7cb380bb249c35afb4a56dfe8a8dec9a6a87a76c1dc7301d9a4e62eabd03a3d1

Resubmissions

01-04-2023 01:51

01-04-2023 01:44

max time kernel
153s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
01-04-2023 01:44

Target

Ghast Setup.exe
Size

47.0MB
MD5

aade6b70530baa03c6f520119161d224
SHA1

ba2d3b60a32e5a4ca5033ceb27ef4bc0613086c8
SHA256

7cb380bb249c35afb4a56dfe8a8dec9a6a87a76c1dc7301d9a4e62eabd03a3d1
SHA512

e8d8f3385efa219368d2a153031e0ef934e8c4e480cca22a54be526297e9093acbd6fe5bc4e6c8353c3712612d2b36f7b6f2312e0d182b73a8bba746b7092296
SSDEEP

786432:F1pKaCrTgJhsBqMCiMz0WSt++sQVOcHJ4ok7icr1TEDgvFGv1XqWHb:F6fWwsnSt++tAwq7icnvm

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

Ghast Setup.tmp

pid process

2028 Ghast Setup.tmp
Loads dropped DLL 1 IoCs

Processes:

Ghast Setup.exe

pid process

1704 Ghast Setup.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Ghast Setup.tmp

pid process

2028 Ghast Setup.tmp

pid	process
2028	Ghast Setup.tmp

pid	process
1704	Ghast Setup.exe

pid	process
2028	Ghast Setup.tmp

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

Ghast Setup.exe

description	pid	process	target process
PID 1704 wrote to memory of 2028	1704	Ghast Setup.exe	Ghast Setup.tmp
PID 1704 wrote to memory of 2028	1704	Ghast Setup.exe	Ghast Setup.tmp
PID 1704 wrote to memory of 2028	1704	Ghast Setup.exe	Ghast Setup.tmp
PID 1704 wrote to memory of 2028	1704	Ghast Setup.exe	Ghast Setup.tmp
PID 1704 wrote to memory of 2028	1704	Ghast Setup.exe	Ghast Setup.tmp
PID 1704 wrote to memory of 2028	1704	Ghast Setup.exe	Ghast Setup.tmp
PID 1704 wrote to memory of 2028	1704	Ghast Setup.exe	Ghast Setup.tmp

C:\Users\Admin\AppData\Local\Temp\is-IB7H5.tmp\Ghast Setup.tmp
Filesize
3.1MB

MD5
161d1bd06392e424ebf8e4f7971db25b

SHA1
e77ded0d21db752db95dee086137cf138701c99a

SHA256
8c5f29f44a196946191e3ef6f6e8b829c9e6123176b4a4223ada06724471437c

SHA512
e3474f14633de67411ca0e3c26f18b0629b60d6e8f330c71bfadf0a6995cbcf356dc0b063eedd6712a764bfae4ada901ffdcc9285a337a02d045aabcdb4135f6

Download Submit
\Users\Admin\AppData\Local\Temp\is-IB7H5.tmp\Ghast Setup.tmp
Filesize
3.1MB

MD5
161d1bd06392e424ebf8e4f7971db25b

SHA1
e77ded0d21db752db95dee086137cf138701c99a

SHA256
8c5f29f44a196946191e3ef6f6e8b829c9e6123176b4a4223ada06724471437c

SHA512
e3474f14633de67411ca0e3c26f18b0629b60d6e8f330c71bfadf0a6995cbcf356dc0b063eedd6712a764bfae4ada901ffdcc9285a337a02d045aabcdb4135f6

Download Submit
memory/1704-54-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/1704-63-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/2028-62-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2028-64-0x0000000000400000-0x0000000000723000-memory.dmp

Filesize
3.1MB

Download