Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
24-03-2023 10:53
General
-
Target
98ff83aa60ac3db4b22a864c09b7947f7def34a1f00d1f0eca388623365c9d80.exe
-
Size
1.1MB
-
MD5
38eb6a51e52969b019f6307787ba3490
-
SHA1
da5e209cee4a82e2b8d4b10240150b51a1b2bd3f
-
SHA256
98ff83aa60ac3db4b22a864c09b7947f7def34a1f00d1f0eca388623365c9d80
-
SHA512
742a98438f30b8e5457b077f723291764d0824ee9fbc12b06db133302c9e9f444daf0927b07e3fc4ce762156fd604d562bff585930c9b7b4ff69dc527539aa0e
-
SSDEEP
12288:sFn6o3FeN4Ddfv9g23kw+D18aZwezBNQu/HRNwy0kjG7BxQxn24o:g/3FeQg20Z18azNQ4Iy0kCT224
Malware Config
Extracted
Family
gh0strat
C2
3005.qmananan.com
Signatures
-
Gh0st RAT payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/4692-134-0x0000000000400000-0x00000000005E1000-memory.dmp family_gh0strat behavioral1/memory/4692-135-0x0000000010000000-0x0000000010010000-memory.dmp family_gh0strat behavioral1/memory/4692-138-0x0000000000400000-0x00000000005E1000-memory.dmp family_gh0strat -
Processes:
resource yara_rule behavioral1/memory/4692-133-0x0000000000400000-0x00000000005E1000-memory.dmp vmprotect behavioral1/memory/4692-134-0x0000000000400000-0x00000000005E1000-memory.dmp vmprotect behavioral1/memory/4692-138-0x0000000000400000-0x00000000005E1000-memory.dmp vmprotect
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4692-133-0x0000000000400000-0x00000000005E1000-memory.dmpFilesize
1.9MB
-
memory/4692-134-0x0000000000400000-0x00000000005E1000-memory.dmpFilesize
1.9MB
-
memory/4692-135-0x0000000010000000-0x0000000010010000-memory.dmpFilesize
64KB
-
memory/4692-138-0x0000000000400000-0x00000000005E1000-memory.dmpFilesize
1.9MB