Analysis
-
max time kernel
74s -
max time network
177s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
04/01/2024, 20:07
Static task
static1
Behavioral task
behavioral1
Sample
360rsp.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral2
Sample
360rsp.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
456Login.dll
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral4
Sample
456Login.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
MachineGUID.dll
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral6
Sample
MachineGUID.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
General
-
Target
360rsp.exe
-
Size
562KB
-
MD5
fe7279ede3a7dcb7184105e6ebad8462
-
SHA1
7bb5420426828b1fb5c39655dd2970a5eefbd47e
-
SHA256
6c36e20b91ea36d03c7ac4cbddce7d045470757f21da2e340abb6510c4ba6b87
-
SHA512
1853792e5f40e92e36094b02d1a05e767c20923b19f0b85ced2f70e23c695b8d3273fa150004e659f9c721919110b82d3e19331d8f309e482ea3f927277d4109
-
SSDEEP
12288:3opCiRmtWBygSpspt7t0Ms9tmc5xW0UG24ip0hfHvpeWVRQWocoooooYoooooooh:l7q22h0MstmWxZUG24ip+vpeWVRnocoV
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/memory/1904-1-0x0000000010000000-0x0000000010020000-memory.dmp family_gh0strat -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe 1904 360rsp.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1904 360rsp.exe