Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
28/12/2023, 22:56
General
-
Target
fe463a49a4446fcaf52ba769c917b203.exe
-
Size
192KB
-
MD5
fe463a49a4446fcaf52ba769c917b203
-
SHA1
21120db5c551cf1f95d544a2c09d56d61c0758b4
-
SHA256
79ffd7653880068fb44a441fbbab8e727b7ae7bd06304dfbc4d7816ebd6dd7ab
-
SHA512
aa21a12a2a6f9cc0b4e38271d49710d266f11b5fd54f4cade7aff953cd02003d09fc78bc66d5dd36bede042725828a9d4bdd95844c0c5d93b4a197dc30c81ef3
-
SSDEEP
3072:r2y1AnWLgCRlBsEcumxPiS6MRBAKAVRDDZOHv27KVfgjJUexltjkwbwHMim3D:ynWLgCRAEcu+fGK4XOHv2RxlNk4ws
Score
10/10
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
-
Deletes itself 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory 1 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
-
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe463a49a4446fcaf52ba769c917b203.exe"C:\Users\Admin\AppData\Local\Temp\fe463a49a4446fcaf52ba769c917b203.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility1⤵
- Sets DLL path for service in the registry
- Sets service image path in registry
- Deletes itself
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
156KB
-
Filesize
196KB
-
Filesize
196KB