Analysis
-
max time kernel
150s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
01/12/2022, 15:26
General
-
Target
1433.exe
-
Size
89KB
-
MD5
5aba57f11f1176d0a81dc28af9e77bdc
-
SHA1
efd087836b0bdd281b984bde113ab7f234cb38da
-
SHA256
4cc6f99c47bac7dd9f849aed8b0509511d5015efc80a284ba9a66cc60a36a559
-
SHA512
12ff3484fd7cfa6f290159a32e689f5130932806b4b2ccedae888eff30f420686ebefcdf5bb3e1013257830fc64f925cd26f776855ffb0b48465de64420ed59d
-
SSDEEP
1536:A9IywkUpmqyz2Wq9/lwiMbtzW56lq1eFd6+BHy7dHc4uNg/t4Bu6:A9IYiy6bjkDkMvHB8cj46
Malware Config
Signatures
-
Gh0st RAT payload 8 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Executes dropped EXE 1 IoCs
-
Deletes itself 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1433.exe"C:\Users\Admin\AppData\Local\Temp\1433.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\eqjsmesvkb"C:\Users\Admin\AppData\Local\Temp\1433.exe" a -sc:\users\admin\appdata\local\temp\1433.exe2⤵
- Executes dropped EXE
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
22.2MB
MD515026e4a785423887638b79c76ff2ef5
SHA1a412c553e2a31857100f356a516c7a7ca2f83cd3
SHA256dd778e9bee98127a97ab1dba6dc0ba17466098aad594807733fcdecde4122a04
SHA512a293df2ae768f747f9ca67e87b54294ab55cb6e796d95a2db561e0c09ee45510ee85ea2cbadacfbdadcbac4f62e68c4397dc728964d74bf27e2d2841b6db0567
-
Filesize
3.7MB
MD5f5374c7bdba66232654820d588afff3c
SHA1e18546c29f69832b93b92c0eb5866baa4f5ca0f1
SHA25692f095ecb106338dad37f1dd1a942dc14d77ad1f8d01b11d2dcb4abaec93c551
SHA512d90ca4e5c80500193d87ccc4657c571415f7ff05fd7dbff0a2e62d2fefd174127d49567e86644a193aa1e6a007133562a74b27280ed4419adff7ff7371867897
-
Filesize
22.2MB
MD515026e4a785423887638b79c76ff2ef5
SHA1a412c553e2a31857100f356a516c7a7ca2f83cd3
SHA256dd778e9bee98127a97ab1dba6dc0ba17466098aad594807733fcdecde4122a04
SHA512a293df2ae768f747f9ca67e87b54294ab55cb6e796d95a2db561e0c09ee45510ee85ea2cbadacfbdadcbac4f62e68c4397dc728964d74bf27e2d2841b6db0567
-
Filesize
2.8MB
MD56d864441407ed6ae3aa1bcab6c356244
SHA12353884347106bd0a205ad34754b1b683e84a21d
SHA256a3c0b82b02a68e65e685f0820bd28e8be572877649668ec485c9b40f4f9cfb84
SHA51265aed289d3b196d67ce8d5b5cced765cecd107319f4de482ad8467a410b951d3c9799d703a981696cac86d31a7ca76e9e08411707c7cccf755b6ad5e8613eda3
-
Filesize
22.2MB
MD515026e4a785423887638b79c76ff2ef5
SHA1a412c553e2a31857100f356a516c7a7ca2f83cd3
SHA256dd778e9bee98127a97ab1dba6dc0ba17466098aad594807733fcdecde4122a04
SHA512a293df2ae768f747f9ca67e87b54294ab55cb6e796d95a2db561e0c09ee45510ee85ea2cbadacfbdadcbac4f62e68c4397dc728964d74bf27e2d2841b6db0567
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
52KB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
8KB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
296KB