Analysis
-
max time kernel
137s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
12/04/2023, 16:19
General
-
Target
caece8f8ccb77b8a3e2ee14770e2c4b734a8573b8a0dc676be0782e27389182a.exe
-
Size
310KB
-
MD5
65deedccc1dcbe6b1cbc074c3855e0ba
-
SHA1
0d5051e9329194a96f8836082f6e308b3520a495
-
SHA256
caece8f8ccb77b8a3e2ee14770e2c4b734a8573b8a0dc676be0782e27389182a
-
SHA512
c1ad0acaa2ed39ee15eb63a0c0d198862d7fc6135858c4e69ca6f901a21c42dbeb03e4429f19d3e4fd977ddd92033b8b7edff99be13c8d5d9df64f7d7695444d
-
SSDEEP
3072:VNWlkU/r+37BO8ynhvd01vYJPp9Hfj/NTNW95xpIImWKyB:V4l9+3QZd0QPp9HfZu5LIImWv
Score
10/10
Malware Config
Signatures
-
Gh0st RAT payload 8 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Blocklisted process makes network request 2 IoCs
-
UPX packed file 10 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: EnumeratesProcesses 29 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\caece8f8ccb77b8a3e2ee14770e2c4b734a8573b8a0dc676be0782e27389182a.exe"C:\Users\Admin\AppData\Local\Temp\caece8f8ccb77b8a3e2ee14770e2c4b734a8573b8a0dc676be0782e27389182a.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe -Puppet2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
-
Filesize
312KB
-
Filesize
68KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
68KB
-
Filesize
1.3MB
-
Filesize
312KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
4KB