Overview

overview

10

Static

static

10

COMDLG32.dll

windows7-x64

1

COMDLG32.dll

windows10-2004-x64

1

MSADODC.dll

windows7-x64

1

MSADODC.dll

windows10-2004-x64

1

MSBIND.dll

windows7-x64

1

MSBIND.dll

windows10-2004-x64

1

MSCOMCT2.dll

windows7-x64

1

MSCOMCT2.dll

windows10-2004-x64

1

MSCOMCTL.dll

windows7-x64

1

MSCOMCTL.dll

windows10-2004-x64

1

MSDATGRD.dll

windows7-x64

1

MSDATGRD.dll

windows10-2004-x64

1

MSSTDFMT.dll

windows7-x64

1

MSSTDFMT.dll

windows10-2004-x64

1

MSWINSCK.dll

windows7-x64

1

MSWINSCK.dll

windows10-2004-x64

1

Readme-说明.htm

windows7-x64

1

Readme-说明.htm

windows10-2004-x64

1

jmail.dll

windows7-x64

1

jmail.dll

windows10-2004-x64

1

run.exe

windows7-x64

10

run.exe

windows10-2004-x64

10

yuren2008.exe

windows7-x64

yuren2008.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    199s
  • max time network
    203s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-11-2022 16:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    run.exe

  • Size

    107KB

  • MD5

    9600799c1b9ef711c48967fe354ef57c

  • SHA1

    10bbd5671d071c66e5a1c81d3f23b3be18d37f12

  • SHA256

    1e8cb74780f21ae6c11504f04cf084acfc4ef6a73cfa12e3bb8ce423c55cdae3

  • SHA512

    94037e08596bc60d8541b249a655b4aa16724727415a7672879699b29db0c70d1b3064cd20fd3cc50ae5ee2b1baf9d36b93b2f1f57a2afd5fcbbc2096210b1b3

  • SSDEEP

    3072:Rt6XkomyxsPRRf9joJFWZCZ1UTpO2BAsq+Bxa/2CGwp4jqR:Rt6XkomyxsPDf5oJFWZUO82G57/2CGw5

Score
10/10
gh0stratrat

Malware Config

Signatures

  • Gh0st RAT payload 1 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat
  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\run.exe
    "C:\Users\Admin\AppData\Local\Temp\run.exe"
    1⤵
      PID:1096
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1096 -s 284
        2⤵
        • Program crash
        PID:2956
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1096 -ip 1096
      1⤵
        PID:3196

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1096-132-0x0000000000400000-0x000000000041C000-memory.dmp

        Filesize

        112KB

        Download