Analysis
-
max time kernel
150s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
12/03/2024, 06:17
General
-
Target
c2a865802a96f54dc8eed392bb3d6553.exe
-
Size
668KB
-
MD5
c2a865802a96f54dc8eed392bb3d6553
-
SHA1
91ce2347f463f859c15197dbeb5397fd3b698301
-
SHA256
c5b1662a3a2375fd65f40d8494f57b3f35382ee43ee61937e52d5acb4b3094c2
-
SHA512
1c18786e74156b9049827beceac805f761df9035aed1ec01803f927fcc63debbfe4362563db79ee086ee739229e5686c0a944125322b184ed62cd788db0e444a
-
SSDEEP
12288:wejttGEcXBQrfVugH89lSikEPG5AFhdIQZbpUwR:wejt0WfHmlhYcfVj
Malware Config
Signatures
-
Gh0st RAT payload 7 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Loads dropped DLL 1 IoCs
-
Drops file in System32 directory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2a865802a96f54dc8eed392bb3d6553.exe"C:\Users\Admin\AppData\Local\Temp\c2a865802a96f54dc8eed392bb3d6553.exe"1⤵
- Sets DLL path for service in the registry
- Checks BIOS information in registry
- Drops file in System32 directory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152KB
MD5f0acba287b25647e60ade09c5b260f7b
SHA16cc61ff9013b8bc717fea6f79f80aa0dc9b1b6e3
SHA256296263bd6670fd2ab78a4abcdcd020987fc6d0eae47d410125fbc572dd861a3b
SHA5125ffbe0663b5cb05ee55cb0ef9180409acf9899d42aa2bd6c2d461564ea9d73018a856a9cd38979a4b6c6f2dcef75e6569139ca19a3c54024aa7286e76bf9eaa2
-
Filesize
812KB
-
Filesize
812KB
-
Filesize
812KB
-
Filesize
812KB
-
Filesize
812KB
-
Filesize
812KB
-
Filesize
812KB
-
Filesize
812KB