Analysis
-
max time kernel
161s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
25/11/2022, 17:42
General
-
Target
95628119f356b488419f4e3658d93339dc733b44263e39d3ea1a5de4bff85acb.exe
-
Size
91KB
-
MD5
dc9b035ec514ea0cd1df6dbd3e243437
-
SHA1
afbd4434df70c76981d38ef477296bca39c24ce7
-
SHA256
95628119f356b488419f4e3658d93339dc733b44263e39d3ea1a5de4bff85acb
-
SHA512
4b247e39f034655a73706b2759989fb39f04684ca82e7762c6989700fa734cd0c3ab0db3fae18e96272d2b0a0582ea5c6f7086cee3e12e7ccf69a26087318da3
-
SSDEEP
1536:edUVasm9gAHGsOqujkQINbte1EGZpqX5+Ic4FP9MsJLyqTOtEP0Boma1oHXDzt5d:e2gsmbHGhqCkQINRiUsIPZLJh90vbXDV
Malware Config
Signatures
-
Gh0st RAT payload 7 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\95628119f356b488419f4e3658d93339dc733b44263e39d3ea1a5de4bff85acb.exe"C:\Users\Admin\AppData\Local\Temp\95628119f356b488419f4e3658d93339dc733b44263e39d3ea1a5de4bff85acb.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\zgxdcg.exeC:\Windows\zgxdcg.exe1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
91KB
MD5dc9b035ec514ea0cd1df6dbd3e243437
SHA1afbd4434df70c76981d38ef477296bca39c24ce7
SHA25695628119f356b488419f4e3658d93339dc733b44263e39d3ea1a5de4bff85acb
SHA5124b247e39f034655a73706b2759989fb39f04684ca82e7762c6989700fa734cd0c3ab0db3fae18e96272d2b0a0582ea5c6f7086cee3e12e7ccf69a26087318da3
-
Filesize
91KB
MD5dc9b035ec514ea0cd1df6dbd3e243437
SHA1afbd4434df70c76981d38ef477296bca39c24ce7
SHA25695628119f356b488419f4e3658d93339dc733b44263e39d3ea1a5de4bff85acb
SHA5124b247e39f034655a73706b2759989fb39f04684ca82e7762c6989700fa734cd0c3ab0db3fae18e96272d2b0a0582ea5c6f7086cee3e12e7ccf69a26087318da3
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
8KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB