Overview

overview

10

Static

static

3

76b650cc5d...55.exe

windows7-x64

10

76b650cc5d...55.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    138s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-01-2024 07:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    76b650cc5d733e7ebf56a20919a75455.exe

  • Size

    71KB

  • MD5

    76b650cc5d733e7ebf56a20919a75455

  • SHA1

    d02f35d6279d1ca925a6f657f8988bbfd03299e7

  • SHA256

    74ef28257e35a8cc6f26dec34d384f934aad8e0b78813f655303aa32cb1e000c

  • SHA512

    35bc9298b38e72de804c170b1ed17a7361f0e4342188e85dc38a9b18cac4d6100071425ab59db4a832e68484345c0bfca63b86fb3a379aa8eb280bcb87b03c0b

  • SSDEEP

    1536:FkrQ2Ue72ey9PNXiitylpsvJ95qnCC/D6D07t2YeHJvM:FiQRZP9PNSityQvBIvdt2THFM

Score
10/10
gh0stratrat

Malware Config

Signatures

  • Gh0st RAT payload 1 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat
  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\76b650cc5d733e7ebf56a20919a75455.exe
    "C:\Users\Admin\AppData\Local\Temp\76b650cc5d733e7ebf56a20919a75455.exe"
    1⤵
      PID:2104
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 284
        2⤵
        • Program crash
        PID:4660
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2104 -ip 2104
      1⤵
        PID:4824

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2104-0-0x0000000000400000-0x0000000000438000-memory.dmp

        Filesize

        224KB

        Download