Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
-
submitted
04-09-2023 14:37
General
-
Target
0559fe720f7c8faa94c92a446af96627d4e7b162c5d1265c0f81c2fc6c900834.exe
-
Size
3.4MB
-
MD5
7f5cfea0aac9ffd06ef05c2ac2312e95
-
SHA1
059301b01e53779511aeb27d53c1f3c807f8741c
-
SHA256
0559fe720f7c8faa94c92a446af96627d4e7b162c5d1265c0f81c2fc6c900834
-
SHA512
b6a86345a5b231f5f7b1ea8c9b4b4e98ef69d8b05e1c8d9b3bf40ba5750bde5c309ff9fbcff3240c486c5bc61e1a0d99b9f88b62ad7b8743aeeac2936f7ff76a
-
SSDEEP
98304:rsIRrw/lBS7co9AAgWJ3XyB2I6H8MBfUYq6W9:rTOtBs9AArVyByHC7V
Score
10/10
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Suspicious behavior: RenamesItself 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0559fe720f7c8faa94c92a446af96627d4e7b162c5d1265c0f81c2fc6c900834.exe"C:\Users\Admin\AppData\Local\Temp\0559fe720f7c8faa94c92a446af96627d4e7b162c5d1265c0f81c2fc6c900834.exe"1⤵
- Checks BIOS information in registry
- Suspicious behavior: RenamesItself
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.0MB
-
Filesize
9.0MB
-
Filesize
9.0MB
-
Filesize
9.0MB
-
Filesize
9.0MB
-
Filesize
9.0MB
-
Filesize
1.5MB
-
Filesize
9.0MB
-
Filesize
9.0MB