Analysis

  • max time kernel
    148s
  • max time network
    139s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2023, 05:39

General

  • Target

    1032a3ed090f9abba2c1cba5f8412764.exe

  • Size

    143KB

  • MD5

    1032a3ed090f9abba2c1cba5f8412764

  • SHA1

    fb287a0a8a222221a9042f0b8ae52174b09ebb71

  • SHA256

    3a5d187a32e724419e9f09e614e24d2d16a68bfe30dff50c377a1e9286d219a9

  • SHA512

    652a75b4eae898980a643e09989869e5b3552f326df3582966f057dd1d9856915a198bcaac458b1f7766520eb2698f040964dc10478a5a65195b157cf0f70b15

  • SSDEEP

    3072:C69iSZOmD27rRavfCCY8feFgtV4dfFO5pctyhUeqovd3B3E:C/Sc1oykcFu3hUeqoJB0

Score
10/10

Malware Config

Signatures

  • Gh0st RAT payload 3 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • Deletes itself 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1032a3ed090f9abba2c1cba5f8412764.exe
    "C:\Users\Admin\AppData\Local\Temp\1032a3ed090f9abba2c1cba5f8412764.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2008
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k imgsvc
    1⤵
    • Deletes itself
    • Suspicious behavior: EnumeratesProcesses
    PID:2932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\2806500.dll

    Filesize

    101KB

    MD5

    ca3d84abd2632b1575c754b4404ec695

    SHA1

    6657872f3b828024bd2bee272cbcf34448e0ca53

    SHA256

    cb6e3f4a37bd4dde1ad468cc588f5d30a58ba2f91851ddfea4a5b96c06b3344f

    SHA512

    f894f8feca666629a05334f22e77b96137160be867e6250dca6adbe08e845f708506792afe735e4b890b87402b26065f4759b2a111d62856e008a670646f1978

  • C:\Windows\123.jpg

    Filesize

    145KB

    MD5

    bed70841662c86d69488dd3f5f83bdbd

    SHA1

    828b906c8d23edb97ee2fa86d26d70bc26895213

    SHA256

    d07c46bb724b03a24726b3650f88f79cbe094797cbdc4b151254710e801f0661

    SHA512

    f337b799da7b4fbe19a229e42b4720dac9130b928441750141ae33fa231b55099f7e3d619a0e3b081f1a53e9a8d611762ed4afeffdb3b42692ae258b6bdf9647

  • \??\c:\NT_Path.jpg

    Filesize

    85B

    MD5

    84e7de25b954e4383eca4cf4292f9487

    SHA1

    b3a11c94067e85d663a24c8b56a5792574c19d53

    SHA256

    f05513b5ae703bc9f4660a06fc3b41a7b90b36128ee5475661f029abbbc0b609

    SHA512

    a1b4c43989d41e03d1e2a0e9c5a8b39953d990138cd50eb6bd9efe4843594f1d98654fd41e15793a7795e90a31f3c648bded6c180a53846856d04b0a8bf17f28

  • memory/2008-11-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB