Analysis

  • max time kernel
    137s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    19-06-2024 05:42

General

  • Target

    b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe

  • Size

    5.8MB

  • MD5

    129267a89672d2d010be3866c933c83d

  • SHA1

    3282ceeeed48dc68097cd2fe0b610c60e9bf3a7d

  • SHA256

    b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92

  • SHA512

    e3e8f872026e4b5fa1cea84332977bb09f6d05f6f94c6ec522e50d47461ed69f018e38f4da2a5f7cfbf111e78136dd612ca43c6ae8788bb0794fc44fbbfb07a7

  • SSDEEP

    98304:d2SVMK8Bav0tLhKydVrl5q28ajv5o8TlacM6+xgAAKI5Qp2bD9EuVmCVtZTx0jbS:V0aRwnvTcts5Qp2bDzzVtMq

Malware Config

Signatures

  • Gh0st RAT payload 1 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 7 IoCs
  • UPX packed file 23 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 4 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 49 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe
    "C:\Users\Admin\AppData\Local\Temp\b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2276
    • C:\Users\Admin\AppData\Local\Temp\look2.exe
      C:\Users\Admin\AppData\Local\Temp\\look2.exe
      2⤵
      • Server Software Component: Terminal Services DLL
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      PID:1656
    • C:\Users\Admin\AppData\Local\Temp\HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe
      C:\Users\Admin\AppData\Local\Temp\HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2572
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k "svchcst"
    1⤵
      PID:2320
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\SysWOW64\svchost.exe -k "svchcst"
      1⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:2980
      • C:\Windows\SysWOW64\svchcst.exe
        C:\Windows\system32\svchcst.exe "c:\windows\system32\259394827.bat",MainThread
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2668

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\HD_X.dat

      Filesize

      1.2MB

      MD5

      e7dce99dd405bef957f7b6ba4ca0399c

      SHA1

      c819d2d77417e45b436f0444dacdfc948d7e1e46

      SHA256

      445994ec321f2a4e4f43700fee16ac6cb8e87344f9a50cdf53602686194d6ca4

      SHA512

      877dafa69541ee771c0affce1a8d881ffdb02945bf2fcd97b41c5e58c9c64eeea4587a80271366a707f89ad312807614f4971026848d7e2ee5cd3d24b674e3a7

    • \Users\Admin\AppData\Local\Temp\HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe

      Filesize

      4.7MB

      MD5

      5db30979e33406b57949b6548da5e6d7

      SHA1

      8bbd90bce5181faf442b8e5c7125fd7b8eef96b1

      SHA256

      05cc6c712fa8be8b30cee0e9453ff08a1ba383b50dd7026c3cbbe91cf1fe3f4f

      SHA512

      11427e839afffac519fd208f346f4ecd76d979fe8cd72794f91e6b9354c12c7a7822c63f87e445fecc8b343a00297770c180a13aae3f22bc90ac4745ae199a59

    • \Users\Admin\AppData\Local\Temp\look2.exe

      Filesize

      337KB

      MD5

      fb66e1e31fa1e6dfb21a50ccd11e0409

      SHA1

      6c45a0a115ec896eb14a531a44809b2a22cf8934

      SHA256

      5ea8c5455f0ebe884ed98834e78ead8b6c68814bbb1723370299fa44b88c0faa

      SHA512

      58ee149f70438296a67d5ae5cbd6cb9f5b2510a0381466b8f09eec3835be1ce7cad6903ca8fbc9273105132e85952208e78c59f776416c5449b86cc62111154b

    • \Windows\SysWOW64\259394827.bat

      Filesize

      51KB

      MD5

      55a8da2614599c9df55ee082118c5baf

      SHA1

      4ea23fbfb226b8dce0f0ca8cbe5e9c124621788d

      SHA256

      52700819ecf1d5011a8a8cefb3c891bbba5154ac25bdf076cf1bb829262730ca

      SHA512

      36500f6e8b4dcd17c0332c0f2381d70fea83db23b10262b889f6a3abc58f5e4dcb39114d6238e137c475efe4ad07ddf1734a112b60ce7368e08bcb2c7c6aead9

    • \Windows\SysWOW64\svchcst.exe

      Filesize

      43KB

      MD5

      51138beea3e2c21ec44d0932c71762a8

      SHA1

      8939cf35447b22dd2c6e6f443446acc1bf986d58

      SHA256

      5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

      SHA512

      794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

    • memory/2572-64-0x0000000002910000-0x000000000294E000-memory.dmp

      Filesize

      248KB

    • memory/2572-58-0x0000000002910000-0x000000000294E000-memory.dmp

      Filesize

      248KB

    • memory/2572-78-0x0000000002910000-0x000000000294E000-memory.dmp

      Filesize

      248KB

    • memory/2572-76-0x0000000002910000-0x000000000294E000-memory.dmp

      Filesize

      248KB

    • memory/2572-74-0x0000000002910000-0x000000000294E000-memory.dmp

      Filesize

      248KB

    • memory/2572-72-0x0000000002910000-0x000000000294E000-memory.dmp

      Filesize

      248KB

    • memory/2572-70-0x0000000002910000-0x000000000294E000-memory.dmp

      Filesize

      248KB

    • memory/2572-68-0x0000000002910000-0x000000000294E000-memory.dmp

      Filesize

      248KB

    • memory/2572-66-0x0000000002910000-0x000000000294E000-memory.dmp

      Filesize

      248KB

    • memory/2572-54-0x0000000002910000-0x000000000294E000-memory.dmp

      Filesize

      248KB

    • memory/2572-60-0x0000000002910000-0x000000000294E000-memory.dmp

      Filesize

      248KB

    • memory/2572-80-0x0000000002910000-0x000000000294E000-memory.dmp

      Filesize

      248KB

    • memory/2572-56-0x0000000002910000-0x000000000294E000-memory.dmp

      Filesize

      248KB

    • memory/2572-53-0x0000000002910000-0x000000000294E000-memory.dmp

      Filesize

      248KB

    • memory/2572-50-0x0000000002910000-0x000000000294E000-memory.dmp

      Filesize

      248KB

    • memory/2572-49-0x0000000002910000-0x000000000294E000-memory.dmp

      Filesize

      248KB

    • memory/2572-47-0x0000000002910000-0x000000000294E000-memory.dmp

      Filesize

      248KB

    • memory/2572-44-0x0000000002910000-0x000000000294E000-memory.dmp

      Filesize

      248KB

    • memory/2572-42-0x0000000002910000-0x000000000294E000-memory.dmp

      Filesize

      248KB

    • memory/2572-41-0x0000000002910000-0x000000000294E000-memory.dmp

      Filesize

      248KB

    • memory/2572-39-0x0000000002910000-0x000000000294E000-memory.dmp

      Filesize

      248KB

    • memory/2572-37-0x0000000002910000-0x000000000294E000-memory.dmp

      Filesize

      248KB

    • memory/2572-62-0x0000000002910000-0x000000000294E000-memory.dmp

      Filesize

      248KB