Analysis
-
max time kernel
140s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
20-08-2024 14:12
Behavioral task
behavioral1
Sample
ExeFile (24).exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
ExeFile (24).exe
Resource
win10v2004-20240802-en
General
-
Target
ExeFile (24).exe
-
Size
112KB
-
MD5
ca1ad33af1b5a62528075b8d3c69472d
-
SHA1
8d7307b490bf258572530fba14b0462b7cb974e7
-
SHA256
46f227d962a503eb6276f99d63b891e8de60a1eaf02c768ac4b0aba2e3ac5d56
-
SHA512
3ee3b2a1a88fb9be5211a104c3544afa2e59669554d28f149ee62ea3c15ec870ab8d3fc69f32f06006643d2281e01d829969e9a948333b541063225bfeea8ba9
-
SSDEEP
1536:vqEA70HzLJksPEOajozLElnqiO2sdJ/tHi:vXTLJkQ7zAV3OtC
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x000800000002345a-1.dat family_gh0strat -
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\serivces\Parameters\ServiceDll = "C:\\Windows\\fonts\\240623375.dll" ExeFile (24).exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation ExeFile (24).exe -
Executes dropped EXE 1 IoCs
pid Process 1260 serivces.exe -
Loads dropped DLL 3 IoCs
pid Process 1760 ExeFile (24).exe 3560 svchost.exe 1260 serivces.exe -
Creates a Windows Service
-
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\serivces.exe svchost.exe File opened for modification C:\Windows\SysWOW64\serivces.exe svchost.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\fonts\240623375.dll ExeFile (24).exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ExeFile (24).exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language serivces.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1400 cmd.exe 4124 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4124 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1760 ExeFile (24).exe 1760 ExeFile (24).exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1760 ExeFile (24).exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1760 ExeFile (24).exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1760 wrote to memory of 1400 1760 ExeFile (24).exe 86 PID 1760 wrote to memory of 1400 1760 ExeFile (24).exe 86 PID 1760 wrote to memory of 1400 1760 ExeFile (24).exe 86 PID 1400 wrote to memory of 4124 1400 cmd.exe 89 PID 1400 wrote to memory of 4124 1400 cmd.exe 89 PID 1400 wrote to memory of 4124 1400 cmd.exe 89 PID 3560 wrote to memory of 1260 3560 svchost.exe 95 PID 3560 wrote to memory of 1260 3560 svchost.exe 95 PID 3560 wrote to memory of 1260 3560 svchost.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\ExeFile (24).exe"C:\Users\Admin\AppData\Local\Temp\ExeFile (24).exe"1⤵
- Server Software Component: Terminal Services DLL
- Checks computer location settings
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\Admin\AppData\Local\Temp\ExeFile (24).exe"2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4124
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "serivces"1⤵PID:3300
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "serivces"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Windows\SysWOW64\serivces.exeC:\Windows\system32\serivces.exe "c:\windows\fonts\240623375.dll",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1260
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD5d120109c51cdb5187c0b926bbbecc7af
SHA11fef747d87dcf29e3dec31c5bdf71d05ef6f2b4e
SHA2560649e4500086724bb606fb46726a6c9c4c7fce062fb8c9eb3d9149200432a08f
SHA5129ae1a041d004e2ccd16feaf6918b3410dfc6a96bac4fc7857a6c9b767101cb725f0113e9cc4ddaaf832b02ece5d48effc0bb0a2423c11fbeb8b73cb6cdbfbd9c
-
Filesize
60KB
MD5889b99c52a60dd49227c5e485a016679
SHA18fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA2566cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA51208933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641