Overview
overview
10Static
static
10客户端(...EY.exe
windows7-x64
9客户端(...EY.exe
windows10-2004-x64
906432
ubuntu-22.04-amd64
71.html
windows7-x64
31.html
windows10-2004-x64
3518_2.exe
windows7-x64
4518_2.exe
windows10-2004-x64
4520.exe
windows7-x64
4520.exe
windows10-2004-x64
410711.exe
windows7-x64
310711.exe
windows10-2004-x64
3711.exe
windows7-x64
7711.exe
windows10-2004-x64
7TSmm
ubuntu-24.04-amd64
7Drkv
ubuntu-22.04-amd64
10FCK_RSC.dll
windows7-x64
3FCK_RSC.dll
windows10-2004-x64
3FUCK360.exe
windows7-x64
7FUCK360.exe
windows10-2004-x64
10GetPass.exe
windows7-x64
3GetPass.exe
windows10-2004-x64
3HkMh.exe
windows7-x64
10HkMh.exe
windows10-2004-x64
10HkMh_2.exe
windows7-x64
7HkMh_2.exe
windows10-2004-x64
10HkMh_3.exe
windows7-x64
10HkMh_3.exe
windows10-2004-x64
10Killbash.x
ubuntu-24.04-amd64
3服务器(...r).exe
windows7-x64
6服务器(...r).exe
windows10-2004-x64
6ShellCodeDec.exe
windows7-x64
ShellCodeDec.exe
windows10-2004-x64
Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08-12-2024 01:12
Behavioral task
behavioral1
Sample
客户端(Client)_KEY.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral2
Sample
客户端(Client)_KEY.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
06432
Resource
ubuntu2204-amd64-20240611-en
ubuntu-22.04-amd64
Behavioral task
behavioral4
Sample
1.html
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral5
Sample
1.html
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
518_2.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral7
Sample
518_2.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
520.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral9
Sample
520.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
10711.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral11
Sample
10711.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
711.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral13
Sample
711.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
TSmm
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
Behavioral task
behavioral15
Sample
Drkv
Resource
ubuntu2204-amd64-20240611-en
ubuntu-22.04-amd64
Behavioral task
behavioral16
Sample
FCK_RSC.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral17
Sample
FCK_RSC.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
FUCK360.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral19
Sample
FUCK360.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
GetPass.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral21
Sample
GetPass.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
HkMh.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral23
Sample
HkMh.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
HkMh_2.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral25
Sample
HkMh_2.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
HkMh_3.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral27
Sample
HkMh_3.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
Killbash.x
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
Behavioral task
behavioral29
Sample
服务器(Server)/服务器(Server).exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral30
Sample
服务器(Server)/服务器(Server).exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
ShellCodeDec.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral32
Sample
ShellCodeDec.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
HkMh_3.exe
-
Size
176KB
-
MD5
0cae2144249cca11917ce26657fc0281
-
SHA1
e7ffc36c62c26e987c6954e4739a306a95d119e1
-
SHA256
5fa749158a4dd5dd030bb97a5ca74a542ae4661b2a76ec69b29d41c3a32e8767
-
SHA512
50c5ea18407b74fc5d741d602c87a28c0bfebb348a8ff1710026951937b1e9077a353ee0b9bf2eb648b83a60e34a5e934d8b95c1b7e1202933aea875e6975027
-
SSDEEP
3072:MBFDC2a8kkalMLmNTMeN1vT72dPxIhf+5HS5LTbl2NBX9ZdebJR3u:M/inHlN1vTyTIBEHkTbl2zn0bJR
Malware Config
Signatures
-
Gh0st RAT payload 4 IoCs
resource yara_rule behavioral26/memory/2092-0-0x0000000000400000-0x0000000000431000-memory.dmp family_gh0strat behavioral26/files/0x000a00000001202a-4.dat family_gh0strat behavioral26/memory/2092-8-0x0000000000400000-0x0000000000431000-memory.dmp family_gh0strat behavioral26/memory/1640-9-0x0000000000400000-0x0000000000431000-memory.dmp family_gh0strat -
Gh0strat family
-
Executes dropped EXE 1 IoCs
pid Process 1640 rifzsk.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\rifzsk.exe HkMh_3.exe File opened for modification C:\Windows\SysWOW64\rifzsk.exe HkMh_3.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HkMh_3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rifzsk.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2092 HkMh_3.exe 1640 rifzsk.exe -
Suspicious behavior: MapViewOfSection 47 IoCs
pid Process 2092 HkMh_3.exe 2092 HkMh_3.exe 2092 HkMh_3.exe 2092 HkMh_3.exe 2092 HkMh_3.exe 2092 HkMh_3.exe 2092 HkMh_3.exe 2092 HkMh_3.exe 2092 HkMh_3.exe 2092 HkMh_3.exe 2092 HkMh_3.exe 2092 HkMh_3.exe 2092 HkMh_3.exe 2092 HkMh_3.exe 2092 HkMh_3.exe 2092 HkMh_3.exe 2092 HkMh_3.exe 2092 HkMh_3.exe 2092 HkMh_3.exe 2092 HkMh_3.exe 2092 HkMh_3.exe 2092 HkMh_3.exe 2092 HkMh_3.exe 1640 rifzsk.exe 1640 rifzsk.exe 1640 rifzsk.exe 1640 rifzsk.exe 1640 rifzsk.exe 1640 rifzsk.exe 1640 rifzsk.exe 1640 rifzsk.exe 1640 rifzsk.exe 1640 rifzsk.exe 1640 rifzsk.exe 1640 rifzsk.exe 1640 rifzsk.exe 1640 rifzsk.exe 1640 rifzsk.exe 1640 rifzsk.exe 1640 rifzsk.exe 1640 rifzsk.exe 1640 rifzsk.exe 1640 rifzsk.exe 1640 rifzsk.exe 1640 rifzsk.exe 1640 rifzsk.exe 1640 rifzsk.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2092 HkMh_3.exe Token: SeDebugPrivilege 1640 rifzsk.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2092 wrote to memory of 380 2092 HkMh_3.exe 3 PID 2092 wrote to memory of 380 2092 HkMh_3.exe 3 PID 2092 wrote to memory of 380 2092 HkMh_3.exe 3 PID 2092 wrote to memory of 380 2092 HkMh_3.exe 3 PID 2092 wrote to memory of 380 2092 HkMh_3.exe 3 PID 2092 wrote to memory of 380 2092 HkMh_3.exe 3 PID 2092 wrote to memory of 380 2092 HkMh_3.exe 3 PID 2092 wrote to memory of 396 2092 HkMh_3.exe 4 PID 2092 wrote to memory of 396 2092 HkMh_3.exe 4 PID 2092 wrote to memory of 396 2092 HkMh_3.exe 4 PID 2092 wrote to memory of 396 2092 HkMh_3.exe 4 PID 2092 wrote to memory of 396 2092 HkMh_3.exe 4 PID 2092 wrote to memory of 396 2092 HkMh_3.exe 4 PID 2092 wrote to memory of 396 2092 HkMh_3.exe 4 PID 2092 wrote to memory of 432 2092 HkMh_3.exe 5 PID 2092 wrote to memory of 432 2092 HkMh_3.exe 5 PID 2092 wrote to memory of 432 2092 HkMh_3.exe 5 PID 2092 wrote to memory of 432 2092 HkMh_3.exe 5 PID 2092 wrote to memory of 432 2092 HkMh_3.exe 5 PID 2092 wrote to memory of 432 2092 HkMh_3.exe 5 PID 2092 wrote to memory of 432 2092 HkMh_3.exe 5 PID 2092 wrote to memory of 480 2092 HkMh_3.exe 6 PID 2092 wrote to memory of 480 2092 HkMh_3.exe 6 PID 2092 wrote to memory of 480 2092 HkMh_3.exe 6 PID 2092 wrote to memory of 480 2092 HkMh_3.exe 6 PID 2092 wrote to memory of 480 2092 HkMh_3.exe 6 PID 2092 wrote to memory of 480 2092 HkMh_3.exe 6 PID 2092 wrote to memory of 480 2092 HkMh_3.exe 6 PID 2092 wrote to memory of 488 2092 HkMh_3.exe 7 PID 2092 wrote to memory of 488 2092 HkMh_3.exe 7 PID 2092 wrote to memory of 488 2092 HkMh_3.exe 7 PID 2092 wrote to memory of 488 2092 HkMh_3.exe 7 PID 2092 wrote to memory of 488 2092 HkMh_3.exe 7 PID 2092 wrote to memory of 488 2092 HkMh_3.exe 7 PID 2092 wrote to memory of 488 2092 HkMh_3.exe 7 PID 2092 wrote to memory of 496 2092 HkMh_3.exe 8 PID 2092 wrote to memory of 496 2092 HkMh_3.exe 8 PID 2092 wrote to memory of 496 2092 HkMh_3.exe 8 PID 2092 wrote to memory of 496 2092 HkMh_3.exe 8 PID 2092 wrote to memory of 496 2092 HkMh_3.exe 8 PID 2092 wrote to memory of 496 2092 HkMh_3.exe 8 PID 2092 wrote to memory of 496 2092 HkMh_3.exe 8 PID 2092 wrote to memory of 600 2092 HkMh_3.exe 9 PID 2092 wrote to memory of 600 2092 HkMh_3.exe 9 PID 2092 wrote to memory of 600 2092 HkMh_3.exe 9 PID 2092 wrote to memory of 600 2092 HkMh_3.exe 9 PID 2092 wrote to memory of 600 2092 HkMh_3.exe 9 PID 2092 wrote to memory of 600 2092 HkMh_3.exe 9 PID 2092 wrote to memory of 600 2092 HkMh_3.exe 9 PID 2092 wrote to memory of 676 2092 HkMh_3.exe 10 PID 2092 wrote to memory of 676 2092 HkMh_3.exe 10 PID 2092 wrote to memory of 676 2092 HkMh_3.exe 10 PID 2092 wrote to memory of 676 2092 HkMh_3.exe 10 PID 2092 wrote to memory of 676 2092 HkMh_3.exe 10 PID 2092 wrote to memory of 676 2092 HkMh_3.exe 10 PID 2092 wrote to memory of 676 2092 HkMh_3.exe 10 PID 2092 wrote to memory of 740 2092 HkMh_3.exe 11 PID 2092 wrote to memory of 740 2092 HkMh_3.exe 11 PID 2092 wrote to memory of 740 2092 HkMh_3.exe 11 PID 2092 wrote to memory of 740 2092 HkMh_3.exe 11 PID 2092 wrote to memory of 740 2092 HkMh_3.exe 11 PID 2092 wrote to memory of 740 2092 HkMh_3.exe 11 PID 2092 wrote to memory of 740 2092 HkMh_3.exe 11 PID 2092 wrote to memory of 824 2092 HkMh_3.exe 12
Processes
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:380
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:480
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:600
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe4⤵PID:328
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵PID:1788
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:676
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:740
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:824
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵PID:1048
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:868
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:976
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:276
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1060
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:1080
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1160
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"3⤵PID:336
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:1732
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:2444
-
-
C:\Windows\SysWOW64\rifzsk.exeC:\Windows\SysWOW64\rifzsk.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1640
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:488
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:496
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:396
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:432
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe"C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe"2⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2092
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
176KB
MD50cae2144249cca11917ce26657fc0281
SHA1e7ffc36c62c26e987c6954e4739a306a95d119e1
SHA2565fa749158a4dd5dd030bb97a5ca74a542ae4661b2a76ec69b29d41c3a32e8767
SHA51250c5ea18407b74fc5d741d602c87a28c0bfebb348a8ff1710026951937b1e9077a353ee0b9bf2eb648b83a60e34a5e934d8b95c1b7e1202933aea875e6975027