Analysis

  • max time kernel
    126s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    19-06-2024 19:46

General

  • Target

    2011529111153.exe

  • Size

    308KB

  • MD5

    7d86edf22313fa5d5eb1c54be6f6a324

  • SHA1

    8eeb4548895910fbc7075dda25361ce959c95bdf

  • SHA256

    e45adc891873e7f3de969313430c494ed6d1e07086208bf5a01094ffe9046c4f

  • SHA512

    64f88917cf394de7ee603f7acf00e9d6b0cafb7083a46669ad106a776a60443898a906a5a05c917a31fc24780f94149d2628a541a645ac8d4f094c67055de69c

  • SSDEEP

    6144:diTtiWB0wL7t4J5Vp34EnWC4G7v4G7AWFH:QXB0wd4rVN7WEJAU

Malware Config

Signatures

  • Gh0st RAT payload 1 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2011529111153.exe
    "C:\Users\Admin\AppData\Local\Temp\2011529111153.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2164

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Temp\zk.exe

    Filesize

    308KB

    MD5

    7d86edf22313fa5d5eb1c54be6f6a324

    SHA1

    8eeb4548895910fbc7075dda25361ce959c95bdf

    SHA256

    e45adc891873e7f3de969313430c494ed6d1e07086208bf5a01094ffe9046c4f

    SHA512

    64f88917cf394de7ee603f7acf00e9d6b0cafb7083a46669ad106a776a60443898a906a5a05c917a31fc24780f94149d2628a541a645ac8d4f094c67055de69c