Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
22/09/2023, 05:39
General
-
Target
e76c24926275e4aa90876c29d1ed64781146b2df00ffe660f3152da8c06c0cb7.exe
-
Size
1.1MB
-
MD5
81063a6ec8fc6b35a92d03c335b61cad
-
SHA1
a7f5173a6c5774e5c4be66f6e5496aa86fc6ec87
-
SHA256
e76c24926275e4aa90876c29d1ed64781146b2df00ffe660f3152da8c06c0cb7
-
SHA512
62964c54bc063f8bc351f7372add1d8f7a2f38b49c6d4a6ce07739a634ae355c9a43dd43810271919dcbfa2f99964050784250108332d1b59595a597a54e55f5
-
SSDEEP
24576:psRkWF5Vi5Fu5xfSejKWaxRc0Ou1R1DSR0EA1RIkE7cLyll5:yRk+5kwvQIu1R10A1ukEFV
Malware Config
Extracted
gh0strat
192.253.237.97
Signatures
-
Gh0st RAT payload 2 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
-
Program crash 1 IoCs
-
Enumerates system info in registry 2 TTPs 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e76c24926275e4aa90876c29d1ed64781146b2df00ffe660f3152da8c06c0cb7.exe"C:\Users\Admin\AppData\Local\Temp\e76c24926275e4aa90876c29d1ed64781146b2df00ffe660f3152da8c06c0cb7.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e76c24926275e4aa90876c29d1ed64781146b2df00ffe660f3152da8c06c0cb7mgr.exeC:\Users\Admin\AppData\Local\Temp\e76c24926275e4aa90876c29d1ed64781146b2df00ffe660f3152da8c06c0cb7mgr.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3176 -s 2643⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3176 -ip 31761⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105KB
MD5dfb5daabb95dcfad1a5faf9ab1437076
SHA14a199569a9b52911bee7fb19ab80570cc5ff9ed1
SHA25654282ec29d4993ed6e9972122cfbb70bba4898a21d527bd9e72a166d7ec2fdc0
SHA5125d31c34403ab5f8db4a6d84f2b5579d4ea18673914b626d78e458a648ac20ddd8e342818e807331036d7bb064f596a02b9737acac42fbead29260343a30717e8
-
Filesize
105KB
MD5dfb5daabb95dcfad1a5faf9ab1437076
SHA14a199569a9b52911bee7fb19ab80570cc5ff9ed1
SHA25654282ec29d4993ed6e9972122cfbb70bba4898a21d527bd9e72a166d7ec2fdc0
SHA5125d31c34403ab5f8db4a6d84f2b5579d4ea18673914b626d78e458a648ac20ddd8e342818e807331036d7bb064f596a02b9737acac42fbead29260343a30717e8
-
Filesize
364KB
-
Filesize
4KB
-
Filesize
364KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
192KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
488KB
-
Filesize
1.6MB
-
Filesize
2.1MB
-
Filesize
1.4MB