Analysis
-
max time kernel
117s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
16/10/2023, 09:00
General
-
Target
1fce8b9f38fcc8ba94217892687dd2663a450fb120f12bbc520865b7055742a7.exe
-
Size
3.1MB
-
MD5
afda95541d982e00709ed9d5e3b67d41
-
SHA1
ffc360180e44a92a7faa6a996028f33701b5e6b1
-
SHA256
1fce8b9f38fcc8ba94217892687dd2663a450fb120f12bbc520865b7055742a7
-
SHA512
f10acc956fe2d50547edf24d763ceea4bc66fa801545068adadc1c7765896d45d4e2ada253413453d60266382a0cf8dcc33a8663215cd8225cdd428d9776f5f7
-
SSDEEP
98304:LFBpdAoM5C3Vz6+OYT5Z+ljDKEjJH5BNFFnWoEaa4OiZrq1DfPHNADtV6v+m:hBpmUVz9n+ljx7nWoEr4O7NADtV6v+m
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 6 IoCs
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1fce8b9f38fcc8ba94217892687dd2663a450fb120f12bbc520865b7055742a7.exe"C:\Users\Admin\AppData\Local\Temp\1fce8b9f38fcc8ba94217892687dd2663a450fb120f12bbc520865b7055742a7.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\BitTorrent\EvernoteMouseTray.exe"C:\Users\Public\BitTorrent\EvernoteMouseTray.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61B
MD50fcbd853e01aa6f177d2f3b67545bc82
SHA19f74a379dbe44723656abcb0ec21aaf1f1cebe36
SHA2566ae6a905c577e823c39a5edf6c6497b801f97308b8d0d0a42f7fe3fe379de513
SHA5122900c3a4e1ce53fbc85a022e9740baa2c1a9d3d3c4cf7e8ad3452d64a2d4981e51699ecd2dfe40707fd07b4fc81d16aed417df24e1c05974e5e07b4a1bdd1bc5
-
Filesize
2.0MB
MD52ff236ca982bc4fdd29586ab77c49fdd
SHA1187b43ea891e01b6530d249b988c713d826c04e7
SHA2569064ab3843cb154f46a2e4d9a5d0f2df9bedd1a684efaba8a6e94cb77070edf3
SHA512c43f693d095fe02a53368fb9d3ea207f1082201afebd00076eb08bad082e71cf2ec66bc1bb45405278c91afdf8b6087b366540843c88cfcf80184c2e15b1504d
-
Filesize
2.0MB
MD52ff236ca982bc4fdd29586ab77c49fdd
SHA1187b43ea891e01b6530d249b988c713d826c04e7
SHA2569064ab3843cb154f46a2e4d9a5d0f2df9bedd1a684efaba8a6e94cb77070edf3
SHA512c43f693d095fe02a53368fb9d3ea207f1082201afebd00076eb08bad082e71cf2ec66bc1bb45405278c91afdf8b6087b366540843c88cfcf80184c2e15b1504d
-
Filesize
411KB
MD5e3c817f7fe44cc870ecdbcbc3ea36132
SHA12ada702a0c143a7ae39b7de16a4b5cc994d2548b
SHA256d769fafa2b3232de9fa7153212ba287f68e745257f1c00fafb511e7a02de7adf
SHA5124fcf3fcdd27c97a714e173aa221f53df6c152636d77dea49e256a9788f2d3f2c2d7315dd0b4d72ecefc553082f9149b8580779abb39891a88907f16ec9e13cbe
-
Filesize
755KB
MD5bf38660a9125935658cfa3e53fdc7d65
SHA10b51fb415ec89848f339f8989d323bea722bfd70
SHA25660c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa
SHA51225f521ffe25a950d0f1a4de63b04cb62e2a3b0e72e7405799586913208bf8f8fa52aa34e96a9cc6ee47afcd41870f3aa0cd8289c53461d1b6e792d19b750c9a1
-
Filesize
576KB
MD500e4d9349ca60fd4799472d8464f7c8d
SHA1d96dff8a5d83166853245a731cd3c722be9cbf64
SHA25631d785f49ef62d7c641126bd4568ea46bb03d85b97e99dbfc34b0b34df6ca51a
SHA512f2ea397e16dab407057362787fcb0bc6610fc5060d1fa60630ec655f04d0131516bf3dc59179c0a2936c0a714fa99eb3fe27f4c754da3df445aa2e6e3775070d
-
Filesize
4.2MB
MD5f32077df74efd435a1dcdf415e189df1
SHA12771393d56ff167275bf03170377c43c28ee14e1
SHA25624bb6838defd491df5460a88bed2d70b903a2156c49fb63e214e2c77251eca71
SHA512fb708e0949854998fb80635138c80ac05d77dca3089d3e5974663ddf2376d6a03535dae1a068514c3b58bc06c8e4078b37cfb6bc90f080f7f31fefc972a34850
-
Filesize
305KB
MD55d6c90d2cb177500f7b46f8c7caf6531
SHA14fc46eb0cf80073855580ec34b319fe361020379
SHA256e512dc10ff8d33efe688c3214be608a40ecf4f1f7b4f9659ff6efc9a6827ee40
SHA512eb35f337e0a6387d4bc47b6d9be241e4ea2c28936e3b4edc58448fc205b55c8171ec40399293b24e949fbb2a656918056e498b6dbedd6757c7bf2151862aa0d0
-
Filesize
93B
MD5c8887f9c30372f71e3d3d20276cb868b
SHA14e0b25e6144dba5da40b10b332a8fea3ff81f718
SHA2567083b54c98c2b6dd3248192e73af17e6caebfe047ec16b8e6e33f3d28e20ed98
SHA5121af47f493bf874a010bdf6927d1e691dbe7ff74ec43036977599ddd3d01e40c2df75112573c5c3666cc66f5e6125fef23c1ebe12473668d9014f79c52fdf5fa7
-
Filesize
60KB
MD53b1d46c4eb061065a5bb32d4fbb86b79
SHA1b04e3e18bee6dc6f298e2242c89041d16eb2d8bf
SHA2564e56158a4c191bff82056902290346109c8354eb7e43ba7de8e127535eb09507
SHA512d024ce1446086c0552d12f2bb117149821637cfaa887e4159a4fd94b0db4dee10126fc2c1577ef00e7efe89ee041b98f26c88996f4058b52300e4cff856af24d
-
Filesize
2.0MB
MD52ff236ca982bc4fdd29586ab77c49fdd
SHA1187b43ea891e01b6530d249b988c713d826c04e7
SHA2569064ab3843cb154f46a2e4d9a5d0f2df9bedd1a684efaba8a6e94cb77070edf3
SHA512c43f693d095fe02a53368fb9d3ea207f1082201afebd00076eb08bad082e71cf2ec66bc1bb45405278c91afdf8b6087b366540843c88cfcf80184c2e15b1504d
-
Filesize
4.2MB
MD5f32077df74efd435a1dcdf415e189df1
SHA12771393d56ff167275bf03170377c43c28ee14e1
SHA25624bb6838defd491df5460a88bed2d70b903a2156c49fb63e214e2c77251eca71
SHA512fb708e0949854998fb80635138c80ac05d77dca3089d3e5974663ddf2376d6a03535dae1a068514c3b58bc06c8e4078b37cfb6bc90f080f7f31fefc972a34850
-
Filesize
305KB
MD55d6c90d2cb177500f7b46f8c7caf6531
SHA14fc46eb0cf80073855580ec34b319fe361020379
SHA256e512dc10ff8d33efe688c3214be608a40ecf4f1f7b4f9659ff6efc9a6827ee40
SHA512eb35f337e0a6387d4bc47b6d9be241e4ea2c28936e3b4edc58448fc205b55c8171ec40399293b24e949fbb2a656918056e498b6dbedd6757c7bf2151862aa0d0
-
Filesize
411KB
MD5e3c817f7fe44cc870ecdbcbc3ea36132
SHA12ada702a0c143a7ae39b7de16a4b5cc994d2548b
SHA256d769fafa2b3232de9fa7153212ba287f68e745257f1c00fafb511e7a02de7adf
SHA5124fcf3fcdd27c97a714e173aa221f53df6c152636d77dea49e256a9788f2d3f2c2d7315dd0b4d72ecefc553082f9149b8580779abb39891a88907f16ec9e13cbe
-
Filesize
755KB
MD5bf38660a9125935658cfa3e53fdc7d65
SHA10b51fb415ec89848f339f8989d323bea722bfd70
SHA25660c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa
SHA51225f521ffe25a950d0f1a4de63b04cb62e2a3b0e72e7405799586913208bf8f8fa52aa34e96a9cc6ee47afcd41870f3aa0cd8289c53461d1b6e792d19b750c9a1
-
Filesize
60KB
MD53b1d46c4eb061065a5bb32d4fbb86b79
SHA1b04e3e18bee6dc6f298e2242c89041d16eb2d8bf
SHA2564e56158a4c191bff82056902290346109c8354eb7e43ba7de8e127535eb09507
SHA512d024ce1446086c0552d12f2bb117149821637cfaa887e4159a4fd94b0db4dee10126fc2c1577ef00e7efe89ee041b98f26c88996f4058b52300e4cff856af24d
-
Filesize
600KB
-
Filesize
600KB
-
Filesize
492KB
-
Filesize
600KB