Analysis
-
max time kernel
120s -
max time network
70s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
03-09-2024 18:48
General
-
Target
cd30f88e89ee85373e600a49135e33d0N.exe
-
Size
57KB
-
MD5
cd30f88e89ee85373e600a49135e33d0
-
SHA1
7ac7ecac09dea116f3ba2d5ca5e5fabc4753459a
-
SHA256
7da5ecbfb0b28ce880472cce4e181034aab91f33bd640fdde00d386ec196aafb
-
SHA512
6ad92b86a4c98647c2fb463cefd74b57f93dca6b2535824a849163cc05b62e69706a48c05ba0217a34cf3fec84c9197f90c81fe5033cd28a3d8b49b633856627
-
SSDEEP
1536:Jqcc9KoCN2F/NDieophAtVuG7mcof/qIIZMdeRSSJAE:Js9K32JNDielVxmq4dSJAE
Malware Config
Signatures
-
Gh0st RAT payload 7 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
-
Deletes itself 1 IoCs
-
Loads dropped DLL 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd30f88e89ee85373e600a49135e33d0N.exe"C:\Users\Admin\AppData\Local\Temp\cd30f88e89ee85373e600a49135e33d0N.exe"1⤵
- Server Software Component: Terminal Services DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5ae43537fb56aa55f8ef101ffc85c40e0
SHA17326f8249cf217bcbe33f7ae236104483e9fe8f8
SHA25657611122e23fc64d77dc36cc84aebb004d95ba85ccf1313038141628d662fd2d
SHA512417ba92349ee7011f45c034acf6fe7c3935d94e4fb4267252608274fc9e9989d22d06a13bdd4ddb8b8a6f37966ce1c98606886ab047864244a269029f810fbc8
-
Filesize
188KB
-
Filesize
112KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
112KB
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
108KB