Analysis
-
max time kernel
153s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
07-10-2023 07:09
General
-
Target
90b1ff266e372c682edb1d335b339fdd647c438d21bda5e3d2739a21aa8aaa5c.exe
-
Size
11.8MB
-
MD5
84d1b8f9debb4a0e336a8a4cb444eb33
-
SHA1
bbcf359df23a0cc764672c759226184bc54fd30a
-
SHA256
90b1ff266e372c682edb1d335b339fdd647c438d21bda5e3d2739a21aa8aaa5c
-
SHA512
453dba43165c0dd0269edfa04a6251791eb2a5149f85880b2b61138cd1c49d24654461f1d161d8209f34b074480d918cbf5730be44f7b345425daa8c08e88651
-
SSDEEP
196608:ubwAAhq4tUvEa4kqGher9AEXvUxhdJfpPw4QD+zuBRfG1XqrTIDK:ubnCfWvXqTJN8xBF1ZK4q
Malware Config
Signatures
-
Gh0st RAT payload 5 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 38 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
-
Drops file in Windows directory 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\90b1ff266e372c682edb1d335b339fdd647c438d21bda5e3d2739a21aa8aaa5c.exe"C:\Users\Admin\AppData\Local\Temp\90b1ff266e372c682edb1d335b339fdd647c438d21bda5e3d2739a21aa8aaa5c.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\1.exeC:\Users\1.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Dtldt.exeC:\Windows\Dtldt.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\Dtldt.exeC:\Windows\Dtldt.exe -acsi2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
494KB
MD56a487d4ff5ab55efb99243fafc9f7e62
SHA104c43c8f01e201298571a8060bf598880a865393
SHA256b3e7d4b6f1c4a973e00d80a3426cd511d7159783c6eca8cfafd636e162870aa0
SHA5120eb8763b432ca33d5f31d970946228980d2a93bcc23f01a0e73c5412cb1aa39a8f2f19d74e007e4042b5eb16e614556596606427ef4053123344bd2ae8d00bbf
-
Filesize
494KB
MD56a487d4ff5ab55efb99243fafc9f7e62
SHA104c43c8f01e201298571a8060bf598880a865393
SHA256b3e7d4b6f1c4a973e00d80a3426cd511d7159783c6eca8cfafd636e162870aa0
SHA5120eb8763b432ca33d5f31d970946228980d2a93bcc23f01a0e73c5412cb1aa39a8f2f19d74e007e4042b5eb16e614556596606427ef4053123344bd2ae8d00bbf
-
Filesize
494KB
MD56a487d4ff5ab55efb99243fafc9f7e62
SHA104c43c8f01e201298571a8060bf598880a865393
SHA256b3e7d4b6f1c4a973e00d80a3426cd511d7159783c6eca8cfafd636e162870aa0
SHA5120eb8763b432ca33d5f31d970946228980d2a93bcc23f01a0e73c5412cb1aa39a8f2f19d74e007e4042b5eb16e614556596606427ef4053123344bd2ae8d00bbf
-
Filesize
494KB
MD56a487d4ff5ab55efb99243fafc9f7e62
SHA104c43c8f01e201298571a8060bf598880a865393
SHA256b3e7d4b6f1c4a973e00d80a3426cd511d7159783c6eca8cfafd636e162870aa0
SHA5120eb8763b432ca33d5f31d970946228980d2a93bcc23f01a0e73c5412cb1aa39a8f2f19d74e007e4042b5eb16e614556596606427ef4053123344bd2ae8d00bbf
-
Filesize
494KB
MD56a487d4ff5ab55efb99243fafc9f7e62
SHA104c43c8f01e201298571a8060bf598880a865393
SHA256b3e7d4b6f1c4a973e00d80a3426cd511d7159783c6eca8cfafd636e162870aa0
SHA5120eb8763b432ca33d5f31d970946228980d2a93bcc23f01a0e73c5412cb1aa39a8f2f19d74e007e4042b5eb16e614556596606427ef4053123344bd2ae8d00bbf
-
Filesize
494KB
MD56a487d4ff5ab55efb99243fafc9f7e62
SHA104c43c8f01e201298571a8060bf598880a865393
SHA256b3e7d4b6f1c4a973e00d80a3426cd511d7159783c6eca8cfafd636e162870aa0
SHA5120eb8763b432ca33d5f31d970946228980d2a93bcc23f01a0e73c5412cb1aa39a8f2f19d74e007e4042b5eb16e614556596606427ef4053123344bd2ae8d00bbf
-
Filesize
494KB
MD56a487d4ff5ab55efb99243fafc9f7e62
SHA104c43c8f01e201298571a8060bf598880a865393
SHA256b3e7d4b6f1c4a973e00d80a3426cd511d7159783c6eca8cfafd636e162870aa0
SHA5120eb8763b432ca33d5f31d970946228980d2a93bcc23f01a0e73c5412cb1aa39a8f2f19d74e007e4042b5eb16e614556596606427ef4053123344bd2ae8d00bbf
-
Filesize
494KB
MD56a487d4ff5ab55efb99243fafc9f7e62
SHA104c43c8f01e201298571a8060bf598880a865393
SHA256b3e7d4b6f1c4a973e00d80a3426cd511d7159783c6eca8cfafd636e162870aa0
SHA5120eb8763b432ca33d5f31d970946228980d2a93bcc23f01a0e73c5412cb1aa39a8f2f19d74e007e4042b5eb16e614556596606427ef4053123344bd2ae8d00bbf
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
23.1MB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
4KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
4KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.1MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB