Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
05/03/2025, 11:31
General
-
Target
e04aba0e0f6a4aca9da4d5edf558e9d6d536d6d8e3d67df3a119a0ebe7a32d0c.dll
-
Size
137KB
-
MD5
8bdcaab64127c866f997b01440c527d5
-
SHA1
83dfa4a2ceca9615fbe58db0c0d2885fdba201dd
-
SHA256
e04aba0e0f6a4aca9da4d5edf558e9d6d536d6d8e3d67df3a119a0ebe7a32d0c
-
SHA512
8af721e4921aef2488e07a05cfe7b5f72ed044f81eccff243b5863335c7ceb046211a2bbeec28b2fc42b9157ab1bb657b9e7d88f19a31db635faef1d5b3bddb5
-
SSDEEP
3072:3R02WMK8RJGInTlhnaBanONVk40rpg4yeF/TyUGSK9FrafcUksPxx6iTUui:K25GgFny61mraE
Malware Config
Signatures
-
Gh0st RAT payload 4 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
Blocklisted process makes network request 1 IoCs
-
Boot or Logon Autostart Execution: Port Monitors 1 TTPs 16 IoCs
Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.
-
Sets service image path in registry 2 TTPs 2 IoCs
-
ACProtect 1.3x - 1.4x DLL software 16 IoCs
Detects file using ACProtect software.
-
Drops file in System32 directory 10 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Windows directory 4 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 22 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e04aba0e0f6a4aca9da4d5edf558e9d6d536d6d8e3d67df3a119a0ebe7a32d0c.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e04aba0e0f6a4aca9da4d5edf558e9d6d536d6d8e3d67df3a119a0ebe7a32d0c.dll,#12⤵
- Blocklisted process makes network request
- Boot or Logon Autostart Execution: Port Monitors
- Sets service image path in registry
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe -k rundll323⤵
- Boot or Logon Autostart Execution: Port Monitors
- Sets service image path in registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 6483⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1140 -ip 11401⤵
-
C:\Windows\system32\Spoolsv.exeSpoolsv.exe1⤵
- Boot or Logon Autostart Execution: Port Monitors
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Port Monitors
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Port Monitors
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
137KB
MD5ab224645c87b49b6d11152a95f684f81
SHA1413691c2353fe8a3391e186a31d878001b6a3ea2
SHA2568dccbcbe4a67ebdb74ac5ffcee59e767be0b4447049c3d1c3458981afcf649bf
SHA512c563c75010c6de4fe7355d841c0c1dc4ec9cce354157972f397b27be9573e8ff35c1b151ba810734bb94595380c59a35ab86a74b2f796c6089eaefb5efee88e9
-
Filesize
137KB
MD5e1e50998f2f3c0fd88510b86364a3b40
SHA1a6aef4ee139442ca961a4d63e1fb8a42e9275b0b
SHA25627df4edd0af62301c6a32e5aece942ea2ccb8439acd4b16897f14da58d988b3f
SHA5125c194c1d934bc20793c7e6429f8bb05e165531df2d95f74f66c5adfcd75a1d6a49aa4df50fc095e33043e9bdcddd5cca044036a511795b7b79b0b5570778c6c2
-
Filesize
99B
MD5edaf5f37dcc9ac49d193352c8b4875e7
SHA116a352d2abbfdcd7a93982c0eb16efb137736921
SHA256643359946c645113c3925df272ee98e90da6dfb536545e41af4577c6515dc6f2
SHA512f4c5c4de3cc7bd1de8991a5bd8802ea5d4fbad9736c38c131af763704d1cd7960b159145b4d80593be84bc01050d184432c01b494052c93b7c9a9e0466251e98
-
Filesize
247B
MD5ba3c7fbfc30bd011afde7cefc335d512
SHA1145beda061158a3051ffa1b6ab659b6e763babba
SHA2568931d66ac6e7ea52773cedbd3e16dfe9408ae472a321dff4f8a94e54f49355bb
SHA5129c2a7f7975b64df81c4e36fdd7dd8888a3891ad7f348ba288ba2922246b10bceeb2f730212e5315dbc3be49266002934279bc2405fe8129feef5569232df8ef7
-
Filesize
326B
MD55dfcb311d1892c17cc598d058168fbc1
SHA10acd15bf766a82855fdd7948b18dff02a8322eb2
SHA256a4e135d167203612d849bcf9bcad0277113ab462182bb53472378abee9f624af
SHA512d260962d7246fc0f895668401fd4077c9a6a6023f26ecdf419e024d7c1fe8fcab81b4aed36ba5818ee6a9dd419d966f77367e73a6bcbf019089f5b403832ff79
-
Filesize
137KB
MD5633294635fdf99eabeb24dee7f7e12ac
SHA175647ee10b3a3001b3b0ecb88a2a2286397034f7
SHA256301979b5c2738d7f849674e489f5e54482683bee49a8e6e08ba4053b7f8a0f22
SHA5127f5f718634319f23654607ecf237be67da9aa5a487870ec5a5abdefa942a7419978cf74dd3b0d8918a9af6f5bbe1f6e65dcbda0fdbc4f6e1168938337d712001
-
Filesize
116KB
-
Filesize
156KB
-
Filesize
116KB
-
Filesize
112KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
112KB
-
Filesize
112KB
-
Filesize
156KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
140KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
112KB
-
Filesize
156KB