Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
25/12/2023, 06:17
General
-
Target
0afaeef479f93bdc60bb639b18f60eca.exe
-
Size
95KB
-
MD5
0afaeef479f93bdc60bb639b18f60eca
-
SHA1
6e3c3d58bf88f80242c720c66fb93115e138724a
-
SHA256
49bf9b104775088fe07e2f26ced8367189952df95575ad244a15fc593190f775
-
SHA512
1718225859f9ed5b92c08e9664e7fca9b08f2047bf85e9dc2e32f230318dd56f297508c93adc1cf269b5371c985994b029d74e418091cf563d5810e964ce5d06
-
SSDEEP
1536:KFFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8pr9bwLFk0D6A:KLS4jHS8q/3nTzePCwNUh4E92Fk0uA
Malware Config
Signatures
-
Gh0st RAT payload 5 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory 2 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 6 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 18 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0afaeef479f93bdc60bb639b18f60eca.exe"C:\Users\Admin\AppData\Local\Temp\0afaeef479f93bdc60bb639b18f60eca.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\gtihbnjsmr"C:\Users\Admin\AppData\Local\Temp\0afaeef479f93bdc60bb639b18f60eca.exe" a -sc:\users\admin\appdata\local\temp\0afaeef479f93bdc60bb639b18f60eca.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD586dd31907042310a3be4c1c621b46864
SHA19b3f40bebd693cad471854141d220f5d7e149a24
SHA2569d688b09be98e3d145c31ec0406570382c61245a9d4456fd8d04d7d61b34b1ed
SHA5126df102e71bcce545fbdaacdda3294e865af6cfb4e809b92286f0a3a97fb64cb843935fb0b894a7dd9a587c8ad086497300701861166a46010379c261514f2857
-
Filesize
236KB
MD5e6612d877e554dd7b9819c2ecb72c38e
SHA14874deaf998cb1845fa490323ebe71e75abe404f
SHA256704089ed18a0a296fdf3caa8d91b1794a93917d3e1e486d3293a359588bd240c
SHA51249983b24d00f83196b810317257aa17fa240d145d867a70802ae2108dab5910913009606f551cd16c3283d3fd4749e26c578466837a4c726635636527bb6852b
-
Filesize
92KB
MD5f50916b5dfc5e14fc4ad68561cae04e9
SHA187692c43a3d42fbf394beb1fd4e4197373012a49
SHA2563145647b3e5abd701f316db51d20490d984f2c6484168a3660aa718cb9dd7c9d
SHA51219b4550677ac350c2771cc99280bf3e8555131df2f5e184bc68a624c45c393b8655a0ff3ac73992b8e3bd0cc7dbfc7a8613461cf720bbfe5487899e9e73b3d3b
-
Filesize
1.6MB
MD5e3bd46d095b4ab40befdd14e79a4a230
SHA1ca07c88dfa74a93d0c6a0d0c4c4651e073a5b0df
SHA256738c979d787fdad5694b1b5fa7c878d2d3a801e81b4a1c1a00bfe4b02b9eb864
SHA512a69d9a2f1ea132a96f5eb34254ea27824b5074479b12d5c9cdba0e0d3a3f32c7b1ed563c4e4ab2b1d56229029c932f100ecf8ca0c87e9cd4d6314985afd8878a
-
Filesize
579KB
MD5c8a1e4feb33cbfa965be9080b8689d7b
SHA1fe2ded2ceb4331369384a057c24e22402436b0fc
SHA256151dfb4aa22baea836c5fa06f5497f14fb74f2ae37c9692edb88b5973554642b
SHA512c1b5a81f146dac808745e2ae453b8bdac0d7cf472e5b5d5f42b4cc5e5d70f8d1fd350dab877cf778ec31a7e0af08707fb6dba7e44beef38b51be9db460d92db1
-
Filesize
313KB
-
Filesize
313KB
-
Filesize
4KB
-
Filesize
313KB
-
Filesize
313KB
-
Filesize
4KB
-
Filesize
313KB
-
Filesize
313KB
-
Filesize
316KB