Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
- submitted
13/06/2024, 01:14
General
- Target 506c946ecc0877b13de8fb977de24a7b9e14054d44ca547e518084c914334a6b.exe
- Size 60KB
- Sample240613-bl45gasdnl
- SHA256 506c946ecc0877b13de8fb977de24a7b9e14054d44ca547e518084c914334a6b
Score
10/10
Malware Config
Signatures
- Gh0st RAT payload 3 IoCs
- Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
- Detects Windows executables referencing non-Windows User-Agents 3 IoCs
- UPX dump on OEP (original entry point) 4 IoCs
- UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\506c946ecc0877b13de8fb977de24a7b9e14054d44ca547e518084c914334a6b.exe"C:\Users\Admin\AppData\Local\Temp\506c946ecc0877b13de8fb977de24a7b9e14054d44ca547e518084c914334a6b.exe"1⤵
- Drops file in Program Files directory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
8.77.dll
8.77.dll
memory/5076-20-0x0000000010000000-0x000000001034B000-memory.dmp
memory/5076-17-0x0000000010000000-0x000000001034B000-memory.dmp
memory/5076-22-0x0000000010000000-0x000000001034B000-memory.dmp
memory/5076-21-0x0000000010000000-0x000000001034B000-memory.dmp