Analysis
-
max time kernel
153s -
max time network
62s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
02/12/2022, 22:18
General
-
Target
fe309f1274044a5199ef58465f6331fdb76c6d6522643987fd30abbcbe518c55.exe
-
Size
186KB
-
MD5
bef247b87ded3ca5235b5167274b3e38
-
SHA1
49bcdc33993d9716947f3d690f18c4a4eaba65af
-
SHA256
fe309f1274044a5199ef58465f6331fdb76c6d6522643987fd30abbcbe518c55
-
SHA512
bd8849db435710046149808e8f04d2917cc33b72c017cd80d3f1cb85233c10b24bf67e2645ea853961e275762c790375db8be064095b77cda1f5d3b6cd0aaac3
-
SSDEEP
3072:DHoxMfZ7kmP3n5XSoz/t1UFC6Dhh9cOQsKWTShRwwa2cx8m7Stw8iAgu:DHox4X5hR1UB3Q8TShRwwcv2ysR
Malware Config
Signatures
-
Gh0st RAT payload 5 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
-
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Deletes itself 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 45 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe309f1274044a5199ef58465f6331fdb76c6d6522643987fd30abbcbe518c55.exe"C:\Users\Admin\AppData\Local\Temp\fe309f1274044a5199ef58465f6331fdb76c6d6522643987fd30abbcbe518c55.exe"1⤵
- Sets DLL path for service in the registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k svchost1⤵
- Deletes itself
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
123KB
MD5e5e9cba0b7e45f5d5dff20d16fbe7c0e
SHA1f312f8e2f5d87f78e7cdef0995b4abb702ca8964
SHA256130c5ad87ca3cc8cccdbc57425f1ab78aeb7be63e9de7f2d0a830e7e21128144
SHA5123a161fecbf65d674d05cc88e0056f69bea313019c45c9c4eb5b734a0550df4cd4a47f78cc5b106590b644d75926365db4529c78ac50693a69c8f4d5d4ddfcccd
-
Filesize
123KB
MD5e5e9cba0b7e45f5d5dff20d16fbe7c0e
SHA1f312f8e2f5d87f78e7cdef0995b4abb702ca8964
SHA256130c5ad87ca3cc8cccdbc57425f1ab78aeb7be63e9de7f2d0a830e7e21128144
SHA5123a161fecbf65d674d05cc88e0056f69bea313019c45c9c4eb5b734a0550df4cd4a47f78cc5b106590b644d75926365db4529c78ac50693a69c8f4d5d4ddfcccd
-
Filesize
8KB
-
Filesize
1.1MB
-
Filesize
132KB
-
Filesize
132KB