Analysis

  • max time kernel
    64s
  • max time network
    65s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-09-2024 03:42

General

  • Target

    Ghost Stealer/Ghost.builder.exe.xml

  • Size

    163B

  • MD5

    dccd44fb11b8e4ebdfb822e809a54b6f

  • SHA1

    1889d5ae8c7c70c051cbde104af6e0f31f8c1b63

  • SHA256

    6862b25736259f7bfd344e43eea10a703885be381eee2a745ceb12916b01a158

  • SHA512

    dadffe41bdadfc3a79cb34369c9a8b37ce4833aee18058b02dcb13d64007f022b80b63ab404572c60278937cf83b06b00712ff9ee302e725b9d5c7fe14bd5f50

Score
1/10

Malware Config

Signatures

Processes

  • C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
    "C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Ghost Stealer\Ghost.builder.exe.xml"
    1⤵
      PID:1668

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1668-0-0x00007FF88BF30000-0x00007FF88BF40000-memory.dmp

      Filesize

      64KB

    • memory/1668-1-0x00007FF8CBF4D000-0x00007FF8CBF4E000-memory.dmp

      Filesize

      4KB

    • memory/1668-2-0x00007FF8CBEB0000-0x00007FF8CC0A5000-memory.dmp

      Filesize

      2.0MB

    • memory/1668-3-0x00007FF8CBEB0000-0x00007FF8CC0A5000-memory.dmp

      Filesize

      2.0MB

    • memory/1668-4-0x00007FF8CBEB0000-0x00007FF8CC0A5000-memory.dmp

      Filesize

      2.0MB