Analysis
-
max time kernel
189s -
max time network
219s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
26/12/2023, 11:48
General
-
Target
6bfaf13f199eea66483a44878dd5a646.exe
-
Size
96KB
-
MD5
6bfaf13f199eea66483a44878dd5a646
-
SHA1
03b73d5de0bb7fc3d5ec5c70b32a66f73db5583b
-
SHA256
26cf8c53b438bd1329b6b45f9b6fb146458c889a4e5dbcd88e4cf393c4676cee
-
SHA512
eef57fd4e021b5005699e7cba367377c0ee0b051a2fc66c28fb8dc78704838df6ce0002c8d8a41ac6942ee1724ece8b7e53640bc9c54a385859092104042a2f5
-
SSDEEP
1536:B5FusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prnRJiCTSv7ZU:BvS4jHS8q/3nTzePCwNUh4E9zi/zZU
Malware Config
Signatures
-
Gh0st RAT payload 4 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory 2 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 18 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6bfaf13f199eea66483a44878dd5a646.exe"C:\Users\Admin\AppData\Local\Temp\6bfaf13f199eea66483a44878dd5a646.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\huuqkjdoqc"C:\Users\Admin\AppData\Local\Temp\6bfaf13f199eea66483a44878dd5a646.exe" a -sc:\users\admin\appdata\local\temp\6bfaf13f199eea66483a44878dd5a646.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20.9MB
MD5c5bcbb2bac20a31037c4a16ed7a91eb6
SHA1c827cf030b68eae17e90c9e90787f1987ee24874
SHA25676e1891e84306214d3856894fe70bf432b2c1db987c2c76705af380d722a474e
SHA5129ba8850805135f1a0304663a492898a133ec155e1e488b1322119a2aab8fb853e4fdbf7ed178066d1b6e28aeb49cafbe91b701731fa55df455d76059c6d4c8a5
-
Filesize
8.1MB
MD50b541020496d67556a81228ce84c2bae
SHA1e1bc93406c3d5da11b81e39a0c81026edb7de7cf
SHA256a908cc15aa2688e908adad3bfd887b8636cf0c705418ec71bdcae78137ad8f81
SHA5124a81a0c1d1646f82ccd28fb3936862af7c3d02591a55dd2892fbdb000316f37c430daa3abe025f7a27dc96cfdfda7a00774d564a15a528ff6f025d7b3ff4fcf5
-
Filesize
9.1MB
MD5a2b87a7cf431448c83d0bab9074c7b2b
SHA158cd0582ae47585f4c9128d56dbe4e904f2e07b4
SHA25637cf0d134e2cbd93dc560fb41f79c06d7befd0efbf98fc5254a24f71a53f404f
SHA51225992ebaebb37e94ef65007ca1ccbb939810ad3a6468f8b1d6f839807a0b42e31cbf8f870f6adc68e0ec9f381112c4bcd75ac7d83b7a97aebfe1e02fb700f783
-
Filesize
3.6MB
MD531da2f42a127eea642b45bef454d0e36
SHA13aed68aba5fa955dc275c529ead0b8bdcc438a46
SHA25684d2def8f0b6339fa546bb8e5c9e4867afe7479299f452a664fea3631d983bd5
SHA512c594275360995ab67119e2e0c065cbf4e74457a350941676d920b01b093faed32ab63bee80fc79c3c3f1e3daabd66d9981d39e2c575e36a0363d7b6a903250a9
-
Filesize
17.0MB
MD52d4278d41b2569e7ed0dc77dbc05c058
SHA1d8b060452bf8a85774a6e824ff84b6eb337ad91d
SHA256e66cfa10f554d182086fcd7d9620147c14a371cf8510ddec47bfb63b900dac36
SHA512b354fd2e9422ec89d8346289370f5102b413a1f34a6e1acaea7f8127469f49e4140a5e52ee94282e749e6ca6c9d1d16a0a2489f0da7adb7d70981de09aab0889
-
Filesize
4KB
-
Filesize
312KB
-
Filesize
4KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
316KB
-
Filesize
312KB
-
Filesize
316KB
-
Filesize
312KB
-
Filesize
4KB