Analysis
-
max time kernel
107s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-11-2024 02:41
General
-
Target
5a5f13d201e227857558c902ec71da7810514cdc3c10a908b9dd2aeea7db7844.dll
-
Size
137KB
-
MD5
6bb8264813d9675d10eddd7a04ae8b68
-
SHA1
158f34b4e145839e790cbe55b75deded67d78057
-
SHA256
5a5f13d201e227857558c902ec71da7810514cdc3c10a908b9dd2aeea7db7844
-
SHA512
76f7bda14c3ba324b03cab0844389c87dc001403cd41a88ee7b01fee4c1feed716d5dbcfd6d1744b1154aa97c5151c4b85e21a8b3c90a9fa4072a7378c57d7d9
-
SSDEEP
3072:BR02WMK8RJGInTlhnaBanONVk40rpg4yeF/TyUGSK9FrafcUksPxx6iTUuY:M25GgFny61mra6
Malware Config
Signatures
-
Gh0st RAT payload 6 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
Boot or Logon Autostart Execution: Port Monitors 1 TTPs 28 IoCs
Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.
-
Sets service image path in registry 2 TTPs 2 IoCs
-
ACProtect 1.3x - 1.4x DLL software 17 IoCs
Detects file using ACProtect software.
-
Drops file in System32 directory 6 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Windows directory 4 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 24 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 44 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5a5f13d201e227857558c902ec71da7810514cdc3c10a908b9dd2aeea7db7844.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5a5f13d201e227857558c902ec71da7810514cdc3c10a908b9dd2aeea7db7844.dll,#12⤵
- Boot or Logon Autostart Execution: Port Monitors
- Sets service image path in registry
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 6163⤵
- Program crash
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe -k rundll323⤵
- Boot or Logon Autostart Execution: Port Monitors
- Sets service image path in registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 1668 -ip 16681⤵
-
C:\Windows\system32\Spoolsv.exeSpoolsv.exe1⤵
- Boot or Logon Autostart Execution: Port Monitors
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
C:\Windows\system32\Spoolsv.exeSpoolsv.exe1⤵
- Boot or Logon Autostart Execution: Port Monitors
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Port Monitors
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Port Monitors
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
137KB
MD56daf04565c14357f3e855cec2ccb510b
SHA1168357fd477db856ed2527e2baf9833a40f59ab3
SHA25640bfc661512e65143162d2eece51f12d5df0eb3b40a7d4162cd57ec8f0b5d8c8
SHA5124848a5e3494de64e0d73bd7c7c495b1106dd6e6b697c5ddd35b14fd37fdff56cbfa17d39ef1c1aae9f4da7e594a49666a57a3866505ecb182788fd2e6fd39111
-
Filesize
128B
MD589f27b9bc70c4d39f4e62de5568f666f
SHA122bf9f199cb1f57a515809c00f0127555591ccc3
SHA256e5d5bd8e47b93548027150445de43cdbb62d598221499d7dc3574fc94b3de3f5
SHA5128b13b9f353a16b5853b3a72d554d0bcb7879e7236d21a7ae1cf80d62331dd0f5e464478cfbad89a8e0dace5b78b2e658476760ba5b27cbcd1c72d30d0483bc5f
-
Filesize
156KB
-
Filesize
116KB
-
Filesize
156KB
-
Filesize
140KB
-
Filesize
156KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
112KB
-
Filesize
156KB
-
Filesize
112KB
-
Filesize
116KB
-
Filesize
112KB
-
Filesize
156KB
-
Filesize
112KB
-
Filesize
112KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
112KB
-
Filesize
116KB