Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
25/06/2024, 22:02
Static task
static1
Behavioral task
behavioral1
Sample
84fe6ff652e079ae7278a707268163db03d90c46f3c209b72315b380d0a283ee.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
84fe6ff652e079ae7278a707268163db03d90c46f3c209b72315b380d0a283ee.exe
Resource
win10v2004-20240611-en
General
-
Target
84fe6ff652e079ae7278a707268163db03d90c46f3c209b72315b380d0a283ee.exe
-
Size
4.8MB
-
MD5
f379e23fdf5a4cd4c9db3c4dfcc19eec
-
SHA1
2a48345da76480fd69fc0900acefeb66db4c48bc
-
SHA256
84fe6ff652e079ae7278a707268163db03d90c46f3c209b72315b380d0a283ee
-
SHA512
9e341afb18dcdea52069c885e1c42c63a95874b1e744ba9c30941edf84cdcd3a4adf75871d00962e72720e4dda6345724f1fb5c5b34ae3d42ad578a516424f58
-
SSDEEP
49152:kYREXSVMDi3UXipThIbXsPNIULkmp1/j6AeXZG7wmpvGF1IP9z5WuHC4O8b8ITDG:d2SVMD8UkhIbXsPN5kiQaZ56
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x00070000000233eb-5.dat family_gh0strat -
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\svchcst\Parameters\ServiceDll = "C:\\Windows\\system32\\240596968.bat" look2.exe -
Executes dropped EXE 3 IoCs
pid Process 1532 look2.exe 872 HD_84fe6ff652e079ae7278a707268163db03d90c46f3c209b72315b380d0a283ee.exe 2172 svchcst.exe -
Loads dropped DLL 3 IoCs
pid Process 1532 look2.exe 1612 svchost.exe 2172 svchcst.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\240596968.bat look2.exe File opened for modification C:\Windows\SysWOW64\ini.ini look2.exe File created C:\Windows\SysWOW64\svchcst.exe svchost.exe File opened for modification C:\Windows\SysWOW64\svchcst.exe svchost.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 84fe6ff652e079ae7278a707268163db03d90c46f3c209b72315b380d0a283ee.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3492 84fe6ff652e079ae7278a707268163db03d90c46f3c209b72315b380d0a283ee.exe 3492 84fe6ff652e079ae7278a707268163db03d90c46f3c209b72315b380d0a283ee.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3492 84fe6ff652e079ae7278a707268163db03d90c46f3c209b72315b380d0a283ee.exe 3492 84fe6ff652e079ae7278a707268163db03d90c46f3c209b72315b380d0a283ee.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3492 wrote to memory of 1532 3492 84fe6ff652e079ae7278a707268163db03d90c46f3c209b72315b380d0a283ee.exe 82 PID 3492 wrote to memory of 1532 3492 84fe6ff652e079ae7278a707268163db03d90c46f3c209b72315b380d0a283ee.exe 82 PID 3492 wrote to memory of 1532 3492 84fe6ff652e079ae7278a707268163db03d90c46f3c209b72315b380d0a283ee.exe 82 PID 3492 wrote to memory of 872 3492 84fe6ff652e079ae7278a707268163db03d90c46f3c209b72315b380d0a283ee.exe 85 PID 3492 wrote to memory of 872 3492 84fe6ff652e079ae7278a707268163db03d90c46f3c209b72315b380d0a283ee.exe 85 PID 3492 wrote to memory of 872 3492 84fe6ff652e079ae7278a707268163db03d90c46f3c209b72315b380d0a283ee.exe 85 PID 1612 wrote to memory of 2172 1612 svchost.exe 92 PID 1612 wrote to memory of 2172 1612 svchost.exe 92 PID 1612 wrote to memory of 2172 1612 svchost.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\84fe6ff652e079ae7278a707268163db03d90c46f3c209b72315b380d0a283ee.exe"C:\Users\Admin\AppData\Local\Temp\84fe6ff652e079ae7278a707268163db03d90c46f3c209b72315b380d0a283ee.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\look2.exeC:\Users\Admin\AppData\Local\Temp\\look2.exe2⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1532
-
-
C:\Users\Admin\AppData\Local\Temp\HD_84fe6ff652e079ae7278a707268163db03d90c46f3c209b72315b380d0a283ee.exeC:\Users\Admin\AppData\Local\Temp\HD_84fe6ff652e079ae7278a707268163db03d90c46f3c209b72315b380d0a283ee.exe2⤵
- Executes dropped EXE
PID:872
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "svchcst"1⤵PID:4904
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "svchcst"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\SysWOW64\svchcst.exeC:\Windows\system32\svchcst.exe "c:\windows\system32\240596968.bat",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HD_84fe6ff652e079ae7278a707268163db03d90c46f3c209b72315b380d0a283ee.exe
Filesize3.1MB
MD5fb083acd60fe5c3156dc25442be815e3
SHA161df59b8f3ebd8b3d29ca3aedc4995e23cacf6d8
SHA256f130b3789962d5c8b59aa250d6f26ad5945928f3905b32bf65aa7bd30348a794
SHA5127147337d2c1006bb15cfa967c9eea6826b63c8d343f866e7454d7368d25019f39e52cf179500810834244c3ca9644d6c0df0b2c3128a9051e9ee6b428fa926f6
-
Filesize
1.8MB
MD59502ec16b8dec9a7c8527b618dd5becc
SHA1f63bd9e3dd3628c3b115e2eb13325ce0f53864c1
SHA2563ac6e1eb7e77993c43c9a4f5de0234cef75c0622032d8c9953f33f4deaa77b85
SHA5128cd7b273a162be00b9a49807ff133dda779eec32dc0accca80de032f5355970f5525116556eb1fe9b6287a1aec037e0ecf32c6d32cb6e45b4d4370c149250b11
-
Filesize
337KB
MD52f3b6f16e33e28ad75f3fdaef2567807
SHA185e907340faf1edfc9210db85a04abd43d21b741
SHA25686492ebf2d6f471a5ee92977318d099b3ea86175b5b7ae522237ae01d07a4857
SHA512db17e99e2df918cfc9ccbe934adfe73f0777ce1ce9f28b57a4b24ecd821efe2e0b976a634853247b77b16627d2bb3af4ba20306059d1d25ef38ffada7da3e3a4
-
Filesize
51KB
MD544b9ac650e168f618a02db8caba7bd42
SHA1da69a34c636e200f11ccb856a4117f7918879a85
SHA256586fa6792b6cbb94d16979d14d3c27f04905f294db33d9e5c2ae240d1afa2540
SHA5127d3ca8b0eedce23465805c4a43d4a08914f7e1d673eb93ff978c43c290ee1e5f4bd6fb3d9f7795750470e75fedcf61682ea79c725048f593e9b1f01da5ef8955
-
Filesize
60KB
MD5889b99c52a60dd49227c5e485a016679
SHA18fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA2566cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA51208933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641