\Windows\apppatch\Custom\Custom64\conhotsdfw.exe mm.exe File opened for modification C:\Windows\apppatch\Custom\Custom64\conhotsdfw.exe mm.exe File created C:\Windows\apppatch\Custom\Custom64\conhotsdlvse.exe mm.exe File opened for modification C:\Windows\apppatch\Custom\Custom64\GoogleUpdateTaskMachineUA{16BC37E5-3A02-401D-B8D2-176130bin lvse.xml mm.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
pid pid_target Process procid_target 1392 3320 WerFault.exe 88 - Modifies data under HKEY_USERS 16 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows conhostdhfw.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" conhostdhfw.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" conhostdhfw.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" conhostdhfw.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" conhostdhfw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings conhostdhfw.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix conhostdhfw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P conhostdhfw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing conhostdhfw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History conhostdhfw.exe Key created \REGISTRY\USER\.DEFAULT\Software conhostdhfw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft conhostdhfw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion conhostdhfw.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" conhostdhfw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ conhostdhfw.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" conhostdhfw.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3320 conhostdhfw.exe Token: SeDebugPrivilege 3320 conhostdhfw.exe Token: SeDebugPrivilege 3804 conhostdhfw.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4824 wrote to memory of 4552 4824 mm.exe 84 PID 4824 wrote to memory of 4552 4824 mm.exe 84 PID 4824 wrote to memory of 4552 4824 mm.exe 84 PID 4552 wrote to memory of 392 4552 conhostdhfw.exe 87 PID 4552 wrote to memory of 392 4552 conhostdhfw.exe 87 PID 4552 wrote to memory of 392 4552 conhostdhfw.exe 87 PID 3320 wrote to memory of 4996 3320 conhostdhfw.exe 89 PID 3320 wrote to memory of 4996 3320 conhostdhfw.exe 89 PID 3320 wrote to memory of 4996 3320 conhostdhfw.exe 89 PID 3320 wrote to memory of 3804 3320 conhostdhfw.exe 90 PID 3320 wrote to memory of 3804 3320 conhostdhfw.exe 90 PID 3320 wrote to memory of 3804 3320 conhostdhfw.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\mm.exe"C:\Users\Admin\AppData\Local\Temp\mm.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\AppPatch\Custom\Custom64\conhostdhfw.exe"C:\Windows\AppPatch\Custom\Custom64\conhostdhfw.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Program Files (x86)\Windows NT\conhostdhfw.exe"C:\Program Files (x86)\Windows NT\conhostdhfw.exe"3⤵
- Executes dropped EXE
PID:392
-
-
-
C:\Program Files (x86)\Windows NT\conhostdhfw.exe"C:\Program Files (x86)\Windows NT\conhostdhfw.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Program Files (x86)\Windows NT\conhostdhfw.exe"C:\Program Files (x86)\Windows NT\conhostdhfw.exe"2⤵
- Executes dropped EXE
PID:4996
-
-
C:\Program Files (x86)\Windows NT\conhostdhfw.exe"C:\Program Files (x86)\Windows NT\conhostdhfw.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3804
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3320 -s 6402⤵
- Program crash
PID:1392
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 3320 -ip 33201⤵PID:4880
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\AppPatch\8.77.dll
- Size 240KB
- SHA256 cdabc33a27b23c2060637193a4cbad94e16d31e6a4df7d67bdc6b63c1d056b30
- MD5 0a74e0bffbce3cc5466796739cfdeb44
- SHA1 c3b50df0a1de18b7053bff1b0293f5512f824055
- SHA512 9fb4f39d95820f63da2d8767b76f317c512a8db1b86428f04baf4b163d0deaee5c4726c9f66807a3b1c223d575557fabc88e0cde73a4561b304f6edd76b8cc36
- SSDEEP 6144:E1w+HzW2d3ivIkXcRlfW08ALYmvI+7m5WMq:1+HzJd3gBifoALfI+i9q
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\apppatch\Custom\Custom64\conhostdhfw.exe
- Size 60KB
- SHA256 c28770a88ad997d80ca6f461893cd6f032f614a43c449f21e73df15e8a843105
- MD5 90d83bbad8110780e90b8f0beab172f9
- SHA1 0ced0e716b07945787bf78ae6296a5f24bfdbe59
- SHA512 92d4a6697644925176852c2b43bf297b16afadc2a993c135b5aa9df3c74a280bfb7cde883c6bf5c8b06202ff55168997dcf89ef2e791a3aeaca3cb09b6ac7707
- SSDEEP 768:3e1iZNbQAKrWGOkGQeN70ZqL378KBBmbUt4i:36iZNer5GQvkUath
- MD5 SHA1 SHA512 SSDEEP