Overview

overview

10

Static

static

10

0ebfef7d60...7b.exe

windows7-x64

10

0ebfef7d60...7b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0ebfef7d6059b82e87e05a54e80e5a7b.virus

  • Size

    2.6MB

  • Sample

    240916-yw6sdaxemh

  • MD5

    0ebfef7d6059b82e87e05a54e80e5a7b

  • SHA1

    3c1ab9c072625b9e08b72013967b04bd2e0cb69e

  • SHA256

    4695fbf41abd54d1449d8da4a5976d50aec0499e3e2959e20686237d32db3114

  • SHA512

    a695816e77c3d569ba861fab022035910858cf2db0e15dd2a58398c6f39394add35172ca209de1d0d02019f5f0a4f35beb8e3ea56c4e0c37cb645379d1d9e5c9

  • SSDEEP

    24576:3bsATQUIP6braCWyv6BpHv+LOez9OulOcsV9DK2J2aBcpsam5RvikgJkf:3vbDCv+HOulOcQMYYsP5RviP6

Score
10/10
blackmoongh0stratmimikatzcredential_accessdiscoveryevasionpersistencerattrojan

Malware Config

Targets

    • Target

      0ebfef7d6059b82e87e05a54e80e5a7b.virus

    • Size

      2.6MB

    • MD5

      0ebfef7d6059b82e87e05a54e80e5a7b

    • SHA1

      3c1ab9c072625b9e08b72013967b04bd2e0cb69e

    • SHA256

      4695fbf41abd54d1449d8da4a5976d50aec0499e3e2959e20686237d32db3114

    • SHA512

      a695816e77c3d569ba861fab022035910858cf2db0e15dd2a58398c6f39394add35172ca209de1d0d02019f5f0a4f35beb8e3ea56c4e0c37cb645379d1d9e5c9

    • SSDEEP

      24576:3bsATQUIP6braCWyv6BpHv+LOez9OulOcsV9DK2J2aBcpsam5RvikgJkf:3vbDCv+HOulOcQMYYsP5RviP6

    Score
    10/10
    gh0stratmimikatzcredential_accessdiscoveryevasionpersistencerattrojan

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Mimikatz

      mimikatz is an open source tool to dump credentials on Windows.

      mimikatz

    • UAC bypass

      evasiontrojan

    • OS Credential Dumping: LSASS Memory

      Malicious access to Credentials History.

      credential_access

    • mimikatz is an open source tool to dump credentials on Windows

    • Blocklisted process makes network request

    • Server Software Component: Terminal Services DLL

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Server Software Component

1
T1505

Terminal Services DLL

1
T1505.005

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

3
T1112

Credential Access

OS Credential Dumping

1
T1003

LSASS Memory

1
T1003.001

Discovery

Network Service Discovery

1
T1046

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks