Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
-
submitted
25-08-2023 22:26
General
-
Target
e20c228c3d5523326e82fe80e2b39b3a3df2c0c7c86bec74d6d96a5ff87ccb52.exe
-
Size
116KB
-
MD5
ba16b7fd2b9f12c64a6863bc1df3d98e
-
SHA1
1d40f7e47d012cca24dff1447d013e508e69afd2
-
SHA256
e20c228c3d5523326e82fe80e2b39b3a3df2c0c7c86bec74d6d96a5ff87ccb52
-
SHA512
0347548057cc6add745a2a95b047467194af325e8cbed026aa271f7383d7ea08941f09a460763075018941d456e19213cb7c521827ff5465b37e9f38964522f4
-
SSDEEP
3072:/4lvTjceezntY7DoaqCc/Bt7IwpS57s6r+:KL8Y7DoaqCwIwp
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 1 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 40 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e20c228c3d5523326e82fe80e2b39b3a3df2c0c7c86bec74d6d96a5ff87ccb52.exe"C:\Users\Admin\AppData\Local\Temp\e20c228c3d5523326e82fe80e2b39b3a3df2c0c7c86bec74d6d96a5ff87ccb52.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Arrange\NULL.jpg"C:\Program Files (x86)\Arrange\NULL.jpg"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Arrange\NULL.jpg"C:\Program Files (x86)\Arrange\NULL.jpg" Win72⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
116KB
MD5ba16b7fd2b9f12c64a6863bc1df3d98e
SHA11d40f7e47d012cca24dff1447d013e508e69afd2
SHA256e20c228c3d5523326e82fe80e2b39b3a3df2c0c7c86bec74d6d96a5ff87ccb52
SHA5120347548057cc6add745a2a95b047467194af325e8cbed026aa271f7383d7ea08941f09a460763075018941d456e19213cb7c521827ff5465b37e9f38964522f4
-
Filesize
116KB
MD5ba16b7fd2b9f12c64a6863bc1df3d98e
SHA11d40f7e47d012cca24dff1447d013e508e69afd2
SHA256e20c228c3d5523326e82fe80e2b39b3a3df2c0c7c86bec74d6d96a5ff87ccb52
SHA5120347548057cc6add745a2a95b047467194af325e8cbed026aa271f7383d7ea08941f09a460763075018941d456e19213cb7c521827ff5465b37e9f38964522f4
-
Filesize
116KB
MD5ba16b7fd2b9f12c64a6863bc1df3d98e
SHA11d40f7e47d012cca24dff1447d013e508e69afd2
SHA256e20c228c3d5523326e82fe80e2b39b3a3df2c0c7c86bec74d6d96a5ff87ccb52
SHA5120347548057cc6add745a2a95b047467194af325e8cbed026aa271f7383d7ea08941f09a460763075018941d456e19213cb7c521827ff5465b37e9f38964522f4
-
Filesize
116KB
MD5ba16b7fd2b9f12c64a6863bc1df3d98e
SHA11d40f7e47d012cca24dff1447d013e508e69afd2
SHA256e20c228c3d5523326e82fe80e2b39b3a3df2c0c7c86bec74d6d96a5ff87ccb52
SHA5120347548057cc6add745a2a95b047467194af325e8cbed026aa271f7383d7ea08941f09a460763075018941d456e19213cb7c521827ff5465b37e9f38964522f4
-
Filesize
72KB
