Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
02-06-2023 08:05
General
-
Target
tmp.exe
-
Size
188KB
-
MD5
1f3eff47818b6c31bf220154c0fdee12
-
SHA1
26772f42ff36dc47e4aed1f7bbb4b0e331978410
-
SHA256
bff74dc434e208598c2ba484341c6275eaeaa87992043f936e8915bde97b94a2
-
SHA512
8d49c5a8e8885a359732bfef5805f57e981aa16a624756f0c37287ef2a5ecd7b9932633c217e9f3bdb1d317317a6118cfced97afe268a7f72272f08726c5ac12
-
SSDEEP
3072:IWTDNVSbckR+z7uHVuoHsvmhtfwrHY52Lr0l7STUyg5f0oDAAt02un3:nvSbckA2VuisvmPOzptg5BA5p3
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Modifies RDP port number used by Windows 1 TTPs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 56 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 24 IoCs
-
Suspicious use of SendNotifyMessage 7 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file c:\IMG_0050.MOV2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4f0 0x4b41⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.4MB
MD565b738f038962f076c94dee1f8b7db92
SHA141196bd05f89582c812e551dcde3ba6221e99c63
SHA256628790c3dcd300d5934193a09323986a585bf60f8b8f9561812ce1977c6ce12c
SHA5123bb978b6030c5d2c1d8303696cfbdb0c70230082876c804cd996a75faabb4cb8c58eeb7ab186df9bae8f396d5f59d45a4b33614c6b74f62827df082e9d5df5d3
-
Filesize
992KB
-
Filesize
208KB
-
Filesize
2.7MB
-
Filesize
92KB
-
Filesize
92KB
-
Filesize
116KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
96KB
-
Filesize
2.0MB
-
Filesize
16.7MB
-
Filesize
252KB
-
Filesize
132KB
-
Filesize
96KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
96KB
-
Filesize
444KB
-
Filesize
344KB
-
Filesize
1.5MB
-
Filesize
92KB
-
Filesize
192KB
-
Filesize
304KB
-
Filesize
1.4MB
-
Filesize
72KB
-
Filesize
2.3MB
-
Filesize
348KB
-
Filesize
264KB
-
Filesize
1.4MB
-
Filesize
412KB
-
Filesize
108KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
64KB
-
Filesize
23.7MB
-
Filesize
188KB
-
Filesize
68KB
-
Filesize
468KB
-
Filesize
88KB
-
Filesize
84KB
-
Filesize
80KB
-
Filesize
2.1MB
-
Filesize
76KB
-
Filesize
84KB
-
Filesize
76KB
-
Filesize
976KB
-
Filesize
140KB
-
Filesize
168KB
-
Filesize
1.5MB
-
Filesize
76KB
-
Filesize
108KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
68KB
-
Filesize
320KB
-
Filesize
436KB
-
Filesize
392KB
-
Filesize
788KB
-
Filesize
312KB
-
Filesize
120KB