Analysis
-
max time kernel
159s -
max time network
184s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
29/11/2022, 15:26
General
-
Target
941f075dd53a31ea3cc99de8542ca75df3ea7df334066fcbf8eaf80294b6a42c.exe
-
Size
162KB
-
MD5
2ae361acb1546401026453f4f3a2853d
-
SHA1
7a127715845f0b5fd8979bd36710cb27162c58b6
-
SHA256
941f075dd53a31ea3cc99de8542ca75df3ea7df334066fcbf8eaf80294b6a42c
-
SHA512
de779560d5b0e02f0cd89a0c3e0d4ff60e05a3b2e78c7a15b7bc704d3ad72e29f51a8202f0554eea289cb7578d7adfa80c14da142f1cf8519a99a6b6e364b919
-
SSDEEP
3072:SQhZkOLfuDg0PtOqzKONqsEykRLSDGoFnlMMfRn4icUolBu2K2rtNtJAN:oOFStZzKqqsE6pFtFcZgr2rF+
Score
10/10
Malware Config
Signatures
-
Gh0st RAT payload 3 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\941f075dd53a31ea3cc99de8542ca75df3ea7df334066fcbf8eaf80294b6a42c.exe"C:\Users\Admin\AppData\Local\Temp\941f075dd53a31ea3cc99de8542ca75df3ea7df334066fcbf8eaf80294b6a42c.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 6082⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1380 -ip 13801⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
236KB