Overview

overview

10

Static

static

56cfc33a6a...24.exe

windows7-x64

10

56cfc33a6a...24.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2022 15:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    56cfc33a6a32ad236324ad32761a624cd4143f0ba42c82e94577d1b5f3619624.exe

  • Size

    189KB

  • MD5

    bf8c806886770f0c76dce1628abc8144

  • SHA1

    133adfbb850e8229a6486d6c189ab958911fd783

  • SHA256

    56cfc33a6a32ad236324ad32761a624cd4143f0ba42c82e94577d1b5f3619624

  • SHA512

    94e9cf15c205617556121c919d20962e6a5caa3038baee618ca5a2d0f5327290b538e4d7d1a8685385c28dde6ed424ee19a0b3ebe9d955ba104ff90db4ea8e1c

  • SSDEEP

    3072:XrNBkqN25qYRl14/hNyhHkw5dNRg4fM3aTTxpTZwsQMSbak:X253RlAhMhHkiNG4fM3aTzdwsab

Score
10/10
gh0stratrat

Malware Config

Signatures

  • Gh0st RAT payload 1 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat
  • Executes dropped EXE 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\56cfc33a6a32ad236324ad32761a624cd4143f0ba42c82e94577d1b5f3619624.exe
    "C:\Users\Admin\AppData\Local\Temp\56cfc33a6a32ad236324ad32761a624cd4143f0ba42c82e94577d1b5f3619624.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1808
  • C:\Windows\rcflye.exe
    C:\Windows\rcflye.exe
    1⤵
    • Executes dropped EXE
    • Suspicious behavior: GetForegroundWindowSpam
    PID:1736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\rcflye.exe
    Filesize

    189KB

    MD5

    bf8c806886770f0c76dce1628abc8144

    SHA1

    133adfbb850e8229a6486d6c189ab958911fd783

    SHA256

    56cfc33a6a32ad236324ad32761a624cd4143f0ba42c82e94577d1b5f3619624

    SHA512

    94e9cf15c205617556121c919d20962e6a5caa3038baee618ca5a2d0f5327290b538e4d7d1a8685385c28dde6ed424ee19a0b3ebe9d955ba104ff90db4ea8e1c

    Download Submit

  • C:\Windows\rcflye.exe
    Filesize

    189KB

    MD5

    bf8c806886770f0c76dce1628abc8144

    SHA1

    133adfbb850e8229a6486d6c189ab958911fd783

    SHA256

    56cfc33a6a32ad236324ad32761a624cd4143f0ba42c82e94577d1b5f3619624

    SHA512

    94e9cf15c205617556121c919d20962e6a5caa3038baee618ca5a2d0f5327290b538e4d7d1a8685385c28dde6ed424ee19a0b3ebe9d955ba104ff90db4ea8e1c

    Download Submit

  • memory/1808-54-0x0000000076171000-0x0000000076173000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1808-55-0x0000000010000000-0x000000001002F000-memory.dmp

    Filesize

    188KB

    Download