Overview

overview

10

Static

static

10

46c5608c10...4b.exe

windows7-x64

10

46c5608c10...4b.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    25s
  • max time network
    47s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    04-10-2022 07:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    46c5608c10631584caf23a7f785024d12ee4d4b2114f7004b7066d23be9e1a4b.exe

  • Size

    196KB

  • MD5

    5f70ec9b76e08f371deb92e57cf14fd0

  • SHA1

    5f8d8c8f84d609055838c5b0e540821060ebbaf3

  • SHA256

    46c5608c10631584caf23a7f785024d12ee4d4b2114f7004b7066d23be9e1a4b

  • SHA512

    10881431b9e51565c1d9cc80bd951d509f7f9cca23a27e75c716b8a2539e21768ec4c81354a46a58f3f02a65b3ced21dd5c062827007e653c0bc6a5ff67ce162

  • SSDEEP

    6144:DsItKnWUQwBTyPRqyhYPbncTBlhHrcndnG:wtWUgJq8YPbncT3

Score
10/10
gh0stratrat

Malware Config

Signatures

  • Gh0st RAT payload 1 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

Processes

  • C:\Users\Admin\AppData\Local\Temp\46c5608c10631584caf23a7f785024d12ee4d4b2114f7004b7066d23be9e1a4b.exe
    "C:\Users\Admin\AppData\Local\Temp\46c5608c10631584caf23a7f785024d12ee4d4b2114f7004b7066d23be9e1a4b.exe"
    1⤵
      PID:1452

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1452-54-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

      Download

    • memory/1452-55-0x0000000075981000-0x0000000075983000-memory.dmp

      Filesize

      8KB

      Download