Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-06-2024 05:42

General

  • Target

    b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe

  • Size

    5.8MB

  • MD5

    129267a89672d2d010be3866c933c83d

  • SHA1

    3282ceeeed48dc68097cd2fe0b610c60e9bf3a7d

  • SHA256

    b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92

  • SHA512

    e3e8f872026e4b5fa1cea84332977bb09f6d05f6f94c6ec522e50d47461ed69f018e38f4da2a5f7cfbf111e78136dd612ca43c6ae8788bb0794fc44fbbfb07a7

  • SSDEEP

    98304:d2SVMK8Bav0tLhKydVrl5q28ajv5o8TlacM6+xgAAKI5Qp2bD9EuVmCVtZTx0jbS:V0aRwnvTcts5Qp2bDzzVtMq

Malware Config

Signatures

  • Gh0st RAT payload 1 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Drops file in System32 directory 4 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe
    "C:\Users\Admin\AppData\Local\Temp\b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2648
    • C:\Users\Admin\AppData\Local\Temp\look2.exe
      C:\Users\Admin\AppData\Local\Temp\\look2.exe
      2⤵
      • Server Software Component: Terminal Services DLL
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      PID:4324
    • C:\Users\Admin\AppData\Local\Temp\HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe
      C:\Users\Admin\AppData\Local\Temp\HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:3280
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k "svchcst"
    1⤵
      PID:4680
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\SysWOW64\svchost.exe -k "svchcst"
      1⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:4320
      • C:\Windows\SysWOW64\svchcst.exe
        C:\Windows\system32\svchcst.exe "c:\windows\system32\240600687.bat",MainThread
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2000

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\HD_X.dat

      Filesize

      1.2MB

      MD5

      e7dce99dd405bef957f7b6ba4ca0399c

      SHA1

      c819d2d77417e45b436f0444dacdfc948d7e1e46

      SHA256

      445994ec321f2a4e4f43700fee16ac6cb8e87344f9a50cdf53602686194d6ca4

      SHA512

      877dafa69541ee771c0affce1a8d881ffdb02945bf2fcd97b41c5e58c9c64eeea4587a80271366a707f89ad312807614f4971026848d7e2ee5cd3d24b674e3a7

    • C:\Users\Admin\AppData\Local\Temp\HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe

      Filesize

      4.7MB

      MD5

      5db30979e33406b57949b6548da5e6d7

      SHA1

      8bbd90bce5181faf442b8e5c7125fd7b8eef96b1

      SHA256

      05cc6c712fa8be8b30cee0e9453ff08a1ba383b50dd7026c3cbbe91cf1fe3f4f

      SHA512

      11427e839afffac519fd208f346f4ecd76d979fe8cd72794f91e6b9354c12c7a7822c63f87e445fecc8b343a00297770c180a13aae3f22bc90ac4745ae199a59

    • C:\Users\Admin\AppData\Local\Temp\look2.exe

      Filesize

      337KB

      MD5

      fb66e1e31fa1e6dfb21a50ccd11e0409

      SHA1

      6c45a0a115ec896eb14a531a44809b2a22cf8934

      SHA256

      5ea8c5455f0ebe884ed98834e78ead8b6c68814bbb1723370299fa44b88c0faa

      SHA512

      58ee149f70438296a67d5ae5cbd6cb9f5b2510a0381466b8f09eec3835be1ce7cad6903ca8fbc9273105132e85952208e78c59f776416c5449b86cc62111154b

    • C:\Windows\SysWOW64\240600687.bat

      Filesize

      51KB

      MD5

      55a8da2614599c9df55ee082118c5baf

      SHA1

      4ea23fbfb226b8dce0f0ca8cbe5e9c124621788d

      SHA256

      52700819ecf1d5011a8a8cefb3c891bbba5154ac25bdf076cf1bb829262730ca

      SHA512

      36500f6e8b4dcd17c0332c0f2381d70fea83db23b10262b889f6a3abc58f5e4dcb39114d6238e137c475efe4ad07ddf1734a112b60ce7368e08bcb2c7c6aead9

    • C:\Windows\SysWOW64\svchcst.exe

      Filesize

      60KB

      MD5

      889b99c52a60dd49227c5e485a016679

      SHA1

      8fa889e456aa646a4d0a4349977430ce5fa5e2d7

      SHA256

      6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910

      SHA512

      08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641

    • memory/3280-18-0x0000000010000000-0x000000001003C000-memory.dmp

      Filesize

      240KB

    • memory/3280-41-0x0000000010000000-0x000000001003C000-memory.dmp

      Filesize

      240KB