Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

721c16d4f3...d1.exe

windows7-x64

10

721c16d4f3...d1.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    153s
  • max time network
    162s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/11/2022, 04:31 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    721c16d4f313e9a875a6a8e480fef03b5b2bb1ec3bd59b0124ed6a2b617547d1.exe

  • Size

    572KB

  • MD5

    0f49f67a3fc88130ba3257c2f7c300d1

  • SHA1

    498631dffa5bd7401bed773238d918b9b291b463

  • SHA256

    721c16d4f313e9a875a6a8e480fef03b5b2bb1ec3bd59b0124ed6a2b617547d1

  • SHA512

    e2d0eeb8d086181c5388cbfbb19598b760b9b20db1b5a01c622af0358b56c4cc770c4199a7250a6855232d16f1cd7b734643af6d47c7098e6a06239aa9589ffd

  • SSDEEP

    12288:nruM9FNatyT3gNCpOdn/uXcZNJ7QD7HZ5rbx:q+atynpOd/FzJO7HX

Score
10/10
gh0stratpersistencerat

Malware Config

Signatures

  • Gh0st RAT payload 3 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\721c16d4f313e9a875a6a8e480fef03b5b2bb1ec3bd59b0124ed6a2b617547d1.exe
    "C:\Users\Admin\AppData\Local\Temp\721c16d4f313e9a875a6a8e480fef03b5b2bb1ec3bd59b0124ed6a2b617547d1.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    PID:1756

Network

  • flag-us
    DNS
    www.wk1888.com
    721c16d4f313e9a875a6a8e480fef03b5b2bb1ec3bd59b0124ed6a2b617547d1.exe
    Remote address:
    8.8.8.8:53
    Request
    www.wk1888.com
    IN A
    Response
    www.wk1888.com
    IN A
    107.165.232.232
  • flag-us
    DNS
    www.af0575.com
    721c16d4f313e9a875a6a8e480fef03b5b2bb1ec3bd59b0124ed6a2b617547d1.exe
    Remote address:
    8.8.8.8:53
    Request
    www.af0575.com
    IN A
    Response
    www.af0575.com
    IN A
    154.221.164.58
  • flag-us
    DNS
    www.fz0575.com
    721c16d4f313e9a875a6a8e480fef03b5b2bb1ec3bd59b0124ed6a2b617547d1.exe
    Remote address:
    8.8.8.8:53
    Request
    www.fz0575.com
    IN A
    Response
    www.fz0575.com
    IN A
    45.199.41.19
  • flag-us
    DNS
    164.2.77.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    164.2.77.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    9.9.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.3.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa
    Remote address:
    8.8.8.8:53
    Request
    9.9.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.3.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa
    IN PTR
    Response
  • 107.165.232.232:8000
    www.wk1888.com
    721c16d4f313e9a875a6a8e480fef03b5b2bb1ec3bd59b0124ed6a2b617547d1.exe
    260 B
     5
  • 154.221.164.58:8000
    www.af0575.com
    721c16d4f313e9a875a6a8e480fef03b5b2bb1ec3bd59b0124ed6a2b617547d1.exe
    260 B
     5
  • 13.69.239.72:443
    322 B
     7
  • 45.199.41.19:8000
    www.fz0575.com
    721c16d4f313e9a875a6a8e480fef03b5b2bb1ec3bd59b0124ed6a2b617547d1.exe
    260 B
     5
  • 107.165.232.232:8000
    www.wk1888.com
    721c16d4f313e9a875a6a8e480fef03b5b2bb1ec3bd59b0124ed6a2b617547d1.exe
    260 B
     5
  • 8.8.8.8:53
    www.wk1888.com
    dns
    721c16d4f313e9a875a6a8e480fef03b5b2bb1ec3bd59b0124ed6a2b617547d1.exe
    60 B
     76 B
     1
    1

    DNS Request

    www.wk1888.com

    DNS Response

    107.165.232.232

  • 8.8.8.8:53
    www.af0575.com
    dns
    721c16d4f313e9a875a6a8e480fef03b5b2bb1ec3bd59b0124ed6a2b617547d1.exe
    60 B
     76 B
     1
    1

    DNS Request

    www.af0575.com

    DNS Response

    154.221.164.58

  • 8.8.8.8:53
    www.fz0575.com
    dns
    721c16d4f313e9a875a6a8e480fef03b5b2bb1ec3bd59b0124ed6a2b617547d1.exe
    60 B
     76 B
     1
    1

    DNS Request

    www.fz0575.com

    DNS Response

    45.199.41.19

  • 8.8.8.8:53
    164.2.77.40.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    164.2.77.40.in-addr.arpa

  • 8.8.8.8:53
    9.9.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.3.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa
    dns
    118 B
     204 B
     1
    1

    DNS Request

    9.9.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.3.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1756-132-0x0000000010000000-0x0000000010121000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/1756-135-0x0000000010000000-0x0000000010121000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/1756-134-0x0000000010000000-0x0000000010121000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/1756-137-0x0000000010000000-0x0000000010121000-memory.dmp

    Filesize

    1.1MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.