Analysis
-
max time kernel
151s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
30-10-2022 12:11
General
-
Target
ba6f9164f5060117f8daad1e3fc8b6e517687a7ef8d13f53bc2b34f267068b47.exe
-
Size
136KB
-
MD5
a2aee12741001bf761f31187f05a8e00
-
SHA1
770eb5f7b3bd7b57cf929d5216bc9f1a43bcd047
-
SHA256
ba6f9164f5060117f8daad1e3fc8b6e517687a7ef8d13f53bc2b34f267068b47
-
SHA512
74f9508e0680cfc13b453ca5349f50d50fbde9cb1cd072d943c149f971ce90b57de67e1002e387e1e937a1f529d6663f0c5cf2c851b8a275781cf38fcbcb4c8b
-
SSDEEP
3072:M02gsmbHGhqCkQINRiUsIPZLJh90vbXDztaZ14a8:i7m6hqCfysKEz8Z1F
Malware Config
Signatures
-
Gh0st RAT payload 5 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba6f9164f5060117f8daad1e3fc8b6e517687a7ef8d13f53bc2b34f267068b47.exe"C:\Users\Admin\AppData\Local\Temp\ba6f9164f5060117f8daad1e3fc8b6e517687a7ef8d13f53bc2b34f267068b47.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\gemuas.exeC:\Windows\gemuas.exe1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136KB
MD5a2aee12741001bf761f31187f05a8e00
SHA1770eb5f7b3bd7b57cf929d5216bc9f1a43bcd047
SHA256ba6f9164f5060117f8daad1e3fc8b6e517687a7ef8d13f53bc2b34f267068b47
SHA51274f9508e0680cfc13b453ca5349f50d50fbde9cb1cd072d943c149f971ce90b57de67e1002e387e1e937a1f529d6663f0c5cf2c851b8a275781cf38fcbcb4c8b
-
Filesize
136KB
MD5a2aee12741001bf761f31187f05a8e00
SHA1770eb5f7b3bd7b57cf929d5216bc9f1a43bcd047
SHA256ba6f9164f5060117f8daad1e3fc8b6e517687a7ef8d13f53bc2b34f267068b47
SHA51274f9508e0680cfc13b453ca5349f50d50fbde9cb1cd072d943c149f971ce90b57de67e1002e387e1e937a1f529d6663f0c5cf2c851b8a275781cf38fcbcb4c8b
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
8KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB