Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30-12-2023 06:44
General
-
Target
11582d5b304618a72758a284988f5bcd.exe
-
Size
252KB
-
MD5
11582d5b304618a72758a284988f5bcd
-
SHA1
629ec287cfaaf107e83a35ce7ebba8534049ec16
-
SHA256
dab7dec1dc8dc829d8d76ccc061f3789ef22195dd008d89755b2a4e02b6ce028
-
SHA512
37679646039a5e09192b83ddb31325fbef69c31b1e768fde0a0dba221badea4aff5e3cae60eafc18ccd27e673f80cd553154d4626401a532698c4f4a067b0538
-
SSDEEP
6144:SxprF/c5ANnj62gRFXV44colzQ9c6p2ItBDj+ZOYF:qp5/cq9QhIoS9VfDjEOa
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 10 IoCs
-
Drops file in Windows directory 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\11582d5b304618a72758a284988f5bcd.exe"C:\Users\Admin\AppData\Local\Temp\11582d5b304618a72758a284988f5bcd.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\gyggue.exeC:\Windows\gyggue.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
226KB
MD523b2cf72529947ce85d63b4c4ebbe9e6
SHA113f88098374bc09a20e4bd467634770fcf1823aa
SHA256bec247dbd58c324045f04268af47edd80cfe6ae5b4076fa2fe00f6e4bf783545
SHA51238eca9e139290108f582529361effd79e65649d5705bd50d858d9d1ce36dc35918adeed97b5f160fd626161f8a6e6a002567d92156dc7fe2a93901afae0140e0
-
Filesize
252KB
MD511582d5b304618a72758a284988f5bcd
SHA1629ec287cfaaf107e83a35ce7ebba8534049ec16
SHA256dab7dec1dc8dc829d8d76ccc061f3789ef22195dd008d89755b2a4e02b6ce028
SHA51237679646039a5e09192b83ddb31325fbef69c31b1e768fde0a0dba221badea4aff5e3cae60eafc18ccd27e673f80cd553154d4626401a532698c4f4a067b0538
-
Filesize
196KB
-
Filesize
196KB