Analysis

  • max time kernel
    47s
  • max time network
    68s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2022 09:47

General

  • Target

    2c012e2501d1b5020c86c6b2cc44eb7ff765da9a16b616b4f41cb2c185fe97c0.exe

  • Size

    80KB

  • MD5

    717a8e1c9d0debf0fa71d7a98ee5524b

  • SHA1

    5a8523499a61381eed5c898a57b7d483bb5b7476

  • SHA256

    2c012e2501d1b5020c86c6b2cc44eb7ff765da9a16b616b4f41cb2c185fe97c0

  • SHA512

    ee3fe4f9f5b0211a087beb7b537dcc5700aa17f39dbc5a26ee02782ffa09cc9c36f5fc49b2b148189d93c0f92af8e691ec1fdcf5508d6bbd2bcc63594ea6e8b6

  • SSDEEP

    1536:sFz0LnC0atiq+9Cc73McaTBFb0bJ+oa/xrpnHTlyojsjxNe22JjIHM:sFz90hq+Yc7Hf4oa5r5sojsj+oM

Malware Config

Signatures

  • Gh0st RAT payload 2 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2c012e2501d1b5020c86c6b2cc44eb7ff765da9a16b616b4f41cb2c185fe97c0.exe
    "C:\Users\Admin\AppData\Local\Temp\2c012e2501d1b5020c86c6b2cc44eb7ff765da9a16b616b4f41cb2c185fe97c0.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1184
    • C:\Windows\SysWOW64\net.exe
      net start "Task Scheduler"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:280
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 start "Task Scheduler"
        3⤵
          PID:764

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/280-59-0x0000000000000000-mapping.dmp

    • memory/764-60-0x0000000000000000-mapping.dmp

    • memory/1184-54-0x0000000076691000-0x0000000076693000-memory.dmp

      Filesize

      8KB

    • memory/1184-55-0x0000000010000000-0x0000000010046000-memory.dmp

      Filesize

      280KB

    • memory/1184-57-0x0000000010000000-0x0000000010046000-memory.dmp

      Filesize

      280KB

    • memory/1184-61-0x0000000010000000-0x0000000010046000-memory.dmp

      Filesize

      280KB