Analysis
-
max time kernel
174s -
max time network
194s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
06/12/2022, 23:30
General
-
Target
e7b32d3fb2885a25d2f07a5e1a216d292ca80c3a888113d6b232330eeb9814ce.exe
-
Size
2.0MB
-
MD5
df70662c7f535acc97affbf6e2e7057f
-
SHA1
7a42d87a74c44b19fe2a45091d5e76e53197a37a
-
SHA256
e7b32d3fb2885a25d2f07a5e1a216d292ca80c3a888113d6b232330eeb9814ce
-
SHA512
30d9e1b1a677d76d7e4e1bf941f9759236366efc96cc66535fd0f019020a5f7f9ca379ab29544c0dbde4e0fe5d3fb112e29431fbc56d3947291d97a5c21e5d57
-
SSDEEP
49152:B/9PaL4YU6/ivJD0a4sFY2bG/OTAy+ltv5MFVBML:L5YT/gH/Fvb5oloFML
Malware Config
Signatures
-
Gh0st RAT payload 4 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Executes dropped EXE 2 IoCs
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies Internet Explorer settings 1 TTPs 13 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7b32d3fb2885a25d2f07a5e1a216d292ca80c3a888113d6b232330eeb9814ce.exe"C:\Users\Admin\AppData\Local\Temp\e7b32d3fb2885a25d2f07a5e1a216d292ca80c3a888113d6b232330eeb9814ce.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Temp\DNFÄÈÄÈ5.78APCÈ«ÆÁÃëɱ°æ.exe"C:\Users\Admin\AppData\Local\Temp\Temp\DNFÄÈÄÈ5.78APCÈ«ÆÁÃëɱ°æ.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\Temp\server.exe"2⤵
- Executes dropped EXE
- Sets DLL path for service in the registry
-
-
C:\Windows\System32\svchost.exeC:\Windows\\System32\\svchost.exe -k netsvcs -s FastUserSwitchingCompatibility1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5093bed7e76ce12adb39a25a0a305eb5e
SHA13a519900a647f672e8772dc4817bbc737565d552
SHA2565d0e9d04527a4044aa04f34a0dd327ac5c59e72795313ab5a7707bac5534f50d
SHA512c38d9a4936b6bd61cea7e201bebd97c540fd41b06f41278fd98344fb11d84c10becb3e4dd98a6e146941169d484293c3956f653c6b36f5e5683a30ae6a0e1382
-
Filesize
2.1MB
MD5093bed7e76ce12adb39a25a0a305eb5e
SHA13a519900a647f672e8772dc4817bbc737565d552
SHA2565d0e9d04527a4044aa04f34a0dd327ac5c59e72795313ab5a7707bac5534f50d
SHA512c38d9a4936b6bd61cea7e201bebd97c540fd41b06f41278fd98344fb11d84c10becb3e4dd98a6e146941169d484293c3956f653c6b36f5e5683a30ae6a0e1382
-
Filesize
105KB
MD5e19310d0d750927972ea607c8b4457c7
SHA1af73b11b9bac5b8558d1354213032cb588f2136b
SHA2561e76fc6941324f529d2f050aff699f42f03f9d1cb52c1bb7c3c1204e04f8bf72
SHA512832418d2b0c0798d40b46af1b07df7a939612916c4d2c5fb5f29340042bc259154ece6a6d76f8ccfe9754d7ce7f8bed4bd1feb75159067898991739640dcb2bc
-
Filesize
105KB
MD5e19310d0d750927972ea607c8b4457c7
SHA1af73b11b9bac5b8558d1354213032cb588f2136b
SHA2561e76fc6941324f529d2f050aff699f42f03f9d1cb52c1bb7c3c1204e04f8bf72
SHA512832418d2b0c0798d40b46af1b07df7a939612916c4d2c5fb5f29340042bc259154ece6a6d76f8ccfe9754d7ce7f8bed4bd1feb75159067898991739640dcb2bc
-
Filesize
112KB
-
Filesize
112KB
-
Filesize
112KB
-
Filesize
112KB
-
Filesize
112KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB