Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
17/10/2024, 01:59
Static task
static1
Behavioral task
behavioral1
Sample
d8cdfaa3df200a38488e37eb608e4dc91931c16409f14a28b842a21ec9fa15da.exe
Resource
win7-20240708-en
General
-
Target
d8cdfaa3df200a38488e37eb608e4dc91931c16409f14a28b842a21ec9fa15da.exe
-
Size
96KB
-
MD5
373047647bd25c1d3aa9cd960bcd7af8
-
SHA1
5436d03709612a6b1aa2ebbc9609de33c34b3260
-
SHA256
d8cdfaa3df200a38488e37eb608e4dc91931c16409f14a28b842a21ec9fa15da
-
SHA512
e1ef29b53678bdcf242004cc03494d2b85e16aea86a801ccb000a4e45a0ad2f6448c6426401cd86d3731d1a3aa024c154a8402811ea8b2b97285fa646a86b301
-
SSDEEP
1536:1kFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8pr9SNsMSaSKd:1WS4jHS8q/3nTzePCwNUh4E99SNiKd
Malware Config
Signatures
-
Gh0st RAT payload 4 IoCs
resource yara_rule behavioral1/files/0x0009000000015fa5-19.dat family_gh0strat behavioral1/memory/1996-21-0x0000000000400000-0x000000000044E2D4-memory.dmp family_gh0strat behavioral1/memory/2792-24-0x0000000020000000-0x0000000020027000-memory.dmp family_gh0strat behavioral1/memory/2792-26-0x0000000020000000-0x0000000020027000-memory.dmp family_gh0strat -
Deletes itself 1 IoCs
pid Process 1996 dmlfgtvnni -
Executes dropped EXE 1 IoCs
pid Process 1996 dmlfgtvnni -
Loads dropped DLL 3 IoCs
pid Process 2024 d8cdfaa3df200a38488e37eb608e4dc91931c16409f14a28b842a21ec9fa15da.exe 2024 d8cdfaa3df200a38488e37eb608e4dc91931c16409f14a28b842a21ec9fa15da.exe 2792 svchost.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 svchost.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\xymjqmnjfg svchost.exe File created C:\Windows\SysWOW64\xhbcypqgrc svchost.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d8cdfaa3df200a38488e37eb608e4dc91931c16409f14a28b842a21ec9fa15da.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dmlfgtvnni Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum svchost.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1996 dmlfgtvnni 2792 svchost.exe 2792 svchost.exe -
Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeRestorePrivilege 1996 dmlfgtvnni Token: SeBackupPrivilege 1996 dmlfgtvnni Token: SeBackupPrivilege 1996 dmlfgtvnni Token: SeRestorePrivilege 1996 dmlfgtvnni Token: SeBackupPrivilege 2792 svchost.exe Token: SeRestorePrivilege 2792 svchost.exe Token: SeBackupPrivilege 2792 svchost.exe Token: SeBackupPrivilege 2792 svchost.exe Token: SeSecurityPrivilege 2792 svchost.exe Token: SeSecurityPrivilege 2792 svchost.exe Token: SeBackupPrivilege 2792 svchost.exe Token: SeBackupPrivilege 2792 svchost.exe Token: SeSecurityPrivilege 2792 svchost.exe Token: SeBackupPrivilege 2792 svchost.exe Token: SeBackupPrivilege 2792 svchost.exe Token: SeSecurityPrivilege 2792 svchost.exe Token: SeBackupPrivilege 2792 svchost.exe Token: SeRestorePrivilege 2792 svchost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2024 wrote to memory of 1996 2024 d8cdfaa3df200a38488e37eb608e4dc91931c16409f14a28b842a21ec9fa15da.exe 30 PID 2024 wrote to memory of 1996 2024 d8cdfaa3df200a38488e37eb608e4dc91931c16409f14a28b842a21ec9fa15da.exe 30 PID 2024 wrote to memory of 1996 2024 d8cdfaa3df200a38488e37eb608e4dc91931c16409f14a28b842a21ec9fa15da.exe 30 PID 2024 wrote to memory of 1996 2024 d8cdfaa3df200a38488e37eb608e4dc91931c16409f14a28b842a21ec9fa15da.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\d8cdfaa3df200a38488e37eb608e4dc91931c16409f14a28b842a21ec9fa15da.exe"C:\Users\Admin\AppData\Local\Temp\d8cdfaa3df200a38488e37eb608e4dc91931c16409f14a28b842a21ec9fa15da.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\users\admin\appdata\local\dmlfgtvnni"C:\Users\Admin\AppData\Local\Temp\d8cdfaa3df200a38488e37eb608e4dc91931c16409f14a28b842a21ec9fa15da.exe" a -sc:\users\admin\appdata\local\temp\d8cdfaa3df200a38488e37eb608e4dc91931c16409f14a28b842a21ec9fa15da.exe2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1996
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2792
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
23.1MB
MD5b94bbc4be04f1363ebdbc3ab1dedcd76
SHA170865923f59072870144fb15c59bf7314c0e53b0
SHA2563e8e9926caa48b1e7905806cee79d12b8906631747905c4c6a5d40a36e61cddb
SHA512b48ed376f4608e4c1356049d0922ca7ff3637096d7ae50f8c35080822b53331c0b21d118406f9e5dd028ddcf97172911c79e2e9483696925a188c6d818cc614f
-
Filesize
24.3MB
MD597b96987701e9a9ee570d9c516dccc45
SHA146d3e94b2f0cba3dd0593865605f93ae85e58c97
SHA25677a35e30f6dfefd9b72d182343bc970d8247dd23f1c8ea964f077cb766b03e39
SHA51203ac1840abd8c333aca6493957760b17839ea933422240d74fc5acdc3394aee4e586e627d6158585c49cff805c88e23da6f0d67bc9b70e8166cbf8c00d9fd14a