Analysis

  • max time kernel
    133s
  • max time network
    103s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-05-2024 21:29

General

  • Target

    59fd7df4625ce3480e806144a007080f.exe

  • Size

    576KB

  • MD5

    59fd7df4625ce3480e806144a007080f

  • SHA1

    e16d898d304af9c9fae5ca78e3241ddd9fee8dc9

  • SHA256

    a6b9710a78f50e1083d7e4c543c477fd6331c7ca47a50c71a182160e5741c1b6

  • SHA512

    e83abeb86c62ad8408953955e970695a48fb257a1d9ffaf7a612e1704e2e02c5b2744691be4601edb575006ac3a99cdd2bc7829de1413c0d0c65c1efc1d44748

  • SSDEEP

    12288:HruM9FNatyT3gNCpOdn/uYcZNJ7QD7HZ5rbx:K+atynpOd/ozJO7HX

Malware Config

Signatures

  • Gh0st RAT payload 3 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\59fd7df4625ce3480e806144a007080f.exe
    "C:\Users\Admin\AppData\Local\Temp\59fd7df4625ce3480e806144a007080f.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    PID:208

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/208-1-0x0000000010000000-0x0000000010121000-memory.dmp

    Filesize

    1.1MB

  • memory/208-8-0x0000000010000000-0x0000000010121000-memory.dmp

    Filesize

    1.1MB

  • memory/208-9-0x0000000000730000-0x0000000000731000-memory.dmp

    Filesize

    4KB

  • memory/208-2-0x0000000010000000-0x0000000010121000-memory.dmp

    Filesize

    1.1MB

  • memory/208-3-0x0000000010000000-0x0000000010121000-memory.dmp

    Filesize

    1.1MB

  • memory/208-13-0x0000000000730000-0x0000000000731000-memory.dmp

    Filesize

    4KB