Analysis
- max time kernel
150s - max time network
119s - platform
windows11-21h2_x64 - resource
win11-20250502-en - resource tags
arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system - submitted
25/05/2025, 14:36
Behavioral task
behavioral1
Sample
EA042785385F78E162DCC66FF447B858.dll
Resource
win10v2004-20250502-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target EA042785385F78E162DCC66FF447B858.dll
- Size 14.8MB
- Sample250525-ryrynssms3
- SHA256 8cd0a1d8e18cc3adee5fa5c4293b7bb89be489c3d9a98f2afb4bb1ea840a4163
- MD5 ea042785385f78e162dcc66ff447b858
- SHA1 556b15f7e04a92e623b4c12e4e979dad815cfed7
- SHA512 3a6c6cfe4e906ab8829310da477973a7e566aec9bda7d6707fb421063c14f07b5f4e41d73d99e0fd21bd31db7ea2f9fcfd31d03e0175688b04fda050c8550dc2
- SSDEEP 12288:s6+4ClFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFj:sL4Cv
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x001300000002acc6-3.dat family_gh0strat - Gh0strat family
- Loads dropped DLL 1 IoCs
pid Process 1964 svchost.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\FileName.jpg rundll32.exe File created C:\Windows\FileName.jpg rundll32.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe - Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\NetSubKey svchost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 5208 rundll32.exe Token: SeRestorePrivilege 5208 rundll32.exe Token: SeBackupPrivilege 5208 rundll32.exe Token: SeRestorePrivilege 5208 rundll32.exe Token: SeBackupPrivilege 5208 rundll32.exe Token: SeRestorePrivilege 5208 rundll32.exe Token: SeBackupPrivilege 5208 rundll32.exe Token: SeRestorePrivilege 5208 rundll32.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5972 wrote to memory of 5208 5972 rundll32.exe 82 PID 5972 wrote to memory of 5208 5972 rundll32.exe 82 PID 5972 wrote to memory of 5208 5972 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\EA042785385F78E162DCC66FF447B858.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\EA042785385F78E162DCC66FF447B858.dll,#12⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5208
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1964
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path \??\c:\windows\filename.jpg
- Size 16.5MB
- SHA256 3eec9e1dbbe49e4e66c245732fde34e62197c7c1dc3a438a078f6c3e0c8a3d4d
- MD5 8ff2350af7f0837729f81a5785ba9372
- SHA1 8032c57b9855a49c3aa3e5e4c4541559b4b03e94
- SHA512 145211e80b01168679953310c79c14e93fcad9da4ede57ce1335dff875c87feccafaec49a420aaf6f07b38db17990c08f8ffeb4b860fa60da1b8941b04de30c8
- SSDEEP 12288:s6+4ClFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFB:sL4C1
- MD5 SHA1 SHA512 SSDEEP
