Analysis
-
max time kernel
148s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
26/12/2023, 08:40
General
-
Target
60828b0a3aed7ff1459a1e074b09f0dc.exe
-
Size
172KB
-
MD5
60828b0a3aed7ff1459a1e074b09f0dc
-
SHA1
1320999d1a87cc79239da25dbaf607e79f06ee8e
-
SHA256
4c746db20fe8d91ddd3e1402347b1e43a257d8db7ffa0c9061b891571d632ad2
-
SHA512
9fb481f68b00cb1b5794e9b721a41363df160ccfd248b7b6b68c7704829ff6aea6ad044e085c6f199441b95ca31049218e7eaf2b714e4fdb4ec10e9dc225a8a3
-
SSDEEP
3072:sX8gvoZhGH8RiRnvth6y47VFRg6rb1Zb/aQfZ6eiPeqovqw:sX8JZhmZ6yShltZbCVheqoi
Malware Config
Signatures
-
Gh0st RAT payload 9 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Deletes itself 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\60828b0a3aed7ff1459a1e074b09f0dc.exe"C:\Users\Admin\AppData\Local\Temp\60828b0a3aed7ff1459a1e074b09f0dc.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Deletes itself
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
128KB
MD51dfb2e9715ce138f498d3d8c9590d765
SHA1a1574cf30aff7f92ab0e7896b87a780629f3ab2a
SHA256054731d0f2a81aff46c5a467b2ddf42a5cc9ae39ee46b7bac836956e00333d29
SHA512308a27e261857435e7235a2070f7e58cea6290c9d0e52f22bc16a665252e978d50b8310d36303e861dadcd27faa824b931b46081dffefc3e816cef255f172a6c
-
Filesize
106KB
MD503df342c8a52597294946d391068cc58
SHA164b82872b16ba860a303111e810b19a6545bbb16
SHA25627609b16eacce27c98fb146c84f205b0cabddf701560774a1a1c2a80d9db1edf
SHA5126631088635d91a9fc13b126797e5135de767e1cc774f65c28874d679b330bfeed437039cd3617c25f0e8ba2843c349a5cad8644a236ef68fe39089f02f15b9df
-
Filesize
85B
MD546e6856cf2f8fbe501fdefd2adec9044
SHA1dc201316513caff4672c02dfcc00a847a01e777b
SHA256377bcb51ac7e75da0e676e697c869c69ff2322eef3f6c3a56ea354457a42b2ef
SHA51236cbc7c01977f3f1ec033201893674b9d13a2ac23e35fead8656e0930256f425a2128d57fadcbde033b754877a66476541bd1f1d208eafb0b46bac28d05a2caf
-
Filesize
65KB
MD51df57c3524e9a15aefdea9068478ff5e
SHA1ecaf662afb1b0b9385918f660d5b582600fc7602
SHA25638d43ab95d08e2036c4868b65dbb119f1a81f444896f32685fdfc87f0606e60b
SHA512fd7cacf75d65c9bd390235e641d6d6f62b2b409a14ea5b91ea43655bfea9e47a3a644c22dda2724d68b1d6f428019cfb60d5b54c9e01bd503c9d509ad9d2ee21
-
Filesize
78KB
MD5a022e4a2bc39d729327782492ef485cb
SHA14d5d678e50683a7ee8e186fb992b6bc287753d94
SHA256d08984574cea751a7e9db12649ac750ca136c4326683676394010c920773a1e2
SHA512a9c1b1aaad1040f5e0429e2053ac5afb93900b07f89cf7980289b67a0528a67b45abf86d233120871e2fdc06567dd712e74fbeb9dfd3e448bd6467058bce09bd
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
172KB
-
Filesize
132KB
