Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
22-03-2023 07:31
General
-
Target
940a9b6805bfdaa1523f55d20e5895ad.com.exe
-
Size
18KB
-
MD5
940a9b6805bfdaa1523f55d20e5895ad
-
SHA1
ac37840fd87d9380ed40ab57f9ce411b002c37b6
-
SHA256
33e741219978b766b80213bdc5985c358f5100c297d43e4d30d6eb7794836ade
-
SHA512
c607941be78ae35440b10104a8b80423e00cbc6fa007a0c01b24f5e2460635e8ab9388658328adb0570df0cbfedfd94eb16efe1881367c265da8d4139b0d86f7
-
SSDEEP
384:x7HlMmf8xvauS6Pc6ki2UipTcV1VF0hXHMGBk7/UMQ3BIz:MmqvauSy2/+V1VaXLkj5
Malware Config
Signatures
-
Gh0st RAT payload 4 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Executes dropped EXE 1 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\940a9b6805bfdaa1523f55d20e5895ad.com.exe"C:\Users\Admin\AppData\Local\Temp\940a9b6805bfdaa1523f55d20e5895ad.com.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\Downloads\zipdata.tmp"C:\Users\Public\Downloads\zipdata.tmp"2⤵
- Executes dropped EXE
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
18KB
MD5940a9b6805bfdaa1523f55d20e5895ad
SHA1ac37840fd87d9380ed40ab57f9ce411b002c37b6
SHA25633e741219978b766b80213bdc5985c358f5100c297d43e4d30d6eb7794836ade
SHA512c607941be78ae35440b10104a8b80423e00cbc6fa007a0c01b24f5e2460635e8ab9388658328adb0570df0cbfedfd94eb16efe1881367c265da8d4139b0d86f7
-
Filesize
18KB
MD5940a9b6805bfdaa1523f55d20e5895ad
SHA1ac37840fd87d9380ed40ab57f9ce411b002c37b6
SHA25633e741219978b766b80213bdc5985c358f5100c297d43e4d30d6eb7794836ade
SHA512c607941be78ae35440b10104a8b80423e00cbc6fa007a0c01b24f5e2460635e8ab9388658328adb0570df0cbfedfd94eb16efe1881367c265da8d4139b0d86f7
-
Filesize
80KB
-
Filesize
180KB
-
Filesize
1.3MB
-
Filesize
344KB
-
Filesize
72KB
-
Filesize
396KB
-
Filesize
180KB
-
Filesize
180KB