Analysis
-
max time kernel
151s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
11-10-2022 18:48
General
-
Target
015645b50837942ced50582e3b5164f848287b4e551ff34f30b67bf2c3fb9c28.exe
-
Size
188KB
-
MD5
68a99ea1ef20e1acac00762aeafdfad6
-
SHA1
b872796b8e732d24dd60eaeab36b9e79ec4d05ac
-
SHA256
015645b50837942ced50582e3b5164f848287b4e551ff34f30b67bf2c3fb9c28
-
SHA512
2cbd169e31fa373670551b5bac1f3f147736f8eea5fba63b2b04aad6efe9c0a217337a59a2f0b17e5de915f36d4c6f57df72789dba010364f1985c6d604bec06
-
SSDEEP
3072:boWoZusJKTS2eCaf+Tob4Vm1bKFSGDQIKvbBUWiFqX56WdIjcVwOyq:boWoZueK3j+mosf10RbGfFS56Wd0crn
Malware Config
Signatures
-
Gh0st RAT payload 3 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Drops file in Windows directory 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\015645b50837942ced50582e3b5164f848287b4e551ff34f30b67bf2c3fb9c28.exe"C:\Users\Admin\AppData\Local\Temp\015645b50837942ced50582e3b5164f848287b4e551ff34f30b67bf2c3fb9c28.exe"1⤵
- Sets DLL path for service in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "c:\windows\system32\winnie.cmd",EASTNOD Rspdates Apxplicatioan2⤵
- Loads dropped DLL
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD523c457747c717e3c59883b804a87629d
SHA10d478b9abdd5a43deb555529f4b919b015b80f80
SHA256c3641159b290b58c6dc71167f77edb685bc46868db9c043b2670794b4a0e03eb
SHA5125f928854aa827dd90354b8422bd923f1a7c6084d038d6953af1cf6df0aaa16bfafc1e1767bed1483a2d205691308bf55524ca6e123e0388a70283b0d511810b1
-
Filesize
1.1MB
MD523c457747c717e3c59883b804a87629d
SHA10d478b9abdd5a43deb555529f4b919b015b80f80
SHA256c3641159b290b58c6dc71167f77edb685bc46868db9c043b2670794b4a0e03eb
SHA5125f928854aa827dd90354b8422bd923f1a7c6084d038d6953af1cf6df0aaa16bfafc1e1767bed1483a2d205691308bf55524ca6e123e0388a70283b0d511810b1
-
Filesize
1.1MB
MD523c457747c717e3c59883b804a87629d
SHA10d478b9abdd5a43deb555529f4b919b015b80f80
SHA256c3641159b290b58c6dc71167f77edb685bc46868db9c043b2670794b4a0e03eb
SHA5125f928854aa827dd90354b8422bd923f1a7c6084d038d6953af1cf6df0aaa16bfafc1e1767bed1483a2d205691308bf55524ca6e123e0388a70283b0d511810b1