Overview
overview
10Static
static
10客户端(...EY.exe
windows7-x64
9客户端(...EY.exe
windows10-2004-x64
906432
ubuntu-22.04-amd64
71.html
windows7-x64
31.html
windows10-2004-x64
3518_2.exe
windows7-x64
4518_2.exe
windows10-2004-x64
4520.exe
windows7-x64
4520.exe
windows10-2004-x64
410711.exe
windows7-x64
310711.exe
windows10-2004-x64
3711.exe
windows7-x64
7711.exe
windows10-2004-x64
7TSmm
ubuntu-24.04-amd64
7Drkv
ubuntu-22.04-amd64
10FCK_RSC.dll
windows7-x64
3FCK_RSC.dll
windows10-2004-x64
3FUCK360.exe
windows7-x64
7FUCK360.exe
windows10-2004-x64
10GetPass.exe
windows7-x64
3GetPass.exe
windows10-2004-x64
3HkMh.exe
windows7-x64
10HkMh.exe
windows10-2004-x64
10HkMh_2.exe
windows7-x64
7HkMh_2.exe
windows10-2004-x64
10HkMh_3.exe
windows7-x64
10HkMh_3.exe
windows10-2004-x64
10Killbash.x
ubuntu-24.04-amd64
3服务器(...r).exe
windows7-x64
6服务器(...r).exe
windows10-2004-x64
6ShellCodeDec.exe
windows7-x64
ShellCodeDec.exe
windows10-2004-x64
Analysis
-
max time kernel
145s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
08-12-2024 01:12
Behavioral task
behavioral1
Sample
客户端(Client)_KEY.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral2
Sample
客户端(Client)_KEY.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
06432
Resource
ubuntu2204-amd64-20240611-en
ubuntu-22.04-amd64
Behavioral task
behavioral4
Sample
1.html
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral5
Sample
1.html
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
518_2.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral7
Sample
518_2.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
520.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral9
Sample
520.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
10711.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral11
Sample
10711.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
711.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral13
Sample
711.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
TSmm
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
Behavioral task
behavioral15
Sample
Drkv
Resource
ubuntu2204-amd64-20240611-en
ubuntu-22.04-amd64
Behavioral task
behavioral16
Sample
FCK_RSC.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral17
Sample
FCK_RSC.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
FUCK360.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral19
Sample
FUCK360.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
GetPass.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral21
Sample
GetPass.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
HkMh.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral23
Sample
HkMh.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
HkMh_2.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral25
Sample
HkMh_2.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
HkMh_3.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral27
Sample
HkMh_3.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
Killbash.x
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
Behavioral task
behavioral29
Sample
服务器(Server)/服务器(Server).exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral30
Sample
服务器(Server)/服务器(Server).exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
ShellCodeDec.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral32
Sample
ShellCodeDec.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
HkMh.exe
-
Size
332KB
-
MD5
1cd12a8269d6ed7af46c6d82dbf0db28
-
SHA1
cf47e4ce299999ce9b584e29f29cd3942d8abf27
-
SHA256
83e96c76e59b2d12849e2f92306c76bb90687194326b79546ac9ed2a1d8b6162
-
SHA512
20106eba738c1e0ef1f544879b4036b81cf19aba8c6d581aa6c546af68c819bd7f283138ba9fed55f82feacfcb4c4dd4ba1e0b5af8bf8de481444292109a9baa
-
SSDEEP
6144:xBcBaz+oA9IxnN8veMdpRTAZbl/NMe5F+/fAsluDXKVBopxC1rUniJ734maajc3A:sBaz+oA9IxnN8WmAZbRNZOAy3BUHniJX
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
resource yara_rule behavioral22/memory/2724-7-0x0000000010000000-0x0000000010024000-memory.dmp family_gh0strat behavioral22/memory/2724-11-0x0000000000400000-0x000000000042C000-memory.dmp family_gh0strat -
Gh0strat family
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral22/files/0x00090000000120f9-2.dat acprotect -
Loads dropped DLL 1 IoCs
pid Process 2724 HkMh.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HkMh.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2724 HkMh.exe 2724 HkMh.exe -
Suspicious behavior: MapViewOfSection 24 IoCs
pid Process 2724 HkMh.exe 2724 HkMh.exe 2724 HkMh.exe 2724 HkMh.exe 2724 HkMh.exe 2724 HkMh.exe 2724 HkMh.exe 2724 HkMh.exe 2724 HkMh.exe 2724 HkMh.exe 2724 HkMh.exe 2724 HkMh.exe 2724 HkMh.exe 2724 HkMh.exe 2724 HkMh.exe 2724 HkMh.exe 2724 HkMh.exe 2724 HkMh.exe 2724 HkMh.exe 2724 HkMh.exe 2724 HkMh.exe 2724 HkMh.exe 2724 HkMh.exe 2724 HkMh.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2724 HkMh.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2724 HkMh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2724 wrote to memory of 384 2724 HkMh.exe 3 PID 2724 wrote to memory of 384 2724 HkMh.exe 3 PID 2724 wrote to memory of 384 2724 HkMh.exe 3 PID 2724 wrote to memory of 384 2724 HkMh.exe 3 PID 2724 wrote to memory of 384 2724 HkMh.exe 3 PID 2724 wrote to memory of 384 2724 HkMh.exe 3 PID 2724 wrote to memory of 384 2724 HkMh.exe 3 PID 2724 wrote to memory of 392 2724 HkMh.exe 4 PID 2724 wrote to memory of 392 2724 HkMh.exe 4 PID 2724 wrote to memory of 392 2724 HkMh.exe 4 PID 2724 wrote to memory of 392 2724 HkMh.exe 4 PID 2724 wrote to memory of 392 2724 HkMh.exe 4 PID 2724 wrote to memory of 392 2724 HkMh.exe 4 PID 2724 wrote to memory of 392 2724 HkMh.exe 4 PID 2724 wrote to memory of 424 2724 HkMh.exe 5 PID 2724 wrote to memory of 424 2724 HkMh.exe 5 PID 2724 wrote to memory of 424 2724 HkMh.exe 5 PID 2724 wrote to memory of 424 2724 HkMh.exe 5 PID 2724 wrote to memory of 424 2724 HkMh.exe 5 PID 2724 wrote to memory of 424 2724 HkMh.exe 5 PID 2724 wrote to memory of 424 2724 HkMh.exe 5 PID 2724 wrote to memory of 476 2724 HkMh.exe 6 PID 2724 wrote to memory of 476 2724 HkMh.exe 6 PID 2724 wrote to memory of 476 2724 HkMh.exe 6 PID 2724 wrote to memory of 476 2724 HkMh.exe 6 PID 2724 wrote to memory of 476 2724 HkMh.exe 6 PID 2724 wrote to memory of 476 2724 HkMh.exe 6 PID 2724 wrote to memory of 476 2724 HkMh.exe 6 PID 2724 wrote to memory of 492 2724 HkMh.exe 7 PID 2724 wrote to memory of 492 2724 HkMh.exe 7 PID 2724 wrote to memory of 492 2724 HkMh.exe 7 PID 2724 wrote to memory of 492 2724 HkMh.exe 7 PID 2724 wrote to memory of 492 2724 HkMh.exe 7 PID 2724 wrote to memory of 492 2724 HkMh.exe 7 PID 2724 wrote to memory of 492 2724 HkMh.exe 7 PID 2724 wrote to memory of 500 2724 HkMh.exe 8 PID 2724 wrote to memory of 500 2724 HkMh.exe 8 PID 2724 wrote to memory of 500 2724 HkMh.exe 8 PID 2724 wrote to memory of 500 2724 HkMh.exe 8 PID 2724 wrote to memory of 500 2724 HkMh.exe 8 PID 2724 wrote to memory of 500 2724 HkMh.exe 8 PID 2724 wrote to memory of 500 2724 HkMh.exe 8 PID 2724 wrote to memory of 604 2724 HkMh.exe 9 PID 2724 wrote to memory of 604 2724 HkMh.exe 9 PID 2724 wrote to memory of 604 2724 HkMh.exe 9 PID 2724 wrote to memory of 604 2724 HkMh.exe 9 PID 2724 wrote to memory of 604 2724 HkMh.exe 9 PID 2724 wrote to memory of 604 2724 HkMh.exe 9 PID 2724 wrote to memory of 604 2724 HkMh.exe 9 PID 2724 wrote to memory of 680 2724 HkMh.exe 10 PID 2724 wrote to memory of 680 2724 HkMh.exe 10 PID 2724 wrote to memory of 680 2724 HkMh.exe 10 PID 2724 wrote to memory of 680 2724 HkMh.exe 10 PID 2724 wrote to memory of 680 2724 HkMh.exe 10 PID 2724 wrote to memory of 680 2724 HkMh.exe 10 PID 2724 wrote to memory of 680 2724 HkMh.exe 10 PID 2724 wrote to memory of 764 2724 HkMh.exe 11 PID 2724 wrote to memory of 764 2724 HkMh.exe 11 PID 2724 wrote to memory of 764 2724 HkMh.exe 11 PID 2724 wrote to memory of 764 2724 HkMh.exe 11 PID 2724 wrote to memory of 764 2724 HkMh.exe 11 PID 2724 wrote to memory of 764 2724 HkMh.exe 11 PID 2724 wrote to memory of 764 2724 HkMh.exe 11 PID 2724 wrote to memory of 812 2724 HkMh.exe 12
Processes
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:384
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:476
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:604
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe4⤵PID:1100
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵PID:1288
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:680
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:764
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:812
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵PID:1172
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:860
-
\\?\C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R4⤵PID:632
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:972
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:272
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:556
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1076
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1112
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"3⤵PID:2004
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:1764
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:2184
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:492
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:500
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:392
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:424
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\HkMh.exe"C:\Users\Admin\AppData\Local\Temp\HkMh.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2724
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9