Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
24/02/2024, 18:08
General
-
Target
a26946c4c2e79e6dd2a9f5a45aeb5b09.exe
-
Size
373KB
-
MD5
a26946c4c2e79e6dd2a9f5a45aeb5b09
-
SHA1
f2908cc96376f297830811dfab97f368208db147
-
SHA256
a6c1bbc89bf46147c105da7c6a14176b14dde2601806e546e7ad5ba50c1e591e
-
SHA512
570bb67dce7f6c119df077499e4d9ac271fe0d9944d6140ea14959beb9c579e8e87024909526934f4bc49b17bd33f3e78e82e765e3f56ad2d37934d2735dada6
-
SSDEEP
6144:c86q1WqF2idZecnl20lHRxp3gwAlZDIvybq1LeCKk+P2QhymIkHZCghjAlLO:0KWmF3Z4mxxQfUv33h9Qv4ssZO
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Drops file in Drivers directory 2 IoCs
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
-
Deletes itself 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Drops file in System32 directory 1 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a26946c4c2e79e6dd2a9f5a45aeb5b09.exe"C:\Users\Admin\AppData\Local\Temp\a26946c4c2e79e6dd2a9f5a45aeb5b09.exe"1⤵
- Drops file in Drivers directory
- Sets DLL path for service in the registry
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Drops file in Drivers directory
- Deletes itself
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70B
MD57f2a780b100be0d3936c6b076400fafe
SHA1b5f7ae35983f3108b6669aac90c6e2bdf2f86c6d
SHA256158abf1af3f81fdbcb2da9f491b699f3624ade28bd1060596c2b9b8a3173a349
SHA512f23bbd3faec69f0641b05636c40572cf3d50e81e1a68dbfeb03b0b711552f983f38d948ab10f0dfe6faf956aa9d6abc6e3412780fc3a37903589989e985f2abb
-
Filesize
95KB
MD587fe2f0db52e85193d56c8f588dca678
SHA1bc3c502b4051b6ef93a13dc362d32bd95852cac6
SHA256323ad9d88f521b2499cb77d283721b8328294428d3195c91476e422b14f5ff13
SHA512fd5242c261caa930ef54a222fa2b81ba9ec7ee2147abf7936842431938307f5cc1f713ece8ba529c1272580d8dc77cc5ddbca0eb75d77a0555409510f2788416
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
444KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
4KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
4KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
444KB
-
Filesize
336KB
-
Filesize
336KB