Analysis

  • max time kernel
    152s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 09:47

General

  • Target

    2c012e2501d1b5020c86c6b2cc44eb7ff765da9a16b616b4f41cb2c185fe97c0.exe

  • Size

    80KB

  • MD5

    717a8e1c9d0debf0fa71d7a98ee5524b

  • SHA1

    5a8523499a61381eed5c898a57b7d483bb5b7476

  • SHA256

    2c012e2501d1b5020c86c6b2cc44eb7ff765da9a16b616b4f41cb2c185fe97c0

  • SHA512

    ee3fe4f9f5b0211a087beb7b537dcc5700aa17f39dbc5a26ee02782ffa09cc9c36f5fc49b2b148189d93c0f92af8e691ec1fdcf5508d6bbd2bcc63594ea6e8b6

  • SSDEEP

    1536:sFz0LnC0atiq+9Cc73McaTBFb0bJ+oa/xrpnHTlyojsjxNe22JjIHM:sFz90hq+Yc7Hf4oa5r5sojsj+oM

Malware Config

Signatures

  • Gh0st RAT payload 3 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2c012e2501d1b5020c86c6b2cc44eb7ff765da9a16b616b4f41cb2c185fe97c0.exe
    "C:\Users\Admin\AppData\Local\Temp\2c012e2501d1b5020c86c6b2cc44eb7ff765da9a16b616b4f41cb2c185fe97c0.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4764
    • C:\Windows\SysWOW64\net.exe
      net start "Task Scheduler"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4332
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 start "Task Scheduler"
        3⤵
          PID:260

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/260-137-0x0000000000000000-mapping.dmp

    • memory/4332-136-0x0000000000000000-mapping.dmp

    • memory/4764-132-0x0000000010000000-0x0000000010046000-memory.dmp

      Filesize

      280KB

    • memory/4764-134-0x0000000010000000-0x0000000010046000-memory.dmp

      Filesize

      280KB

    • memory/4764-135-0x0000000010000000-0x0000000010046000-memory.dmp

      Filesize

      280KB

    • memory/4764-138-0x0000000010000000-0x0000000010046000-memory.dmp

      Filesize

      280KB