Analysis
-
max time kernel
117s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
31/10/2024, 05:40
Static task
static1
Behavioral task
behavioral1
Sample
4bf4716f676a2f04988b968c5004fe83d363f1e11d09fdb9071a780116eabe89N.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4bf4716f676a2f04988b968c5004fe83d363f1e11d09fdb9071a780116eabe89N.dll
Resource
win10v2004-20241007-en
General
-
Target
4bf4716f676a2f04988b968c5004fe83d363f1e11d09fdb9071a780116eabe89N.dll
-
Size
137KB
-
MD5
6e93d2f5ffab3061e8e01fa7e356f270
-
SHA1
192f27b3b11a0f2c10790830fa15cb23cefb084c
-
SHA256
4bf4716f676a2f04988b968c5004fe83d363f1e11d09fdb9071a780116eabe89
-
SHA512
25a6acb46814f89c9c38e230c8539dc7350fb3b98dee63d59f7dd2e69e5c225de678ae047fefaff7ad96f1d096721355e568efde6afa56bf252f844a55ffa7c2
-
SSDEEP
3072:NR02WMK8RJGInTlhnaBanONVk40rpg4yeF/TyUGSK9FrafcUksPxx6iTUu:A25GgFny61mra
Malware Config
Signatures
-
Gh0st RAT payload 4 IoCs
resource yara_rule behavioral2/memory/4644-5-0x0000000010000000-0x000000001001C000-memory.dmp family_gh0strat behavioral2/memory/4644-6-0x0000000010000000-0x000000001001C000-memory.dmp family_gh0strat behavioral2/memory/4644-33-0x0000000010000000-0x000000001001C000-memory.dmp family_gh0strat behavioral2/memory/1888-37-0x0000000010000000-0x000000001001C000-memory.dmp family_gh0strat -
Gh0strat family
-
Boot or Logon Autostart Execution: Port Monitors 1 TTPs 16 IoCs
Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Local Port Spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Microsoft Shared Fax Monitor Spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Standard TCP/IP Port\Ports Spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\USB Monitor Spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port Spoolsv.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\SCSI Port Monitor\Driver = "scsimon.dll" rundll32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\IPP Spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\WSPrint\OfflinePorts Spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\WSPrint Spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\SCSI Port Monitor rundll32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\SCSI Port Monitor svchost.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\SCSI Port Monitor\Driver = "scsimon.dll" svchost.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Appmon Spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Appmon\Ports Spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Standard TCP/IP Port Spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Ports Spoolsv.exe -
Sets service image path in registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Spooler\ImagePath = "Spoolsv.exe" rundll32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Spooler\ImagePath = "Spoolsv.exe" svchost.exe -
ACProtect 1.3x - 1.4x DLL software 16 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/memory/4644-5-0x0000000010000000-0x000000001001C000-memory.dmp acprotect behavioral2/memory/4644-6-0x0000000010000000-0x000000001001C000-memory.dmp acprotect behavioral2/memory/4644-7-0x0000000002A40000-0x0000000002A5D000-memory.dmp acprotect behavioral2/memory/4644-14-0x0000000002A40000-0x0000000002A5D000-memory.dmp acprotect behavioral2/memory/4644-13-0x0000000002A40000-0x0000000002A5D000-memory.dmp acprotect behavioral2/memory/4644-15-0x0000000002A40000-0x0000000002A5D000-memory.dmp acprotect behavioral2/memory/4644-12-0x0000000002A40000-0x0000000002A5D000-memory.dmp acprotect behavioral2/memory/4644-10-0x0000000002A40000-0x0000000002A5D000-memory.dmp acprotect behavioral2/memory/1888-26-0x0000000002A80000-0x0000000002A9D000-memory.dmp acprotect behavioral2/memory/1888-25-0x0000000002A80000-0x0000000002A9D000-memory.dmp acprotect behavioral2/memory/1888-29-0x0000000002A80000-0x0000000002A9D000-memory.dmp acprotect behavioral2/memory/1888-30-0x0000000002A80000-0x0000000002A9D000-memory.dmp acprotect behavioral2/memory/1888-31-0x0000000002A80000-0x0000000002A9D000-memory.dmp acprotect behavioral2/memory/1888-28-0x0000000002A80000-0x0000000002A9D000-memory.dmp acprotect behavioral2/memory/4644-33-0x0000000010000000-0x000000001001C000-memory.dmp acprotect behavioral2/memory/1888-37-0x0000000010000000-0x000000001001C000-memory.dmp acprotect -
Drops file in System32 directory 6 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\com\comb.dll rundll32.exe File opened for modification C:\Windows\SysWOW64\com\comb.dll svchost.exe File opened for modification C:\Windows\SysWOW64\Miscson.dll svchost.exe File created C:\Windows\SysWOW64\Miscson.dll svchost.exe File opened for modification C:\Windows\SysWOW64\scsimon.dll svchost.exe File created C:\Windows\SysWOW64\scsimon.dll svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4644 set thread context of 1888 4644 rundll32.exe 87 -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\AppPatch\AcSvcst.dll rundll32.exe File opened for modification C:\Windows\AppPatch\ComBack.Dll rundll32.exe File created C:\Windows\AppPatch\ComBack.Dll rundll32.exe File opened for modification C:\Windows\AppPatch\AcSvcst.dll rundll32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2588 4644 WerFault.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID Spoolsv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID Spoolsv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID Spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 Spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002 Spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 Spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 Spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002 Spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 Spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002 Spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002 Spoolsv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID Spoolsv.exe -
Modifies data under HKEY_USERS 22 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Fax = "winspool,Ne02:" Spoolsv.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts Spoolsv.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Devices Spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Send To OneNote 2016 = "winspool,nul:,15,45" Spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Microsoft XPS Document Writer = "winspool,Ne00:" Spoolsv.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\Devices Spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Send To OneNote 2016 = "winspool,nul:" Spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft XPS Document Writer = "winspool,Ne00:,15,45" Spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Microsoft Print to PDF = "winspool,Ne01:" Spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Send To OneNote 2016 = "winspool,nul:" Spoolsv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts Spoolsv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Devices Spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft Print to PDF = "winspool,Ne01:,15,45" Spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Fax = "winspool,Ne02:,15,45" Spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Send To OneNote 2016 = "winspool,nul:,15,45" Spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Microsoft XPS Document Writer = "winspool,Ne00:" Spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft XPS Document Writer = "winspool,Ne00:,15,45" Spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Microsoft Print to PDF = "winspool,Ne01:" Spoolsv.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts Spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Fax = "winspool,Ne02:" Spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Fax = "winspool,Ne02:,15,45" Spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft Print to PDF = "winspool,Ne01:,15,45" Spoolsv.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4644 rundll32.exe Token: SeDebugPrivilege 1888 svchost.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 4796 wrote to memory of 4644 4796 rundll32.exe 84 PID 4796 wrote to memory of 4644 4796 rundll32.exe 84 PID 4796 wrote to memory of 4644 4796 rundll32.exe 84 PID 4644 wrote to memory of 1888 4644 rundll32.exe 87 PID 4644 wrote to memory of 1888 4644 rundll32.exe 87 PID 4644 wrote to memory of 1888 4644 rundll32.exe 87 PID 4644 wrote to memory of 1888 4644 rundll32.exe 87
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bf4716f676a2f04988b968c5004fe83d363f1e11d09fdb9071a780116eabe89N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bf4716f676a2f04988b968c5004fe83d363f1e11d09fdb9071a780116eabe89N.dll,#12⤵
- Boot or Logon Autostart Execution: Port Monitors
- Sets service image path in registry
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe -k rundll323⤵
- Boot or Logon Autostart Execution: Port Monitors
- Sets service image path in registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1888
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 6243⤵
- Program crash
PID:2588
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4644 -ip 46441⤵PID:4464
-
C:\Windows\system32\Spoolsv.exeSpoolsv.exe1⤵
- Boot or Logon Autostart Execution: Port Monitors
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4076
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Port Monitors
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Port Monitors
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
137KB
MD50da96aa041ba5963ca73e90ffd76f4a8
SHA1551e166d249e9154d0a09b9ff112b826deb027b6
SHA2569029fef00a4cdcce08dca05391ac27d7253bcb8e681eed4bfbc80b324f21373f
SHA512c05711ea4c93d0dedfd80d84bd11aab05acdd6b18550d814d0f6fa6e71bf6584668f0c5492af15090aff1c4d99f2b906863d1799c1e87cff9f12da16b83bf1b6
-
Filesize
128B
MD5a55d866bdad706ee4c76e10ee9c45568
SHA1f1062648d90d48737e97c18a87c5bd289a6ad323
SHA256e4e6a98a794b7e1fea98a3d28b53f214e82a268201ece3670238e2dc4df64e27
SHA512d298a1cef433139ea300ccb39283c0d513ab320ad389064d5a01a37ec2e30a28c78b1d1b66a00a068b636e84380e6946bcac74201dd723232a8b3a1ffcf13cd3