Analysis
-
max time kernel
135s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
31/10/2024, 05:43
Static task
static1
Behavioral task
behavioral1
Sample
4bf4716f676a2f04988b968c5004fe83d363f1e11d09fdb9071a780116eabe89N.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4bf4716f676a2f04988b968c5004fe83d363f1e11d09fdb9071a780116eabe89N.dll
Resource
win10v2004-20241007-en
General
-
Target
4bf4716f676a2f04988b968c5004fe83d363f1e11d09fdb9071a780116eabe89N.dll
-
Size
137KB
-
MD5
6e93d2f5ffab3061e8e01fa7e356f270
-
SHA1
192f27b3b11a0f2c10790830fa15cb23cefb084c
-
SHA256
4bf4716f676a2f04988b968c5004fe83d363f1e11d09fdb9071a780116eabe89
-
SHA512
25a6acb46814f89c9c38e230c8539dc7350fb3b98dee63d59f7dd2e69e5c225de678ae047fefaff7ad96f1d096721355e568efde6afa56bf252f844a55ffa7c2
-
SSDEEP
3072:NR02WMK8RJGInTlhnaBanONVk40rpg4yeF/TyUGSK9FrafcUksPxx6iTUu:A25GgFny61mra
Malware Config
Signatures
-
Gh0st RAT payload 3 IoCs
resource yara_rule behavioral2/memory/4452-5-0x0000000010000000-0x000000001001C000-memory.dmp family_gh0strat behavioral2/memory/4452-6-0x0000000010000000-0x000000001001C000-memory.dmp family_gh0strat behavioral2/memory/4452-33-0x0000000010000000-0x000000001001C000-memory.dmp family_gh0strat -
Gh0strat family
-
Blocklisted process makes network request 1 IoCs
flow pid Process 2 4452 rundll32.exe -
Boot or Logon Autostart Execution: Port Monitors 1 TTPs 16 IoCs
Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Appmon\Ports Spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Standard TCP/IP Port Spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Standard TCP/IP Port\Ports Spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\USB Monitor Spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\WSPrint Spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\SCSI Port Monitor rundll32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\SCSI Port Monitor\Driver = "scsimon.dll" rundll32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\SCSI Port Monitor svchost.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\WSPrint\OfflinePorts Spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Local Port Spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Microsoft Shared Fax Monitor Spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Ports Spoolsv.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\SCSI Port Monitor\Driver = "scsimon.dll" svchost.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Appmon Spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port Spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\IPP Spoolsv.exe -
Sets service image path in registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Spooler\ImagePath = "Spoolsv.exe" rundll32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Spooler\ImagePath = "Spoolsv.exe" svchost.exe -
ACProtect 1.3x - 1.4x DLL software 16 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/memory/4452-7-0x0000000002A80000-0x0000000002A9D000-memory.dmp acprotect behavioral2/memory/4452-5-0x0000000010000000-0x000000001001C000-memory.dmp acprotect behavioral2/memory/4452-13-0x0000000002A80000-0x0000000002A9D000-memory.dmp acprotect behavioral2/memory/4452-14-0x0000000002A80000-0x0000000002A9D000-memory.dmp acprotect behavioral2/memory/4452-15-0x0000000002A80000-0x0000000002A9D000-memory.dmp acprotect behavioral2/memory/4452-12-0x0000000002A80000-0x0000000002A9D000-memory.dmp acprotect behavioral2/memory/4452-6-0x0000000010000000-0x000000001001C000-memory.dmp acprotect behavioral2/memory/4452-10-0x0000000002A80000-0x0000000002A9D000-memory.dmp acprotect behavioral2/memory/3720-24-0x0000000002CD0000-0x0000000002CED000-memory.dmp acprotect behavioral2/memory/3720-30-0x0000000002CD0000-0x0000000002CED000-memory.dmp acprotect behavioral2/memory/3720-29-0x0000000002CD0000-0x0000000002CED000-memory.dmp acprotect behavioral2/memory/3720-28-0x0000000002CD0000-0x0000000002CED000-memory.dmp acprotect behavioral2/memory/3720-25-0x0000000002CD0000-0x0000000002CED000-memory.dmp acprotect behavioral2/memory/3720-27-0x0000000002CD0000-0x0000000002CED000-memory.dmp acprotect behavioral2/memory/4452-32-0x0000000002A80000-0x0000000002A9D000-memory.dmp acprotect behavioral2/memory/4452-33-0x0000000010000000-0x000000001001C000-memory.dmp acprotect -
Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\scsimon.dll svchost.exe File opened for modification C:\Windows\SysWOW64\com\comb.dll rundll32.exe File opened for modification C:\Windows\SysWOW64\com\comb.dll svchost.exe File opened for modification C:\Windows\SysWOW64\Miscson.dll svchost.exe File created C:\Windows\SysWOW64\Miscson.dll svchost.exe File opened for modification C:\Windows\SysWOW64\scsimon.dll svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4452 set thread context of 3720 4452 rundll32.exe 88 -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\AppPatch\ComBack.Dll rundll32.exe File created C:\Windows\AppPatch\ComBack.Dll rundll32.exe File opened for modification C:\Windows\AppPatch\AcSvcst.dll rundll32.exe File created C:\Windows\AppPatch\AcSvcst.dll rundll32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 3028 4452 WerFault.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID Spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 Spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 Spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002 Spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 Spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002 Spoolsv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID Spoolsv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID Spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002 Spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 Spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002 Spoolsv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID Spoolsv.exe -
Modifies data under HKEY_USERS 22 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts Spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Send To OneNote 2016 = "winspool,nul:" Spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Send To OneNote 2016 = "winspool,nul:,15,45" Spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft XPS Document Writer = "winspool,Ne00:,15,45" Spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Microsoft Print to PDF = "winspool,Ne01:" Spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft Print to PDF = "winspool,Ne01:,15,45" Spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Fax = "winspool,Ne02:,15,45" Spoolsv.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Devices Spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft XPS Document Writer = "winspool,Ne00:,15,45" Spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Microsoft XPS Document Writer = "winspool,Ne00:" Spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Fax = "winspool,Ne02:" Spoolsv.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts Spoolsv.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts Spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Microsoft XPS Document Writer = "winspool,Ne00:" Spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Send To OneNote 2016 = "winspool,nul:" Spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Send To OneNote 2016 = "winspool,nul:,15,45" Spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Microsoft Print to PDF = "winspool,Ne01:" Spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Fax = "winspool,Ne02:,15,45" Spoolsv.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\Devices Spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft Print to PDF = "winspool,Ne01:,15,45" Spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Fax = "winspool,Ne02:" Spoolsv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Devices Spoolsv.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4452 rundll32.exe Token: SeDebugPrivilege 3720 svchost.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 4932 wrote to memory of 4452 4932 rundll32.exe 84 PID 4932 wrote to memory of 4452 4932 rundll32.exe 84 PID 4932 wrote to memory of 4452 4932 rundll32.exe 84 PID 4452 wrote to memory of 3720 4452 rundll32.exe 88 PID 4452 wrote to memory of 3720 4452 rundll32.exe 88 PID 4452 wrote to memory of 3720 4452 rundll32.exe 88 PID 4452 wrote to memory of 3720 4452 rundll32.exe 88
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bf4716f676a2f04988b968c5004fe83d363f1e11d09fdb9071a780116eabe89N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bf4716f676a2f04988b968c5004fe83d363f1e11d09fdb9071a780116eabe89N.dll,#12⤵
- Blocklisted process makes network request
- Boot or Logon Autostart Execution: Port Monitors
- Sets service image path in registry
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe -k rundll323⤵
- Boot or Logon Autostart Execution: Port Monitors
- Sets service image path in registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3720
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 6163⤵
- Program crash
PID:3028
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4452 -ip 44521⤵PID:4536
-
C:\Windows\system32\Spoolsv.exeSpoolsv.exe1⤵
- Boot or Logon Autostart Execution: Port Monitors
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:2152
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Port Monitors
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Port Monitors
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
137KB
MD555528993f8d8d1bbced36770417fa979
SHA1b40250215f807c99a0ea038e52a9fc68c2312e7d
SHA256ae050e9ac73d9bbb20a1e614aec48af17f263c827ac5291d07fef3ca7b39fbda
SHA5127019bb8c91673ac8bbf6f84661069d039aa496f175477f4c5cf9eb8e1bd010351b4da20812b9ee840f60bb382f1b261b2f172889b53d9bc3d8eb9321e6e2a6da
-
Filesize
128B
MD5ca32d252121a0c19f041ae9b577123f1
SHA11feced36c661b4703f403c499cfb174f313773b2
SHA25670330b6fdd428a12fbe87a8401e07feb29f7a2eedf07b77c26ce374502afdf13
SHA512d11e0e865c9ec35b729a784c15b922868c43a6fbae706275bef4f2decb6aac13ae09c6504d315f715c2891b426b6a5f4ae6ab37b5ce23e02beb514bc4a9a0ae0