Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 04:39
Static task
static1
Behavioral task
behavioral1
Sample
a36de2baaf9355213b83514d52e08725db182a5f0e21baa440aab8f129610820.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
a36de2baaf9355213b83514d52e08725db182a5f0e21baa440aab8f129610820.exe
Resource
win10v2004-20240508-en
General
-
Target
a36de2baaf9355213b83514d52e08725db182a5f0e21baa440aab8f129610820.exe
-
Size
4.3MB
-
MD5
0f9baf91bbc3af9d45ee0d5891c030a9
-
SHA1
bdd3b7d80059fe7b7cfc374f0ea1f0b9a315988c
-
SHA256
a36de2baaf9355213b83514d52e08725db182a5f0e21baa440aab8f129610820
-
SHA512
00bd256402e067b79d0a3918a8b39a12ab5fd87bae9a03952bfa815a0563c074d49e8973a24ee89c1daeec76c0a57a792bc27d664d6245a9d33bf517dc8ea527
-
SSDEEP
98304:92SVMD8unlEm9++v6O7XkvT+WLeLCt1wrteBO:1EnlE++SNXkorteBO
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
Processes:
resource yara_rule \Windows\SysWOW64\259400521.bat family_gh0strat -
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
Processes:
look2.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\svchcst\Parameters\ServiceDll = "C:\\Windows\\system32\\259400521.bat" look2.exe -
Executes dropped EXE 3 IoCs
Processes:
look2.exeHD_a36de2baaf9355213b83514d52e08725db182a5f0e21baa440aab8f129610820.exesvchcst.exepid process 1812 look2.exe 2124 HD_a36de2baaf9355213b83514d52e08725db182a5f0e21baa440aab8f129610820.exe 2540 svchcst.exe -
Loads dropped DLL 6 IoCs
Processes:
a36de2baaf9355213b83514d52e08725db182a5f0e21baa440aab8f129610820.exelook2.exesvchost.exesvchcst.exepid process 2860 a36de2baaf9355213b83514d52e08725db182a5f0e21baa440aab8f129610820.exe 1812 look2.exe 2388 svchost.exe 2860 a36de2baaf9355213b83514d52e08725db182a5f0e21baa440aab8f129610820.exe 2388 svchost.exe 2540 svchcst.exe -
Drops file in System32 directory 4 IoCs
Processes:
look2.exesvchost.exedescription ioc process File created C:\Windows\SysWOW64\259400521.bat look2.exe File opened for modification C:\Windows\SysWOW64\ini.ini look2.exe File created C:\Windows\SysWOW64\svchcst.exe svchost.exe File opened for modification C:\Windows\SysWOW64\svchcst.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
a36de2baaf9355213b83514d52e08725db182a5f0e21baa440aab8f129610820.exepid process 2860 a36de2baaf9355213b83514d52e08725db182a5f0e21baa440aab8f129610820.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
HD_a36de2baaf9355213b83514d52e08725db182a5f0e21baa440aab8f129610820.exedescription pid process Token: SeDebugPrivilege 2124 HD_a36de2baaf9355213b83514d52e08725db182a5f0e21baa440aab8f129610820.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
HD_a36de2baaf9355213b83514d52e08725db182a5f0e21baa440aab8f129610820.exepid process 2124 HD_a36de2baaf9355213b83514d52e08725db182a5f0e21baa440aab8f129610820.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
a36de2baaf9355213b83514d52e08725db182a5f0e21baa440aab8f129610820.exepid process 2860 a36de2baaf9355213b83514d52e08725db182a5f0e21baa440aab8f129610820.exe 2860 a36de2baaf9355213b83514d52e08725db182a5f0e21baa440aab8f129610820.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
a36de2baaf9355213b83514d52e08725db182a5f0e21baa440aab8f129610820.exesvchost.exedescription pid process target process PID 2860 wrote to memory of 1812 2860 a36de2baaf9355213b83514d52e08725db182a5f0e21baa440aab8f129610820.exe look2.exe PID 2860 wrote to memory of 1812 2860 a36de2baaf9355213b83514d52e08725db182a5f0e21baa440aab8f129610820.exe look2.exe PID 2860 wrote to memory of 1812 2860 a36de2baaf9355213b83514d52e08725db182a5f0e21baa440aab8f129610820.exe look2.exe PID 2860 wrote to memory of 1812 2860 a36de2baaf9355213b83514d52e08725db182a5f0e21baa440aab8f129610820.exe look2.exe PID 2860 wrote to memory of 2124 2860 a36de2baaf9355213b83514d52e08725db182a5f0e21baa440aab8f129610820.exe HD_a36de2baaf9355213b83514d52e08725db182a5f0e21baa440aab8f129610820.exe PID 2860 wrote to memory of 2124 2860 a36de2baaf9355213b83514d52e08725db182a5f0e21baa440aab8f129610820.exe HD_a36de2baaf9355213b83514d52e08725db182a5f0e21baa440aab8f129610820.exe PID 2860 wrote to memory of 2124 2860 a36de2baaf9355213b83514d52e08725db182a5f0e21baa440aab8f129610820.exe HD_a36de2baaf9355213b83514d52e08725db182a5f0e21baa440aab8f129610820.exe PID 2860 wrote to memory of 2124 2860 a36de2baaf9355213b83514d52e08725db182a5f0e21baa440aab8f129610820.exe HD_a36de2baaf9355213b83514d52e08725db182a5f0e21baa440aab8f129610820.exe PID 2388 wrote to memory of 2540 2388 svchost.exe svchcst.exe PID 2388 wrote to memory of 2540 2388 svchost.exe svchcst.exe PID 2388 wrote to memory of 2540 2388 svchost.exe svchcst.exe PID 2388 wrote to memory of 2540 2388 svchost.exe svchcst.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a36de2baaf9355213b83514d52e08725db182a5f0e21baa440aab8f129610820.exe"C:\Users\Admin\AppData\Local\Temp\a36de2baaf9355213b83514d52e08725db182a5f0e21baa440aab8f129610820.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\look2.exeC:\Users\Admin\AppData\Local\Temp\\look2.exe2⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Local\Temp\HD_a36de2baaf9355213b83514d52e08725db182a5f0e21baa440aab8f129610820.exeC:\Users\Admin\AppData\Local\Temp\HD_a36de2baaf9355213b83514d52e08725db182a5f0e21baa440aab8f129610820.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "svchcst"1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "svchcst"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchcst.exeC:\Windows\system32\svchcst.exe "c:\windows\system32\259400521.bat",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\HD_a36de2baaf9355213b83514d52e08725db182a5f0e21baa440aab8f129610820.exeFilesize
3.1MB
MD5fb3e65422df6d71e46f0d53c574409c0
SHA1d094a9a0cdba079f2ea429e87f684e1f36214323
SHA25662db132960dc97ec92f3cf8a1005dcf1b32229b19ab98aca18210e8df1ca2e25
SHA5122ccf11c4f0fde19bfc5e38c355efb8389f0699568d90c531fa50c873a889f3ff439ec33c20e05fa7a75c1b7334a6e43574c236cd73549e89a5a466cc1bc42ed3
-
\Users\Admin\AppData\Local\Temp\look2.exeFilesize
337KB
MD52f3b6f16e33e28ad75f3fdaef2567807
SHA185e907340faf1edfc9210db85a04abd43d21b741
SHA25686492ebf2d6f471a5ee92977318d099b3ea86175b5b7ae522237ae01d07a4857
SHA512db17e99e2df918cfc9ccbe934adfe73f0777ce1ce9f28b57a4b24ecd821efe2e0b976a634853247b77b16627d2bb3af4ba20306059d1d25ef38ffada7da3e3a4
-
\Windows\SysWOW64\259400521.batFilesize
51KB
MD5b58e5d35c10be4f4a89d2c1bd821f872
SHA12e8c6658144668e6b33be33ed961e7eff1cf611f
SHA256355aa59a18286121be018615fb80ebf9c53bd547a94e2aa6519b6b6f11a491df
SHA51221b0a78b02f04b3311d617c7e914db618459bf6bc3c9811e92007c55c9e0eb2d6e2a6121fbdfb49d9b4f99420eb5c352362566cc3c05bcad981ce16ebe50f345
-
\Windows\SysWOW64\svchcst.exeFilesize
43KB
MD551138beea3e2c21ec44d0932c71762a8
SHA18939cf35447b22dd2c6e6f443446acc1bf986d58
SHA2565ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d
-
memory/2124-19-0x0000000000210000-0x0000000000526000-memory.dmpFilesize
3.1MB
-
memory/2124-20-0x000000001BA50000-0x000000001BD20000-memory.dmpFilesize
2.8MB
-
memory/2124-23-0x0000000000920000-0x000000000092A000-memory.dmpFilesize
40KB
-
memory/2124-22-0x0000000000920000-0x000000000092A000-memory.dmpFilesize
40KB
-
memory/2124-27-0x000000001CA40000-0x000000001CAE8000-memory.dmpFilesize
672KB
-
memory/2124-42-0x0000000000920000-0x000000000092A000-memory.dmpFilesize
40KB
-
memory/2124-43-0x0000000000920000-0x000000000092A000-memory.dmpFilesize
40KB