Analysis
-
max time kernel
139s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
12/07/2024, 10:36
General
-
Target
38e4806fcf61db5a5ca5160459dc9c18b743d27c1959badd3ba6f81bd483d55c.exe
-
Size
2.8MB
-
MD5
cf0f62896eee805596cb36cb02849f29
-
SHA1
f00da0be65da98bff5ef24e13cefc9238c5233ca
-
SHA256
38e4806fcf61db5a5ca5160459dc9c18b743d27c1959badd3ba6f81bd483d55c
-
SHA512
f61b3fdda0c2161f14c6ae219368857bf25f5511d15fed58e85cf54e473c888a34c25df42bd2235ef85af9440f42552c1bf5ae63a0773bff7a3ebad9fc3c5dfc
-
SSDEEP
24576:ludyinxRL1c1AhDZzc7edlaozPQPxdIUoLvav8+QAr5+Rc4kTmapTSp7h89:SVXMbozU7KixSpm9
Score
10/10
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\38e4806fcf61db5a5ca5160459dc9c18b743d27c1959badd3ba6f81bd483d55c.exe"C:\Users\Admin\AppData\Local\Temp\38e4806fcf61db5a5ca5160459dc9c18b743d27c1959badd3ba6f81bd483d55c.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.7MB
-
Filesize
92KB
-
Filesize
3.7MB