Analysis
-
max time kernel
137s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-06-2024 05:42
Static task
static1
Behavioral task
behavioral1
Sample
b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe
Resource
win10v2004-20240611-en
General
-
Target
b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe
-
Size
5.8MB
-
MD5
129267a89672d2d010be3866c933c83d
-
SHA1
3282ceeeed48dc68097cd2fe0b610c60e9bf3a7d
-
SHA256
b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92
-
SHA512
e3e8f872026e4b5fa1cea84332977bb09f6d05f6f94c6ec522e50d47461ed69f018e38f4da2a5f7cfbf111e78136dd612ca43c6ae8788bb0794fc44fbbfb07a7
-
SSDEEP
98304:d2SVMK8Bav0tLhKydVrl5q28ajv5o8TlacM6+xgAAKI5Qp2bD9EuVmCVtZTx0jbS:V0aRwnvTcts5Qp2bDzzVtMq
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
Processes:
resource yara_rule \Windows\SysWOW64\259394827.bat family_gh0strat -
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
Processes:
look2.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\svchcst\Parameters\ServiceDll = "C:\\Windows\\system32\\259394827.bat" look2.exe -
Executes dropped EXE 3 IoCs
Processes:
look2.exeHD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exesvchcst.exepid process 1656 look2.exe 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe 2668 svchcst.exe -
Loads dropped DLL 7 IoCs
Processes:
b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exelook2.exesvchost.exesvchcst.exepid process 2276 b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe 1656 look2.exe 2980 svchost.exe 2276 b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe 2276 b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe 2980 svchost.exe 2668 svchcst.exe -
Processes:
resource yara_rule behavioral1/memory/2572-62-0x0000000002910000-0x000000000294E000-memory.dmp upx behavioral1/memory/2572-54-0x0000000002910000-0x000000000294E000-memory.dmp upx behavioral1/memory/2572-80-0x0000000002910000-0x000000000294E000-memory.dmp upx behavioral1/memory/2572-78-0x0000000002910000-0x000000000294E000-memory.dmp upx behavioral1/memory/2572-76-0x0000000002910000-0x000000000294E000-memory.dmp upx behavioral1/memory/2572-74-0x0000000002910000-0x000000000294E000-memory.dmp upx behavioral1/memory/2572-72-0x0000000002910000-0x000000000294E000-memory.dmp upx behavioral1/memory/2572-70-0x0000000002910000-0x000000000294E000-memory.dmp upx behavioral1/memory/2572-68-0x0000000002910000-0x000000000294E000-memory.dmp upx behavioral1/memory/2572-66-0x0000000002910000-0x000000000294E000-memory.dmp upx behavioral1/memory/2572-64-0x0000000002910000-0x000000000294E000-memory.dmp upx behavioral1/memory/2572-60-0x0000000002910000-0x000000000294E000-memory.dmp upx behavioral1/memory/2572-58-0x0000000002910000-0x000000000294E000-memory.dmp upx behavioral1/memory/2572-56-0x0000000002910000-0x000000000294E000-memory.dmp upx behavioral1/memory/2572-53-0x0000000002910000-0x000000000294E000-memory.dmp upx behavioral1/memory/2572-50-0x0000000002910000-0x000000000294E000-memory.dmp upx behavioral1/memory/2572-49-0x0000000002910000-0x000000000294E000-memory.dmp upx behavioral1/memory/2572-47-0x0000000002910000-0x000000000294E000-memory.dmp upx behavioral1/memory/2572-44-0x0000000002910000-0x000000000294E000-memory.dmp upx behavioral1/memory/2572-42-0x0000000002910000-0x000000000294E000-memory.dmp upx behavioral1/memory/2572-41-0x0000000002910000-0x000000000294E000-memory.dmp upx behavioral1/memory/2572-39-0x0000000002910000-0x000000000294E000-memory.dmp upx behavioral1/memory/2572-37-0x0000000002910000-0x000000000294E000-memory.dmp upx -
Drops file in System32 directory 4 IoCs
Processes:
look2.exesvchost.exedescription ioc process File created C:\Windows\SysWOW64\259394827.bat look2.exe File opened for modification C:\Windows\SysWOW64\ini.ini look2.exe File created C:\Windows\SysWOW64\svchcst.exe svchost.exe File opened for modification C:\Windows\SysWOW64\svchcst.exe svchost.exe -
Drops file in Program Files directory 1 IoCs
Processes:
b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exedescription ioc process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exepid process 2276 b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe -
Suspicious use of AdjustPrivilegeToken 49 IoCs
Processes:
HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exedescription pid process Token: SeDebugPrivilege 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe Token: 1 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe Token: SeCreateTokenPrivilege 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe Token: SeAssignPrimaryTokenPrivilege 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe Token: SeLockMemoryPrivilege 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe Token: SeIncreaseQuotaPrivilege 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe Token: SeMachineAccountPrivilege 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe Token: SeTcbPrivilege 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe Token: SeSecurityPrivilege 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe Token: SeTakeOwnershipPrivilege 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe Token: SeLoadDriverPrivilege 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe Token: SeSystemProfilePrivilege 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe Token: SeSystemtimePrivilege 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe Token: SeProfSingleProcessPrivilege 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe Token: SeIncBasePriorityPrivilege 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe Token: SeCreatePagefilePrivilege 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe Token: SeCreatePermanentPrivilege 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe Token: SeBackupPrivilege 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe Token: SeRestorePrivilege 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe Token: SeShutdownPrivilege 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe Token: SeDebugPrivilege 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe Token: SeAuditPrivilege 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe Token: SeSystemEnvironmentPrivilege 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe Token: SeChangeNotifyPrivilege 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe Token: SeRemoteShutdownPrivilege 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe Token: SeUndockPrivilege 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe Token: SeSyncAgentPrivilege 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe Token: SeEnableDelegationPrivilege 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe Token: SeManageVolumePrivilege 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe Token: SeImpersonatePrivilege 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe Token: SeCreateGlobalPrivilege 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe Token: 31 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe Token: 32 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe Token: 33 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe Token: 34 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe Token: 35 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe Token: 36 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe Token: 37 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe Token: 38 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe Token: 39 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe Token: 40 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe Token: 41 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe Token: 42 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe Token: 43 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe Token: 44 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe Token: 45 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe Token: 46 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe Token: 47 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe Token: 48 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exeHD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exepid process 2276 b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe 2276 b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe 2572 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exesvchost.exedescription pid process target process PID 2276 wrote to memory of 1656 2276 b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe look2.exe PID 2276 wrote to memory of 1656 2276 b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe look2.exe PID 2276 wrote to memory of 1656 2276 b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe look2.exe PID 2276 wrote to memory of 1656 2276 b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe look2.exe PID 2276 wrote to memory of 2572 2276 b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe PID 2276 wrote to memory of 2572 2276 b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe PID 2276 wrote to memory of 2572 2276 b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe PID 2276 wrote to memory of 2572 2276 b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe PID 2980 wrote to memory of 2668 2980 svchost.exe svchcst.exe PID 2980 wrote to memory of 2668 2980 svchost.exe svchcst.exe PID 2980 wrote to memory of 2668 2980 svchost.exe svchcst.exe PID 2980 wrote to memory of 2668 2980 svchost.exe svchcst.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe"C:\Users\Admin\AppData\Local\Temp\b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\look2.exeC:\Users\Admin\AppData\Local\Temp\\look2.exe2⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exeC:\Users\Admin\AppData\Local\Temp\HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2572
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "svchcst"1⤵PID:2320
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "svchcst"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\SysWOW64\svchcst.exeC:\Windows\system32\svchcst.exe "c:\windows\system32\259394827.bat",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2668
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5e7dce99dd405bef957f7b6ba4ca0399c
SHA1c819d2d77417e45b436f0444dacdfc948d7e1e46
SHA256445994ec321f2a4e4f43700fee16ac6cb8e87344f9a50cdf53602686194d6ca4
SHA512877dafa69541ee771c0affce1a8d881ffdb02945bf2fcd97b41c5e58c9c64eeea4587a80271366a707f89ad312807614f4971026848d7e2ee5cd3d24b674e3a7
-
\Users\Admin\AppData\Local\Temp\HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe
Filesize4.7MB
MD55db30979e33406b57949b6548da5e6d7
SHA18bbd90bce5181faf442b8e5c7125fd7b8eef96b1
SHA25605cc6c712fa8be8b30cee0e9453ff08a1ba383b50dd7026c3cbbe91cf1fe3f4f
SHA51211427e839afffac519fd208f346f4ecd76d979fe8cd72794f91e6b9354c12c7a7822c63f87e445fecc8b343a00297770c180a13aae3f22bc90ac4745ae199a59
-
Filesize
337KB
MD5fb66e1e31fa1e6dfb21a50ccd11e0409
SHA16c45a0a115ec896eb14a531a44809b2a22cf8934
SHA2565ea8c5455f0ebe884ed98834e78ead8b6c68814bbb1723370299fa44b88c0faa
SHA51258ee149f70438296a67d5ae5cbd6cb9f5b2510a0381466b8f09eec3835be1ce7cad6903ca8fbc9273105132e85952208e78c59f776416c5449b86cc62111154b
-
Filesize
51KB
MD555a8da2614599c9df55ee082118c5baf
SHA14ea23fbfb226b8dce0f0ca8cbe5e9c124621788d
SHA25652700819ecf1d5011a8a8cefb3c891bbba5154ac25bdf076cf1bb829262730ca
SHA51236500f6e8b4dcd17c0332c0f2381d70fea83db23b10262b889f6a3abc58f5e4dcb39114d6238e137c475efe4ad07ddf1734a112b60ce7368e08bcb2c7c6aead9
-
Filesize
43KB
MD551138beea3e2c21ec44d0932c71762a8
SHA18939cf35447b22dd2c6e6f443446acc1bf986d58
SHA2565ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d