Analysis
-
max time kernel
188s -
max time network
202s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
03-12-2022 23:42
General
-
Target
da133e995e3f8b6d4b4b0fa8b57a1cb1e6180ecfd9618064f46f53167126d668.exe
-
Size
131KB
-
MD5
98d61cfcb810ea3ffbc6f21ce14fabea
-
SHA1
bc6423a5a21a7664dfa825d3df52ddff087de8c8
-
SHA256
da133e995e3f8b6d4b4b0fa8b57a1cb1e6180ecfd9618064f46f53167126d668
-
SHA512
bc82c0a8b792c66ca240c438c627740bd7e3a9751ae57db43faaf7879039819e62f787292e3ed2f1da6fb3383ae348dfdf808582c6fa5423f60ce1585ed422ec
-
SSDEEP
3072:gu+2qlgByBTEur7VsuRh/DBiE/8bNJFX6ccx+tJdnJ0:gADyBTE0V1LDw5N3qccqJdnJ0
Score
10/10
Malware Config
Signatures
-
Gh0st RAT payload 3 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\da133e995e3f8b6d4b4b0fa8b57a1cb1e6180ecfd9618064f46f53167126d668.exe"C:\Users\Admin\AppData\Local\Temp\da133e995e3f8b6d4b4b0fa8b57a1cb1e6180ecfd9618064f46f53167126d668.exe"1⤵
- Sets DLL path for service in the registry
- Drops file in System32 directory
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
16KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB