Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
20-06-2024 09:43
General
-
Target
ba37370a4e2c69d6125e3cb76c4b120e06c26fa9a476b13013f1a033749ae120.exe
-
Size
400KB
-
MD5
36641ec28d549d2b71f5b016fae295db
-
SHA1
23262ebeb025cafd64c0c5a28c35f5f4d47a7816
-
SHA256
ba37370a4e2c69d6125e3cb76c4b120e06c26fa9a476b13013f1a033749ae120
-
SHA512
21f34e439d30fb7970a399f56f94d234f7e64b4c2ce56bf7c09968bbcdcd713586df2c11d9fdab2f7088d353461a7ec6e22593ed2cc9ee5f72e4f388b2e25eae
-
SSDEEP
3072:vRK/yLrQbWaR5Qax8c/Yt5Kgm45EWWdfnaZf4Xvl4luK:vIyLEbWaR5CchE6nmCzK
Score
10/10
Malware Config
Extracted
Family
gh0strat
C2
fdsfhkjf.e3.luyouxia.net
Signatures
-
Gh0st RAT payload 1 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba37370a4e2c69d6125e3cb76c4b120e06c26fa9a476b13013f1a033749ae120.exe"C:\Users\Admin\AppData\Local\Temp\ba37370a4e2c69d6125e3cb76c4b120e06c26fa9a476b13013f1a033749ae120.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
84KB