Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29-05-2024 02:22
Behavioral task
behavioral1
Sample
Ghast.exe
Resource
win7-20240221-en
General
-
Target
Ghast.exe
-
Size
6.9MB
-
MD5
0b0675af80bc7794b0f397ad022d4f3b
-
SHA1
93c517c02e225c3ffa4383e5882264f63487a606
-
SHA256
85ab8cab94764bf52b17cbc0331098c6c55376e67dd5d444902b6e94d04a07ce
-
SHA512
1502ef4393f766688bf7eaa08620cb23f95f08cff9fffe6f8a944610aa99f28c440e7e3f0c58929e50911004116bf6143708300cef39712cdec95cd8738e9b76
-
SSDEEP
98304:ZrwSDjWM8JEE1ruamaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRGYKJJcGhEIX:ZrwS0HeNTfm/pf+xk4dWRGtrbWOjgWyk
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
Ghast.exepid process 2940 Ghast.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI22242\python311.dll upx behavioral1/memory/2940-23-0x000007FEF54C0000-0x000007FEF5AA8000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Ghast.exedescription pid process target process PID 2224 wrote to memory of 2940 2224 Ghast.exe Ghast.exe PID 2224 wrote to memory of 2940 2224 Ghast.exe Ghast.exe PID 2224 wrote to memory of 2940 2224 Ghast.exe Ghast.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD5bb46b85029b543b70276ad8e4c238799
SHA1123bdcd9eebcac1ec0fd2764a37e5e5476bb0c1c
SHA25672c24e1db1ba4df791720a93ca9502d77c3738eebf8b9092a5d82aa8d80121d0
SHA5125e993617509c1cf434938d6a467eb0494e04580ad242535a04937f7c174d429da70a6e71792fc3de69e103ffc5d9de51d29001a4df528cfffefdaa2cef4eaf31