Analysis
-
max time kernel
132s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
01/11/2023, 13:55
General
-
Target
NEAS.242ac47d2c804d28c9400d95ea393a70.exe
-
Size
192KB
-
MD5
242ac47d2c804d28c9400d95ea393a70
-
SHA1
887a112415f259abbfa6b766736327bebac7385c
-
SHA256
c2b39bce81daf90a1ef8e0218dd56c08a721ba7e1b0990b5f1ad71fbb8eaaa20
-
SHA512
63c2b9853f5c4a512a3ea3119b1b3f6aabb4ac950356db37c318d3d90c425d53228a75d6ba90b2455a023830687b5139cd17d5418b13036f59059f9282ed2a7e
-
SSDEEP
3072:/ZYhjFTttfP9ZGFwgvRLLCzOYFDq+UdnIPPlMzcsofIw+KaX0LcHLkMIIRK:hYhhT96wgvRHCzOYtqlGyzcsX3KA0LQ0
Score
10/10
Malware Config
Signatures
-
Gh0st RAT payload 6 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Drops file in Windows directory 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.242ac47d2c804d28c9400d95ea393a70.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.242ac47d2c804d28c9400d95ea393a70.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB