Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
26-05-2024 11:42
General
-
Target
d61fea7347d18ea1460d17f8b90cb089ea9982f25e3625872574fca8e8f72d6b.exe
-
Size
1.2MB
-
MD5
037b5afc971b59a356bfe076734b165b
-
SHA1
aed4684d046c5fb1687003798ada37618448268c
-
SHA256
d61fea7347d18ea1460d17f8b90cb089ea9982f25e3625872574fca8e8f72d6b
-
SHA512
6d35f17d0ff1a5522cc4a1c44c302c1bd1b05e0c554a57524fdbd0d097b1eb49b605e125610331034b940e5347f6b6ff378c1dff4f48db96ddfa1910f10b8f52
-
SSDEEP
24576:iTOgQM/++dshTB9/EkgPY1qOeb+SBpaO5F+pfTZJpqPT/qL:iBYd9/jmnJqO5FeDQPG
Score
10/10
Malware Config
Extracted
Family
gh0strat
C2
43.248.139.181
Signatures
-
Gh0st RAT payload 2 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
VMProtect packed file 2 IoCs
Detects executables packed with VMProtect commercial packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d61fea7347d18ea1460d17f8b90cb089ea9982f25e3625872574fca8e8f72d6b.exe"C:\Users\Admin\AppData\Local\Temp\d61fea7347d18ea1460d17f8b90cb089ea9982f25e3625872574fca8e8f72d6b.exe"1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
-
Filesize
84KB
-
Filesize
1.2MB