Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
30/12/2023, 16:58
General
-
Target
01ed18a077b02c571e110faa1d745ac6.exe
-
Size
383KB
-
MD5
01ed18a077b02c571e110faa1d745ac6
-
SHA1
c550ab3f75bbd18b385b84c8cbeaf60b2be294e9
-
SHA256
7dc5ca83aefa08fb9a75e566cb2af29e62ce7630589a8d2c85786b765d192c42
-
SHA512
12ab5d39aa7cd19cb25c42b7f0027fdc48d1e0509d89d2bf736a62c8324a070f9bb1f14a490d9993b4a6da0e989c5edd25715d6b5be5aed7c33b1120a1a52ebf
-
SSDEEP
6144:1MZSvkDbBjX4MF2idZecnl20lHRxp3gwncduD7yB9VCO6Sco4q8+dE6CqTQLyYg:WsvkD9jIsF3Z4mxxjDqVTVOCcLyYg
Malware Config
Signatures
-
Gh0st RAT payload 3 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Drops file in Drivers directory 2 IoCs
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
-
Deletes itself 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Drops file in System32 directory 1 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\01ed18a077b02c571e110faa1d745ac6.exe"C:\Users\Admin\AppData\Local\Temp\01ed18a077b02c571e110faa1d745ac6.exe"1⤵
- Drops file in Drivers directory
- Sets DLL path for service in the registry
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Drops file in Drivers directory
- Deletes itself
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD5c6e51fa9b6d2b395384a68be77cdaa5e
SHA18ae0b4d26c941880957c778541b3d07e722be7fa
SHA2560f757074c19baf9cf80c65697150981813983d154965c9e78fa0951bdedd9c5d
SHA5127f410da44df864467366a9ba66680b1147ebe93ec55e7fe2f6c90ee89d659f8bae6017c840f4518001a7f6c59eb900e1e7b7ee08ab23a128f28d53f43f2f0388
-
Filesize
70B
MD52a01885fd246b3d9a1882a0fff1a8094
SHA142f22c9f6cbc084af235af7fef431227c4a78064
SHA2562f5d67fdb3f18d52cf190ac2e40b47b197c0c88fdeb840ca8a1d0846a663b8ac
SHA5128ead54be32f63a0b3ddef64aa7a2abab6070fb6871ea3d92d46fd5cfa6f7c3464816b949e5e062faec644a34e9622823afb521fa53ceae88603d5f966c9646ab
-
Filesize
95KB
MD58a416eb17fc2c3e3f6e593cd2b8a0722
SHA1e36e61e0ecc7c0fdfb0cb863c248d8fd159a0f00
SHA25676900af9d55d26062de3903ed69f7fc0897fdc32ea0a87aece9e9f98f0f6edcd
SHA512aa27bede562ab4b361a3dd74de82d66d082312d3097834d92d7743d1b25c4261a1ba4e2b7359687694ed193ff0b426d4c9a8fc47f1ea21fd491d53c6e2e6a5d1
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
448KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
12KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
448KB
-
Filesize
336KB
-
Filesize
336KB