Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 05:22
Static task
static1
Behavioral task
behavioral1
Sample
9fd93ef3b23367d775e16c7cf684705d77467395ac6e26c916bfe39e44f46f6c.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
9fd93ef3b23367d775e16c7cf684705d77467395ac6e26c916bfe39e44f46f6c.exe
Resource
win10v2004-20240226-en
General
-
Target
9fd93ef3b23367d775e16c7cf684705d77467395ac6e26c916bfe39e44f46f6c.exe
-
Size
376KB
-
MD5
eb2e46cafe688c41e19a25233029e8fc
-
SHA1
189ddd1a812ad0647dde7f214cd7379764fb838d
-
SHA256
9fd93ef3b23367d775e16c7cf684705d77467395ac6e26c916bfe39e44f46f6c
-
SHA512
b6bdeccec77cd82bb9d34947f63983994b5e5ad8647bdce80dcb28501deb8c6b3708e847349f3fe25581baf0b13984647b2d74a01e6c392aefae22304d5c9a2d
-
SSDEEP
3072:RvK/yLrQbWaR5Qax8c/Ytzyxy+Pb9gcamf/w5vtc009w60wbA0X:ROyLEbWaR5CcLTPb9gc16LKLbN
Malware Config
Extracted
gh0strat
103.143.46.17
Signatures
-
Gh0st RAT payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2336-0-0x0000000010000000-0x0000000010015000-memory.dmp family_gh0strat behavioral1/memory/2336-15-0x0000000000400000-0x0000000000460000-memory.dmp family_gh0strat -
Executes dropped EXE 2 IoCs
Processes:
Zumxpdd.exeZumxpdd.exepid process 2416 Zumxpdd.exe 2828 Zumxpdd.exe -
Loads dropped DLL 1 IoCs
Processes:
Zumxpdd.exepid process 2416 Zumxpdd.exe -
Drops file in Program Files directory 2 IoCs
Processes:
9fd93ef3b23367d775e16c7cf684705d77467395ac6e26c916bfe39e44f46f6c.exedescription ioc process File created C:\Program Files (x86)\Microsoft Ciuoom\Zumxpdd.exe 9fd93ef3b23367d775e16c7cf684705d77467395ac6e26c916bfe39e44f46f6c.exe File opened for modification C:\Program Files (x86)\Microsoft Ciuoom\Zumxpdd.exe 9fd93ef3b23367d775e16c7cf684705d77467395ac6e26c916bfe39e44f46f6c.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
9fd93ef3b23367d775e16c7cf684705d77467395ac6e26c916bfe39e44f46f6c.exeZumxpdd.exeZumxpdd.exepid process 2336 9fd93ef3b23367d775e16c7cf684705d77467395ac6e26c916bfe39e44f46f6c.exe 2336 9fd93ef3b23367d775e16c7cf684705d77467395ac6e26c916bfe39e44f46f6c.exe 2416 Zumxpdd.exe 2416 Zumxpdd.exe 2828 Zumxpdd.exe 2828 Zumxpdd.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
9fd93ef3b23367d775e16c7cf684705d77467395ac6e26c916bfe39e44f46f6c.exepid process 2336 9fd93ef3b23367d775e16c7cf684705d77467395ac6e26c916bfe39e44f46f6c.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
Zumxpdd.exedescription pid process target process PID 2416 wrote to memory of 2828 2416 Zumxpdd.exe Zumxpdd.exe PID 2416 wrote to memory of 2828 2416 Zumxpdd.exe Zumxpdd.exe PID 2416 wrote to memory of 2828 2416 Zumxpdd.exe Zumxpdd.exe PID 2416 wrote to memory of 2828 2416 Zumxpdd.exe Zumxpdd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9fd93ef3b23367d775e16c7cf684705d77467395ac6e26c916bfe39e44f46f6c.exe"C:\Users\Admin\AppData\Local\Temp\9fd93ef3b23367d775e16c7cf684705d77467395ac6e26c916bfe39e44f46f6c.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
-
C:\Program Files (x86)\Microsoft Ciuoom\Zumxpdd.exe"C:\Program Files (x86)\Microsoft Ciuoom\Zumxpdd.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Ciuoom\Zumxpdd.exe"C:\Program Files (x86)\Microsoft Ciuoom\Zumxpdd.exe" Win72⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft Ciuoom\Zumxpdd.exeFilesize
376KB
MD5eb2e46cafe688c41e19a25233029e8fc
SHA1189ddd1a812ad0647dde7f214cd7379764fb838d
SHA2569fd93ef3b23367d775e16c7cf684705d77467395ac6e26c916bfe39e44f46f6c
SHA512b6bdeccec77cd82bb9d34947f63983994b5e5ad8647bdce80dcb28501deb8c6b3708e847349f3fe25581baf0b13984647b2d74a01e6c392aefae22304d5c9a2d
-
memory/2336-0-0x0000000010000000-0x0000000010015000-memory.dmpFilesize
84KB
-
memory/2336-15-0x0000000000400000-0x0000000000460000-memory.dmpFilesize
384KB