Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
19-06-2024 05:42
Static task
static1
Behavioral task
behavioral1
Sample
b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe
Resource
win10v2004-20240611-en
General
-
Target
b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe
-
Size
5.8MB
-
MD5
129267a89672d2d010be3866c933c83d
-
SHA1
3282ceeeed48dc68097cd2fe0b610c60e9bf3a7d
-
SHA256
b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92
-
SHA512
e3e8f872026e4b5fa1cea84332977bb09f6d05f6f94c6ec522e50d47461ed69f018e38f4da2a5f7cfbf111e78136dd612ca43c6ae8788bb0794fc44fbbfb07a7
-
SSDEEP
98304:d2SVMK8Bav0tLhKydVrl5q28ajv5o8TlacM6+xgAAKI5Qp2bD9EuVmCVtZTx0jbS:V0aRwnvTcts5Qp2bDzzVtMq
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
Processes:
resource yara_rule C:\Windows\SysWOW64\240600687.bat family_gh0strat -
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
Processes:
look2.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\svchcst\Parameters\ServiceDll = "C:\\Windows\\system32\\240600687.bat" look2.exe -
Executes dropped EXE 3 IoCs
Processes:
look2.exeHD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exesvchcst.exepid process 4324 look2.exe 3280 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe 2000 svchcst.exe -
Loads dropped DLL 3 IoCs
Processes:
look2.exesvchost.exesvchcst.exepid process 4324 look2.exe 4320 svchost.exe 2000 svchcst.exe -
Drops file in System32 directory 4 IoCs
Processes:
look2.exesvchost.exedescription ioc process File opened for modification C:\Windows\SysWOW64\ini.ini look2.exe File created C:\Windows\SysWOW64\svchcst.exe svchost.exe File opened for modification C:\Windows\SysWOW64\svchcst.exe svchost.exe File created C:\Windows\SysWOW64\240600687.bat look2.exe -
Drops file in Program Files directory 1 IoCs
Processes:
b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exepid process 2648 b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe 2648 b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exeHD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exepid process 2648 b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe 2648 b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe 3280 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe 3280 HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exesvchost.exedescription pid process target process PID 2648 wrote to memory of 4324 2648 b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe look2.exe PID 2648 wrote to memory of 4324 2648 b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe look2.exe PID 2648 wrote to memory of 4324 2648 b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe look2.exe PID 2648 wrote to memory of 3280 2648 b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe PID 2648 wrote to memory of 3280 2648 b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe PID 2648 wrote to memory of 3280 2648 b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe PID 4320 wrote to memory of 2000 4320 svchost.exe svchcst.exe PID 4320 wrote to memory of 2000 4320 svchost.exe svchcst.exe PID 4320 wrote to memory of 2000 4320 svchost.exe svchcst.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe"C:\Users\Admin\AppData\Local\Temp\b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\look2.exeC:\Users\Admin\AppData\Local\Temp\\look2.exe2⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exeC:\Users\Admin\AppData\Local\Temp\HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3280
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "svchcst"1⤵PID:4680
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "svchcst"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Windows\SysWOW64\svchcst.exeC:\Windows\system32\svchcst.exe "c:\windows\system32\240600687.bat",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5e7dce99dd405bef957f7b6ba4ca0399c
SHA1c819d2d77417e45b436f0444dacdfc948d7e1e46
SHA256445994ec321f2a4e4f43700fee16ac6cb8e87344f9a50cdf53602686194d6ca4
SHA512877dafa69541ee771c0affce1a8d881ffdb02945bf2fcd97b41c5e58c9c64eeea4587a80271366a707f89ad312807614f4971026848d7e2ee5cd3d24b674e3a7
-
C:\Users\Admin\AppData\Local\Temp\HD_b9b3211f487120a5a698cc1a6890103e4e38f030e74fd2f36fbb76c5f84ade92.exe
Filesize4.7MB
MD55db30979e33406b57949b6548da5e6d7
SHA18bbd90bce5181faf442b8e5c7125fd7b8eef96b1
SHA25605cc6c712fa8be8b30cee0e9453ff08a1ba383b50dd7026c3cbbe91cf1fe3f4f
SHA51211427e839afffac519fd208f346f4ecd76d979fe8cd72794f91e6b9354c12c7a7822c63f87e445fecc8b343a00297770c180a13aae3f22bc90ac4745ae199a59
-
Filesize
337KB
MD5fb66e1e31fa1e6dfb21a50ccd11e0409
SHA16c45a0a115ec896eb14a531a44809b2a22cf8934
SHA2565ea8c5455f0ebe884ed98834e78ead8b6c68814bbb1723370299fa44b88c0faa
SHA51258ee149f70438296a67d5ae5cbd6cb9f5b2510a0381466b8f09eec3835be1ce7cad6903ca8fbc9273105132e85952208e78c59f776416c5449b86cc62111154b
-
Filesize
51KB
MD555a8da2614599c9df55ee082118c5baf
SHA14ea23fbfb226b8dce0f0ca8cbe5e9c124621788d
SHA25652700819ecf1d5011a8a8cefb3c891bbba5154ac25bdf076cf1bb829262730ca
SHA51236500f6e8b4dcd17c0332c0f2381d70fea83db23b10262b889f6a3abc58f5e4dcb39114d6238e137c475efe4ad07ddf1734a112b60ce7368e08bcb2c7c6aead9
-
Filesize
60KB
MD5889b99c52a60dd49227c5e485a016679
SHA18fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA2566cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA51208933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641