Analysis
-
max time kernel
151s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230621-en -
resource tags
-
submitted
01-07-2023 21:39
General
-
Target
Ghast Setup.exe
-
Size
47.0MB
-
MD5
aade6b70530baa03c6f520119161d224
-
SHA1
ba2d3b60a32e5a4ca5033ceb27ef4bc0613086c8
-
SHA256
7cb380bb249c35afb4a56dfe8a8dec9a6a87a76c1dc7301d9a4e62eabd03a3d1
-
SHA512
e8d8f3385efa219368d2a153031e0ef934e8c4e480cca22a54be526297e9093acbd6fe5bc4e6c8353c3712612d2b36f7b6f2312e0d182b73a8bba746b7092296
-
SSDEEP
786432:F1pKaCrTgJhsBqMCiMz0WSt++sQVOcHJ4ok7icr1TEDgvFGv1XqWHb:F6fWwsnSt++tAwq7icnvm
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ghast Setup.exe"C:\Users\Admin\AppData\Local\Temp\Ghast Setup.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-55J54.tmp\Ghast Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-55J54.tmp\Ghast Setup.tmp" /SL5="$80022,48404993,898048,C:\Users\Admin\AppData\Local\Temp\Ghast Setup.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD5161d1bd06392e424ebf8e4f7971db25b
SHA1e77ded0d21db752db95dee086137cf138701c99a
SHA2568c5f29f44a196946191e3ef6f6e8b829c9e6123176b4a4223ada06724471437c
SHA512e3474f14633de67411ca0e3c26f18b0629b60d6e8f330c71bfadf0a6995cbcf356dc0b063eedd6712a764bfae4ada901ffdcc9285a337a02d045aabcdb4135f6
-
Filesize
3.1MB
MD5161d1bd06392e424ebf8e4f7971db25b
SHA1e77ded0d21db752db95dee086137cf138701c99a
SHA2568c5f29f44a196946191e3ef6f6e8b829c9e6123176b4a4223ada06724471437c
SHA512e3474f14633de67411ca0e3c26f18b0629b60d6e8f330c71bfadf0a6995cbcf356dc0b063eedd6712a764bfae4ada901ffdcc9285a337a02d045aabcdb4135f6
-
Filesize
4KB
-
Filesize
3.1MB
-
Filesize
928KB
-
Filesize
928KB