Analysis
-
max time kernel
4s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
05-07-2024 05:12
Static task
static1
Behavioral task
behavioral1
Sample
62243caed8d98bffb8549867cf9442a478a539437c18532d8af61b5b9c104040.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
62243caed8d98bffb8549867cf9442a478a539437c18532d8af61b5b9c104040.exe
Resource
win10v2004-20240704-en
General
-
Target
62243caed8d98bffb8549867cf9442a478a539437c18532d8af61b5b9c104040.exe
-
Size
5.0MB
-
MD5
2c7ae2fe3831034e1fcf3f0264b021c5
-
SHA1
20195abe76fe5cc247505ed373c4bb98667a6691
-
SHA256
62243caed8d98bffb8549867cf9442a478a539437c18532d8af61b5b9c104040
-
SHA512
e04c963761312e9b2cc1ba2f739ec73801660ab996b20a6f31ef4098295dda5d7b9b5709faaac39f02bdfcc63f9ff96799e5afd1750f112204ff62b82c837723
-
SSDEEP
49152:DYREXSVMKi3hFsDrXjfbXsPNIULkmp1/j6AeXZG7wmpvGF1IP9z5WuHC4O8b8ITi:M2SVMK8hFsD/fbXsPN5kiQaZ56
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
Processes:
resource yara_rule C:\Windows\SysWOW64\240617265.bat family_gh0strat -
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
Processes:
look2.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\svchcst\Parameters\ServiceDll = "C:\\Windows\\system32\\240617265.bat" look2.exe -
Executes dropped EXE 3 IoCs
Processes:
look2.exeHD_62243caed8d98bffb8549867cf9442a478a539437c18532d8af61b5b9c104040.exesvchcst.exepid process 2776 look2.exe 3896 HD_62243caed8d98bffb8549867cf9442a478a539437c18532d8af61b5b9c104040.exe 4148 svchcst.exe -
Loads dropped DLL 3 IoCs
Processes:
look2.exesvchost.exesvchcst.exepid process 2776 look2.exe 3720 svchost.exe 4148 svchcst.exe -
Drops file in System32 directory 4 IoCs
Processes:
svchost.exelook2.exedescription ioc process File opened for modification C:\Windows\SysWOW64\svchcst.exe svchost.exe File created C:\Windows\SysWOW64\240617265.bat look2.exe File opened for modification C:\Windows\SysWOW64\ini.ini look2.exe File created C:\Windows\SysWOW64\svchcst.exe svchost.exe -
Drops file in Program Files directory 1 IoCs
Processes:
62243caed8d98bffb8549867cf9442a478a539437c18532d8af61b5b9c104040.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 62243caed8d98bffb8549867cf9442a478a539437c18532d8af61b5b9c104040.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
62243caed8d98bffb8549867cf9442a478a539437c18532d8af61b5b9c104040.exepid process 2792 62243caed8d98bffb8549867cf9442a478a539437c18532d8af61b5b9c104040.exe 2792 62243caed8d98bffb8549867cf9442a478a539437c18532d8af61b5b9c104040.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
62243caed8d98bffb8549867cf9442a478a539437c18532d8af61b5b9c104040.exepid process 2792 62243caed8d98bffb8549867cf9442a478a539437c18532d8af61b5b9c104040.exe 2792 62243caed8d98bffb8549867cf9442a478a539437c18532d8af61b5b9c104040.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
62243caed8d98bffb8549867cf9442a478a539437c18532d8af61b5b9c104040.exesvchost.exedescription pid process target process PID 2792 wrote to memory of 2776 2792 62243caed8d98bffb8549867cf9442a478a539437c18532d8af61b5b9c104040.exe look2.exe PID 2792 wrote to memory of 2776 2792 62243caed8d98bffb8549867cf9442a478a539437c18532d8af61b5b9c104040.exe look2.exe PID 2792 wrote to memory of 2776 2792 62243caed8d98bffb8549867cf9442a478a539437c18532d8af61b5b9c104040.exe look2.exe PID 2792 wrote to memory of 3896 2792 62243caed8d98bffb8549867cf9442a478a539437c18532d8af61b5b9c104040.exe HD_62243caed8d98bffb8549867cf9442a478a539437c18532d8af61b5b9c104040.exe PID 2792 wrote to memory of 3896 2792 62243caed8d98bffb8549867cf9442a478a539437c18532d8af61b5b9c104040.exe HD_62243caed8d98bffb8549867cf9442a478a539437c18532d8af61b5b9c104040.exe PID 2792 wrote to memory of 3896 2792 62243caed8d98bffb8549867cf9442a478a539437c18532d8af61b5b9c104040.exe HD_62243caed8d98bffb8549867cf9442a478a539437c18532d8af61b5b9c104040.exe PID 3720 wrote to memory of 4148 3720 svchost.exe svchcst.exe PID 3720 wrote to memory of 4148 3720 svchost.exe svchcst.exe PID 3720 wrote to memory of 4148 3720 svchost.exe svchcst.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\62243caed8d98bffb8549867cf9442a478a539437c18532d8af61b5b9c104040.exe"C:\Users\Admin\AppData\Local\Temp\62243caed8d98bffb8549867cf9442a478a539437c18532d8af61b5b9c104040.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\look2.exeC:\Users\Admin\AppData\Local\Temp\\look2.exe2⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Local\Temp\HD_62243caed8d98bffb8549867cf9442a478a539437c18532d8af61b5b9c104040.exeC:\Users\Admin\AppData\Local\Temp\HD_62243caed8d98bffb8549867cf9442a478a539437c18532d8af61b5b9c104040.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "svchcst"1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "svchcst"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchcst.exeC:\Windows\system32\svchcst.exe "c:\windows\system32\240617265.bat",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HD_62243caed8d98bffb8549867cf9442a478a539437c18532d8af61b5b9c104040.exeFilesize
3.1MB
MD5fb083acd60fe5c3156dc25442be815e3
SHA161df59b8f3ebd8b3d29ca3aedc4995e23cacf6d8
SHA256f130b3789962d5c8b59aa250d6f26ad5945928f3905b32bf65aa7bd30348a794
SHA5127147337d2c1006bb15cfa967c9eea6826b63c8d343f866e7454d7368d25019f39e52cf179500810834244c3ca9644d6c0df0b2c3128a9051e9ee6b428fa926f6
-
C:\Users\Admin\AppData\Local\Temp\HD_X.datFilesize
1.9MB
MD5fbe2e8bf813bb82db80b332efe1dc17f
SHA1f771f5d0246a2dccbf4ea6cfd1d77a33bd87ded3
SHA2562462508146112d31b5f9e34af81cebed4cd95b4186bad4b870aa8a0c8f1061cb
SHA512a05f9d7f0f8d0626f9c8d1a961f3e9defd46836f9ef22d75d2f921edd5fbabd9021142ee68c6f1c184ea897f896483dbccbc1f2c93c0c32d85363071bbb80f22
-
C:\Users\Admin\AppData\Local\Temp\look2.exeFilesize
337KB
MD5fb66e1e31fa1e6dfb21a50ccd11e0409
SHA16c45a0a115ec896eb14a531a44809b2a22cf8934
SHA2565ea8c5455f0ebe884ed98834e78ead8b6c68814bbb1723370299fa44b88c0faa
SHA51258ee149f70438296a67d5ae5cbd6cb9f5b2510a0381466b8f09eec3835be1ce7cad6903ca8fbc9273105132e85952208e78c59f776416c5449b86cc62111154b
-
C:\Windows\SysWOW64\240617265.batFilesize
51KB
MD552a9b6f37732a76103657a97332895e0
SHA13aad9dd3a176c9262e2b4eb0d9f3e759efb18f36
SHA2561dcf8e897ca6a8e92a8378bc0b0c12d4fdcaf37d6cb556f9408cd9628a5fe832
SHA5124954891e3bd841bb6a17afe1ea5b8fafa627ce8eb805195f3cf092b70e1870c619d0612f3bf5318b1797e00419da9a92ebefd2b00f8c21fa0e6fc4bddff2ffb7
-
C:\Windows\SysWOW64\svchcst.exeFilesize
60KB
MD5889b99c52a60dd49227c5e485a016679
SHA18fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA2566cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA51208933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641