Analysis
-
max time kernel
62s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
26-11-2022 18:02
General
-
Target
1433_hack44.cn/12-18/Gh0st.exe
-
Size
2.6MB
-
MD5
2c691584a50ac8cdfc05f2fb54440a1d
-
SHA1
baf0ea2cc4f40e50c22103555467b397c01ef2b1
-
SHA256
9d6f5d85e3563556b1e96191e536807d9973b6210b4893f14eaefdb90425a212
-
SHA512
287f652ee5066f641c18b6db342e0c768ee209fdcb7a0e23885ec762a7559ecd35db511e421128e6e06317989f7c6469302e412056f328d021d3b11f53e1372b
-
SSDEEP
49152:q0hYlq/48tcZUhOhEwj26ntNqn3njurXHMYVTuVbX59ku:q0h+q2Ghg3wn3jur7VKd5t
Score
8/10
Malware Config
Signatures
-
UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1433_hack44.cn\12-18\Gh0st.exe"C:\Users\Admin\AppData\Local\Temp\1433_hack44.cn\12-18\Gh0st.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.2MB
-
Filesize
8KB
-
Filesize
6.2MB
-
Filesize
6.2MB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB