Analysis
-
max time kernel
70s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
02-12-2022 16:52
General
-
Target
648992a672e992b4107e6c58a54b10b38806e598810bfe1d6e2a2b52bcaed0b8.exe
-
Size
75KB
-
MD5
19e4da8d695e95ec8802dbc4e75d0e25
-
SHA1
8f4d9e4206c2a59cc9a410ad48d68d321bf3f69e
-
SHA256
648992a672e992b4107e6c58a54b10b38806e598810bfe1d6e2a2b52bcaed0b8
-
SHA512
5936390af27ac7b40ca45dd97ba57f3b605656d15a33b6f7a50856e3d2d9fee08a3353c416808c8ca6364f0e732146424d7fd5aa263bb56eb725118ab49c9946
-
SSDEEP
1536:DoPsWsRDR5zEzcKJP69QAKah6JjfolkbSdfqaP0bj6mQnzy:DoPfsBzkcYP6yAKM6JslkfaPznzy
Score
10/10
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Program crash 1 IoCs
-
Suspicious behavior: LoadsDriver 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\648992a672e992b4107e6c58a54b10b38806e598810bfe1d6e2a2b52bcaed0b8.exe"C:\Users\Admin\AppData\Local\Temp\648992a672e992b4107e6c58a54b10b38806e598810bfe1d6e2a2b52bcaed0b8.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 3202⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2440 -ip 24401⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
189KB
-
Filesize
12KB
-
Filesize
189KB