Overview

overview

10

Static

static

10

7a2480e2b9...ed.exe

windows7-x64

10

7a2480e2b9...ed.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    152s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-01-2024 11:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7a2480e2b9dda4bd4a8b63d633fd05ed.exe

  • Size

    196KB

  • MD5

    7a2480e2b9dda4bd4a8b63d633fd05ed

  • SHA1

    509ab04dcb2b3785bd9579dfd4380aa56c1a106d

  • SHA256

    31d3bdb8c4e66a3caae247c80082484398cc8bc21849fd7ee836cde6d8a19356

  • SHA512

    61855d9a0b5b42c7dda5ba03a6635308fbe108f7f61205e3c0ff30a51081c0cb17393562ef243d399ce21d07d53743ee421ec926d2254832e20b56076789ddb5

  • SSDEEP

    3072:n1Y8t7VChoFw4gbA/zftSF97RdPcurK77S3YcI:hChcYLRBNK77SU

Score
10/10
gh0stratrat

Malware Config

Signatures

  • Gh0st RAT payload 1 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7a2480e2b9dda4bd4a8b63d633fd05ed.exe
    "C:\Users\Admin\AppData\Local\Temp\7a2480e2b9dda4bd4a8b63d633fd05ed.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:4312
    • C:\Program Files\Internet Explorer\carss.exe
      "C:\Program Files\Internet Explorer\carss.exe" "C:\Program Files\Internet Explorer\FuckBaby.dll" rukou
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Internet Explorer\FuckBaby.dll
    Filesize

    20.1MB

    MD5

    f13adc6f94fcbc50db17ee90fdf610d8

    SHA1

    4fb33e21264a5711b5b0e1623087344388049db1

    SHA256

    89a35c8344b41ad75c9e1c4e8f7d86d78fac80e2c7aca0eb345a69dcf8326351

    SHA512

    47d08b0a3ef96069bd3416ad1af440afa10fc20d0da9cd5af859759ce73e5301d5d22914c01bc580fb5b909bde88d05b37eff78c1accf94d5bd4526894fbae1c

    Download Submit

  • C:\Program Files\Internet Explorer\carss.exe
    Filesize

    60KB

    MD5

    889b99c52a60dd49227c5e485a016679

    SHA1

    8fa889e456aa646a4d0a4349977430ce5fa5e2d7

    SHA256

    6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910

    SHA512

    08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641

    Download Submit