Analysis

  • max time kernel
    135s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/10/2024, 05:43

General

  • Target

    4bf4716f676a2f04988b968c5004fe83d363f1e11d09fdb9071a780116eabe89N.dll

  • Size

    137KB

  • MD5

    6e93d2f5ffab3061e8e01fa7e356f270

  • SHA1

    192f27b3b11a0f2c10790830fa15cb23cefb084c

  • SHA256

    4bf4716f676a2f04988b968c5004fe83d363f1e11d09fdb9071a780116eabe89

  • SHA512

    25a6acb46814f89c9c38e230c8539dc7350fb3b98dee63d59f7dd2e69e5c225de678ae047fefaff7ad96f1d096721355e568efde6afa56bf252f844a55ffa7c2

  • SSDEEP

    3072:NR02WMK8RJGInTlhnaBanONVk40rpg4yeF/TyUGSK9FrafcUksPxx6iTUu:A25GgFny61mra

Malware Config

Signatures

  • Gh0st RAT payload 3 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • Gh0strat family
  • Blocklisted process makes network request 1 IoCs
  • Boot or Logon Autostart Execution: Port Monitors 1 TTPs 16 IoCs

    Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

  • Sets service image path in registry 2 TTPs 2 IoCs
  • ACProtect 1.3x - 1.4x DLL software 16 IoCs

    Detects file using ACProtect software.

  • Drops file in System32 directory 6 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 4 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 12 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\4bf4716f676a2f04988b968c5004fe83d363f1e11d09fdb9071a780116eabe89N.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4932
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\4bf4716f676a2f04988b968c5004fe83d363f1e11d09fdb9071a780116eabe89N.dll,#1
      2⤵
      • Blocklisted process makes network request
      • Boot or Logon Autostart Execution: Port Monitors
      • Sets service image path in registry
      • Drops file in System32 directory
      • Suspicious use of SetThreadContext
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4452
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\system32\svchost.exe -k rundll32
        3⤵
        • Boot or Logon Autostart Execution: Port Monitors
        • Sets service image path in registry
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3720
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 616
        3⤵
        • Program crash
        PID:3028
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4452 -ip 4452
    1⤵
      PID:4536
    • C:\Windows\system32\Spoolsv.exe
      Spoolsv.exe
      1⤵
      • Boot or Logon Autostart Execution: Port Monitors
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:2152

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Windows\AppPatch\ComBack.Dll

            Filesize

            137KB

            MD5

            55528993f8d8d1bbced36770417fa979

            SHA1

            b40250215f807c99a0ea038e52a9fc68c2312e7d

            SHA256

            ae050e9ac73d9bbb20a1e614aec48af17f263c827ac5291d07fef3ca7b39fbda

            SHA512

            7019bb8c91673ac8bbf6f84661069d039aa496f175477f4c5cf9eb8e1bd010351b4da20812b9ee840f60bb382f1b261b2f172889b53d9bc3d8eb9321e6e2a6da

          • C:\Windows\SysWOW64\com\comb.dll

            Filesize

            128B

            MD5

            ca32d252121a0c19f041ae9b577123f1

            SHA1

            1feced36c661b4703f403c499cfb174f313773b2

            SHA256

            70330b6fdd428a12fbe87a8401e07feb29f7a2eedf07b77c26ce374502afdf13

            SHA512

            d11e0e865c9ec35b729a784c15b922868c43a6fbae706275bef4f2decb6aac13ae09c6504d315f715c2891b426b6a5f4ae6ab37b5ce23e02beb514bc4a9a0ae0

          • memory/3720-29-0x0000000002CD0000-0x0000000002CED000-memory.dmp

            Filesize

            116KB

          • memory/3720-24-0x0000000002CD0000-0x0000000002CED000-memory.dmp

            Filesize

            116KB

          • memory/3720-27-0x0000000002CD0000-0x0000000002CED000-memory.dmp

            Filesize

            116KB

          • memory/3720-25-0x0000000002CD0000-0x0000000002CED000-memory.dmp

            Filesize

            116KB

          • memory/3720-28-0x0000000002CD0000-0x0000000002CED000-memory.dmp

            Filesize

            116KB

          • memory/3720-31-0x0000000000E80000-0x0000000000EA7000-memory.dmp

            Filesize

            156KB

          • memory/3720-16-0x00000000008D0000-0x00000000008F3000-memory.dmp

            Filesize

            140KB

          • memory/3720-17-0x0000000000E80000-0x0000000000EA7000-memory.dmp

            Filesize

            156KB

          • memory/3720-18-0x0000000000E80000-0x0000000000EA7000-memory.dmp

            Filesize

            156KB

          • memory/3720-30-0x0000000002CD0000-0x0000000002CED000-memory.dmp

            Filesize

            116KB

          • memory/4452-5-0x0000000010000000-0x000000001001C000-memory.dmp

            Filesize

            112KB

          • memory/4452-14-0x0000000002A80000-0x0000000002A9D000-memory.dmp

            Filesize

            116KB

          • memory/4452-13-0x0000000002A80000-0x0000000002A9D000-memory.dmp

            Filesize

            116KB

          • memory/4452-7-0x0000000002A80000-0x0000000002A9D000-memory.dmp

            Filesize

            116KB

          • memory/4452-10-0x0000000002A80000-0x0000000002A9D000-memory.dmp

            Filesize

            116KB

          • memory/4452-6-0x0000000010000000-0x000000001001C000-memory.dmp

            Filesize

            112KB

          • memory/4452-12-0x0000000002A80000-0x0000000002A9D000-memory.dmp

            Filesize

            116KB

          • memory/4452-15-0x0000000002A80000-0x0000000002A9D000-memory.dmp

            Filesize

            116KB

          • memory/4452-32-0x0000000002A80000-0x0000000002A9D000-memory.dmp

            Filesize

            116KB

          • memory/4452-33-0x0000000010000000-0x000000001001C000-memory.dmp

            Filesize

            112KB

          • memory/4452-35-0x0000000043E50000-0x0000000043E77000-memory.dmp

            Filesize

            156KB