Analysis
-
max time kernel
121s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
02/01/2024, 15:53
General
-
Target
7dd3c0d07e21e6ac695b2182f86c2535.exe
-
Size
382KB
-
MD5
7dd3c0d07e21e6ac695b2182f86c2535
-
SHA1
0cb17b579628c702dba83a76dd5b5d812bfa1836
-
SHA256
9d78d909a86ef314f05f3f86a4f7d77aea84e27e2d46fbce239d43e40c727c7d
-
SHA512
b39bd01bbae9722e0c096c1494fa191c2a36afc6dcfacc68bc342b30d4c40b6248d4b0c018c3054494c61f38a18097b4d2f325500a30396873d0c82287c1b20e
-
SSDEEP
6144:/V8HFsnY+jjpVCSqmVZ6XnniYvBZq2kXXl6BbFxueTwkkBn4aUJFBie9/28NNjaP:/VVY+jlddZSn5u2phxJtD8e9/20pMFJ
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Drops file in Drivers directory 2 IoCs
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
-
Deletes itself 1 IoCs
-
Loads dropped DLL 2 IoCs
-
VMProtect packed file 1 IoCs
Detects executables packed with VMProtect commercial packer.
-
Drops file in System32 directory 1 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7dd3c0d07e21e6ac695b2182f86c2535.exe"C:\Users\Admin\AppData\Local\Temp\7dd3c0d07e21e6ac695b2182f86c2535.exe"1⤵
- Drops file in Drivers directory
- Sets DLL path for service in the registry
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Drops file in Drivers directory
- Deletes itself
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70B
MD5a9b26c5a397d13c1d92228764afe8ae7
SHA1907c599e10d7dd110976e98a68af4a617943a810
SHA256f206e67ac262395f4db24e77f7e51d6005120c491812f6852817b612a8cb864a
SHA51203966627b24fd59d2c8927b0f569497cd555debd7e96f55622e37849b7bd0c9f20828665e9271358e64a8643595f3cef6e57e0c045bfb5e309fb12653e37172d
-
Filesize
102KB
MD5027b6e5cc391b245943b8e0002abe13c
SHA1d2356bb8c711b179956dd92cfba03010f9634220
SHA2567e933577728f38d7c9ce3cb4fc975026fa39356896943f0f40f9a9bfe6a377d5
SHA51296f47ae239dfc875149ebbf1e6e3471750ad6d423863170e0d834426cc3f1b3480cf555ada762773f63afaaed8b712d9622e2d77c331ac206467444cab50d6e0
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
336KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
8KB
-
Filesize
256KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
848KB
-
Filesize
4KB
-
Filesize
256KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
336KB
-
Filesize
848KB
-
Filesize
4KB