Analysis
-
max time kernel
123s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
12-10-2023 07:54
General
-
Target
f85f55b11d4a57b986e488c7392d0a2b1a6c02b822372254f0e4814e5e2f0ae0.exe
-
Size
40KB
-
MD5
1262c317a4bd23f059b6007571ce70a6
-
SHA1
fe8802282a9e66cac4cba6af2c91e759b45aad14
-
SHA256
f85f55b11d4a57b986e488c7392d0a2b1a6c02b822372254f0e4814e5e2f0ae0
-
SHA512
68fc22ec17cd92f0bb2ded885c9e58ded87a0166244e1341e1890ce83c4be239de8e1f1d88a79362961f727749937eb8c9447743695dfa1f787890021275217c
-
SSDEEP
384:Iq/btbJG9YmWHcdaILhRleEZn8Xy12qrzRDtadcvWd:IkttGXRs0jlew8U2qyJd
Score
10/10
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f85f55b11d4a57b986e488c7392d0a2b1a6c02b822372254f0e4814e5e2f0ae0.exe"C:\Users\Admin\AppData\Local\Temp\f85f55b11d4a57b986e488c7392d0a2b1a6c02b822372254f0e4814e5e2f0ae0.exe"1⤵
- Adds Run key to start application
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
312KB
-
Filesize
96KB