Overview

overview

10

Static

static

10

0.exe

windows10-1703-x64

10

0.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-07-2024 15:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0.exe

  • Size

    71KB

  • MD5

    2a9d0d06d292a4cbbe4a95da4650ed54

  • SHA1

    44c32dfae9ac971c3651adbd82c821971a5400dc

  • SHA256

    09a1c17ac55cde962b4f3bcd61140d752d86362296ee74736000a6a647c73d8c

  • SHA512

    ed15670a18bffa1c5c1d79f1a5a653d6b2bde649164c955473580321f4ab3d048124c26e1a92e9d8ba0edaf754617d2d2c13d8db92323e09957b6de225b5314d

  • SSDEEP

    1536:jWZpTtLcWyeYd4//yEZc1GJf7/QP4uirySj5e:+pZTvnyEZiGJ7/QguiryS5e

Score
10/10
gh0stratrat

Malware Config

Signatures

  • Gh0st RAT payload 2 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat
  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0.exe
    "C:\Users\Admin\AppData\Local\Temp\0.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:3044
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k imgsvc
    1⤵
    • Deletes itself
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    PID:416

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\2365500.dll
    Filesize

    64KB

    MD5

    45dc749351fd65d71da89ca2ed2766cb

    SHA1

    e080faf81157b7f867cb56938c5e579c206af9b9

    SHA256

    391109432ba2df9f3ebc74e0144f42a490405f7c8ecb51da01b4ce793be72f25

    SHA512

    7e63d8778a4656a19397849a6edb483993f1183257fb8c0793ad4b5c625ed69d1b9472969bac6dfc98938e19baed7e3e61ab80085a1a6edd8a50ca660ce3bf74

    Download Submit
  • \??\c:\NT_Path.jpg
    Filesize

    54B

    MD5

    cb06d6bf0137dc75f68e22e32f92efb4

    SHA1

    8562ffa93717ab3d84e8c6939b0a7cd194b3199d

    SHA256

    3213290f381753da022f946c53129b49f0e67068415333d967a2ccbb9044cd8b

    SHA512

    a74245008d9bacb1a5e601b1bb48b4710ac01801421ffd405cbde37fee023634051b4ca53a62d4402de160c7674cb16c757cedf4622cfc55d5fdd37048f74edb

    Download Submit
  • \??\c:\windows\filename.jpg
    Filesize

    11.2MB

    MD5

    9289add8630f8a4118c284f0e5b07e49

    SHA1

    2af3990147bed6901cf0713ce3ea3a8fc9afda4d

    SHA256

    2b4b7b1c0012a9000c2057e8f185dc65f12c3b587c380331e967cc63706c599d

    SHA512

    fc71e47814021d004775abb825e63f2d3aa983539dc1d144521018b8f871cb72cabfe746cfe54beff0d839e67b6fab9ea4174735c3dbcd77c2629ad2c89488e0

    Download Submit