Analysis
-
max time kernel
192s -
max time network
186s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
14-10-2023 17:51
General
-
Target
NEAS.3b4435c492862dbcbe76824854c02600.exe
-
Size
135KB
-
MD5
3b4435c492862dbcbe76824854c02600
-
SHA1
9582f5a6baa9a20a67d8aef685f5845715794d73
-
SHA256
6af6e64202cb3703d3b054d33d7cea6514bd583a07b81148dddc82194df830e8
-
SHA512
d016e4dc26a3593aba3ab036ded8f70e4a3ded1af7ab965d2d03d4df98ad8b7083dd56e5f66148f1ba233f292f20f9693138e522ece2d0ee3d4aaa39eac2bb73
-
SSDEEP
3072:e02gsmbHGhqCkQINRiUsIPZLJh90vbXDztaZ14a8l:87m6hqCfysKEz8Z1Fg
Malware Config
Signatures
-
Gh0st RAT payload 4 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.3b4435c492862dbcbe76824854c02600.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.3b4435c492862dbcbe76824854c02600.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\zmxrwm.exeC:\Windows\zmxrwm.exe1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135KB
MD53b4435c492862dbcbe76824854c02600
SHA19582f5a6baa9a20a67d8aef685f5845715794d73
SHA2566af6e64202cb3703d3b054d33d7cea6514bd583a07b81148dddc82194df830e8
SHA512d016e4dc26a3593aba3ab036ded8f70e4a3ded1af7ab965d2d03d4df98ad8b7083dd56e5f66148f1ba233f292f20f9693138e522ece2d0ee3d4aaa39eac2bb73
-
Filesize
135KB
MD53b4435c492862dbcbe76824854c02600
SHA19582f5a6baa9a20a67d8aef685f5845715794d73
SHA2566af6e64202cb3703d3b054d33d7cea6514bd583a07b81148dddc82194df830e8
SHA512d016e4dc26a3593aba3ab036ded8f70e4a3ded1af7ab965d2d03d4df98ad8b7083dd56e5f66148f1ba233f292f20f9693138e522ece2d0ee3d4aaa39eac2bb73
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB