Analysis
-
max time kernel
166s -
max time network
181s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
27-11-2022 15:14
General
-
Target
060b30329114dc79d904ceefaf4ae276c23691eef14997b20259597fcde28e32.exe
-
Size
134KB
-
MD5
13eb7d3c5bd88098a92eeb42f58a2f75
-
SHA1
303ebcf2378cb16b36824465decc7bceb03fa1a8
-
SHA256
060b30329114dc79d904ceefaf4ae276c23691eef14997b20259597fcde28e32
-
SHA512
fb0304e03cfa828980918edfe8d4435f73c9c562d0b1506bc43323e615d64bbfdef60d3a1e90b49bc0027c7074e91eb25e1d2617b7ec0027c955bd6845be0440
-
SSDEEP
3072:MMwZSQpKa3VGVnpUlCz764/9xpEEBqbZuwz5iGHeqovv:M3JVGpxx9b3wZuwz4GHeqo
Malware Config
Signatures
-
Gh0st RAT payload 4 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Loads dropped DLL 2 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: LoadsDriver 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\060b30329114dc79d904ceefaf4ae276c23691eef14997b20259597fcde28e32.exe"C:\Users\Admin\AppData\Local\Temp\060b30329114dc79d904ceefaf4ae276c23691eef14997b20259597fcde28e32.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
101KB
MD5940cee512ad1de690a5ea964aeeb5824
SHA1f5a1cc4f263fe80e9c0f21e075b1ad746714c96e
SHA2564627eacd30ba1f21c05b3f5a24d9138003c08a26db346fd900712ece398a00ce
SHA5122f570e2e349099a18dd68f5d8a533ed3c7b6f61905f759b68e636be459765b2af7b0169bb2904aa3f7d3fd9aa9bd1c2fcf81f77d08029bcd8996a5c02dc64758
-
Filesize
101KB
MD5940cee512ad1de690a5ea964aeeb5824
SHA1f5a1cc4f263fe80e9c0f21e075b1ad746714c96e
SHA2564627eacd30ba1f21c05b3f5a24d9138003c08a26db346fd900712ece398a00ce
SHA5122f570e2e349099a18dd68f5d8a533ed3c7b6f61905f759b68e636be459765b2af7b0169bb2904aa3f7d3fd9aa9bd1c2fcf81f77d08029bcd8996a5c02dc64758
-
Filesize
4.4MB
MD501e6bae03ad1db4c748344b4b64aee32
SHA1765bc7438f2da938a07e980ffe39b8f9799a22c7
SHA2560cbe23d2c0f603058ffdd4d229371c0ab20eda7218898810d26248fce504cd5a
SHA5124ac056c219c6b0ba83c1861fc0776b19b8dcd197b906cdfe930925018e867580cc48f3d2630389cdc17e99bff7ac7c1bf2b22c6ec5b5a94e04bec1a4649c7bb0
-
Filesize
117B
MD5d83a3de3e8391c9122d69e9dae318c0e
SHA193d9c55ac957b086a41ec1c4c5b4847e35fb7948
SHA25623b341ace224a4ed6b1e17b2a21a7244b66dd718f949b635722d70b660cc435a
SHA51287ee22cddac6bc6861f42fd6b30cfabeabfcfe6af9f8fd66f8c83d1579a63d8756638668c599d3ddce5cca5a5bdeba851acec4dc994dcc1d4173a13cdada5bc9
-
Filesize
4.4MB
MD501e6bae03ad1db4c748344b4b64aee32
SHA1765bc7438f2da938a07e980ffe39b8f9799a22c7
SHA2560cbe23d2c0f603058ffdd4d229371c0ab20eda7218898810d26248fce504cd5a
SHA5124ac056c219c6b0ba83c1861fc0776b19b8dcd197b906cdfe930925018e867580cc48f3d2630389cdc17e99bff7ac7c1bf2b22c6ec5b5a94e04bec1a4649c7bb0
