Analysis

  • max time kernel
    117s
  • max time network
    110s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/10/2024, 05:40

General

  • Target

    4bf4716f676a2f04988b968c5004fe83d363f1e11d09fdb9071a780116eabe89N.dll

  • Size

    137KB

  • MD5

    6e93d2f5ffab3061e8e01fa7e356f270

  • SHA1

    192f27b3b11a0f2c10790830fa15cb23cefb084c

  • SHA256

    4bf4716f676a2f04988b968c5004fe83d363f1e11d09fdb9071a780116eabe89

  • SHA512

    25a6acb46814f89c9c38e230c8539dc7350fb3b98dee63d59f7dd2e69e5c225de678ae047fefaff7ad96f1d096721355e568efde6afa56bf252f844a55ffa7c2

  • SSDEEP

    3072:NR02WMK8RJGInTlhnaBanONVk40rpg4yeF/TyUGSK9FrafcUksPxx6iTUu:A25GgFny61mra

Malware Config

Signatures

  • Gh0st RAT payload 4 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • Gh0strat family
  • Boot or Logon Autostart Execution: Port Monitors 1 TTPs 16 IoCs

    Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

  • Sets service image path in registry 2 TTPs 2 IoCs
  • ACProtect 1.3x - 1.4x DLL software 16 IoCs

    Detects file using ACProtect software.

  • Drops file in System32 directory 6 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 4 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 12 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\4bf4716f676a2f04988b968c5004fe83d363f1e11d09fdb9071a780116eabe89N.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4796
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\4bf4716f676a2f04988b968c5004fe83d363f1e11d09fdb9071a780116eabe89N.dll,#1
      2⤵
      • Boot or Logon Autostart Execution: Port Monitors
      • Sets service image path in registry
      • Drops file in System32 directory
      • Suspicious use of SetThreadContext
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4644
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\system32\svchost.exe -k rundll32
        3⤵
        • Boot or Logon Autostart Execution: Port Monitors
        • Sets service image path in registry
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1888
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 624
        3⤵
        • Program crash
        PID:2588
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4644 -ip 4644
    1⤵
      PID:4464
    • C:\Windows\system32\Spoolsv.exe
      Spoolsv.exe
      1⤵
      • Boot or Logon Autostart Execution: Port Monitors
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:4076

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Windows\AppPatch\ComBack.Dll

            Filesize

            137KB

            MD5

            0da96aa041ba5963ca73e90ffd76f4a8

            SHA1

            551e166d249e9154d0a09b9ff112b826deb027b6

            SHA256

            9029fef00a4cdcce08dca05391ac27d7253bcb8e681eed4bfbc80b324f21373f

            SHA512

            c05711ea4c93d0dedfd80d84bd11aab05acdd6b18550d814d0f6fa6e71bf6584668f0c5492af15090aff1c4d99f2b906863d1799c1e87cff9f12da16b83bf1b6

          • C:\Windows\SysWOW64\com\comb.dll

            Filesize

            128B

            MD5

            a55d866bdad706ee4c76e10ee9c45568

            SHA1

            f1062648d90d48737e97c18a87c5bd289a6ad323

            SHA256

            e4e6a98a794b7e1fea98a3d28b53f214e82a268201ece3670238e2dc4df64e27

            SHA512

            d298a1cef433139ea300ccb39283c0d513ab320ad389064d5a01a37ec2e30a28c78b1d1b66a00a068b636e84380e6946bcac74201dd723232a8b3a1ffcf13cd3

          • memory/1888-31-0x0000000002A80000-0x0000000002A9D000-memory.dmp

            Filesize

            116KB

          • memory/1888-19-0x0000000000D50000-0x0000000000D77000-memory.dmp

            Filesize

            156KB

          • memory/1888-37-0x0000000010000000-0x000000001001C000-memory.dmp

            Filesize

            112KB

          • memory/1888-36-0x0000000000D50000-0x0000000000D77000-memory.dmp

            Filesize

            156KB

          • memory/1888-28-0x0000000002A80000-0x0000000002A9D000-memory.dmp

            Filesize

            116KB

          • memory/1888-18-0x0000000000D50000-0x0000000000D77000-memory.dmp

            Filesize

            156KB

          • memory/1888-17-0x00000000005B0000-0x00000000005D3000-memory.dmp

            Filesize

            140KB

          • memory/1888-16-0x0000000000D50000-0x0000000000D77000-memory.dmp

            Filesize

            156KB

          • memory/1888-30-0x0000000002A80000-0x0000000002A9D000-memory.dmp

            Filesize

            116KB

          • memory/1888-26-0x0000000002A80000-0x0000000002A9D000-memory.dmp

            Filesize

            116KB

          • memory/1888-29-0x0000000002A80000-0x0000000002A9D000-memory.dmp

            Filesize

            116KB

          • memory/1888-25-0x0000000002A80000-0x0000000002A9D000-memory.dmp

            Filesize

            116KB

          • memory/4644-6-0x0000000010000000-0x000000001001C000-memory.dmp

            Filesize

            112KB

          • memory/4644-7-0x0000000002A40000-0x0000000002A5D000-memory.dmp

            Filesize

            116KB

          • memory/4644-14-0x0000000002A40000-0x0000000002A5D000-memory.dmp

            Filesize

            116KB

          • memory/4644-10-0x0000000002A40000-0x0000000002A5D000-memory.dmp

            Filesize

            116KB

          • memory/4644-5-0x0000000010000000-0x000000001001C000-memory.dmp

            Filesize

            112KB

          • memory/4644-12-0x0000000002A40000-0x0000000002A5D000-memory.dmp

            Filesize

            116KB

          • memory/4644-33-0x0000000010000000-0x000000001001C000-memory.dmp

            Filesize

            112KB

          • memory/4644-35-0x0000000043E50000-0x0000000043E77000-memory.dmp

            Filesize

            156KB

          • memory/4644-15-0x0000000002A40000-0x0000000002A5D000-memory.dmp

            Filesize

            116KB

          • memory/4644-13-0x0000000002A40000-0x0000000002A5D000-memory.dmp

            Filesize

            116KB