Overview

overview

10

Static

static

10

12ed17cd89...1a.exe

windows7-x64

10

12ed17cd89...1a.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    152s
  • max time network
    169s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/12/2023, 08:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    12ed17cd89808dbc6657075a1073a71a.exe

  • Size

    230KB

  • MD5

    12ed17cd89808dbc6657075a1073a71a

  • SHA1

    066591245dd90dea00cf8677a1c0e58ca6d4efc9

  • SHA256

    6635884f6f9b1aa13b0fc3b9246b565fb0d7a12d75205e4da7173710d2796b0c

  • SHA512

    71e2dfb6347cf3da13e6a1487f645b76d748f82964fb8a8f5bcedb2b7b27375e8392da4f74be23d60cbc828dd7974aa69108f5160a08231ac2f54ca583a37ee3

  • SSDEEP

    3072:I4Q8st1snHhc8t9q9naOzJ12SiWe/RagJ1zekmEjJYX0Layn11KXO:9IsnHhc8t9qx3zJQWeZlJ1D7de21eO

Score
10/10
gh0stratpersistencerat

Malware Config

Signatures

  • Gh0st RAT payload 3 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat
  • Sets DLL path for service in the registry 2 TTPs 1 IoCs
    persistence
  • Loads dropped DLL 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\12ed17cd89808dbc6657075a1073a71a.exe
    "C:\Users\Admin\AppData\Local\Temp\12ed17cd89808dbc6657075a1073a71a.exe"
    1⤵
    • Sets DLL path for service in the registry
    • Drops file in Windows directory
    PID:4088
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4088 -ip 4088
    1⤵
      PID:788
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\SysWOW64\svchost.exe -k netsvcs
      1⤵
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:4284
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4284 -s 600
        2⤵
        • Program crash
        PID:1160
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4284 -ip 4284
      1⤵
        PID:896

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • \??\c:\windows\localuser\e58396akill.dll
        Filesize

        97KB

        MD5

        4a06cbca1b8c4738fa110e10101f8714

        SHA1

        3c684ff74beb5696802703d52a3dbfd879f7f06e

        SHA256

        7c3bf711e2622204a662a8a6dc12b8415a5b40065f2d7d7e697da1a93f632c86

        SHA512

        6122fbd4ba70966a45928589a434eec89f47ce657a159817c1ca367b9b85f190ab32e80a68bcad016206c1e359d7edc61ad7986d0cfc46d9e90ad1992d383962

        Download Submit

      • memory/4284-3-0x0000000010000000-0x000000001001A000-memory.dmp

        Filesize

        104KB

        Download

      • memory/4284-4-0x0000000010000000-0x000000001001A000-memory.dmp

        Filesize

        104KB

        Download