Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
31/12/2024, 18:56
General
-
Target
7cf5b831c7e8b7612a1e6b1441ddc11ba0e900c9acfe56953874ceaa2d1fb838.exe
-
Size
12.2MB
-
MD5
313c6125ce2f610bdb867a161addcc81
-
SHA1
02185bfecc7f19658823978ff8d6083531c09bbd
-
SHA256
7cf5b831c7e8b7612a1e6b1441ddc11ba0e900c9acfe56953874ceaa2d1fb838
-
SHA512
52dd26576d45f48de92f37e87aa692cd26a1824fe17e554acdaf673914cbbaf6429bf38ef53fb2340c8d9afa4fc5ab4be8d84c2fc8006f58a1f6baff348dae43
-
SSDEEP
196608:MrvzibXtSA2UFrJ3Miv+364Hosu0VWY7g50N9TieHTwIHknYDToB5TICfWAyDjMJ:MKBSADJ63/cY7X2nboEfWARYQ
Malware Config
Signatures
-
Gh0st RAT payload 5 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 3 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 39 IoCs
-
UPX packed file 34 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7cf5b831c7e8b7612a1e6b1441ddc11ba0e900c9acfe56953874ceaa2d1fb838.exe"C:\Users\Admin\AppData\Local\Temp\7cf5b831c7e8b7612a1e6b1441ddc11ba0e900c9acfe56953874ceaa2d1fb838.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ÉϺÅÆ÷12.28.exeC:\Users\Admin\AppData\Local\Temp\ÉϺÅÆ÷12.28.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\QQ.exeC:\Users\Admin\AppData\Local\Temp\QQ.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11.9MB
MD511b503094eb69c8a8285f6ed28af8ef1
SHA1594e3c2d536bdcb5b936fe9494caf2893dbe9d07
SHA256908fd02a45d2fa8da35010a998e3b77262a4b9ca8659df86344d414f3c66b040
SHA512d4568977eb7f4c46118f99061dd8f9b43038d544895f36774988e09a5d9bfbafb3ff5a0e67728e6cea9c12e47928eff3143521f423eccbecd753e42acf188769
-
Filesize
1.0MB
MD5da35f17e36bc4941d092f3e64104462b
SHA15c9e07329c96503382dc4247d5973e0c99080c58
SHA25635a73589540316d2ccb4f637e5db2c13ee8c092432b2bf62a49527477ef2c949
SHA51248f1d11f77260533432d58f33c701969524d7bb04b552830a8f8481eacf542202399bc2fe5dd8bc1a0354053114f8df7f7fc43c9a98260f176b5e8da9b7f0d60
-
Filesize
10.4MB
MD5752c8b7cdb212b24297ead70c84254da
SHA19de73123d26012e0ea9c94cb80418f52285e8ca2
SHA2568001894be26eeb74852b6be647114294323d6ef737e4ec8458785b1f0f8636b6
SHA51203c4f348d5df80cff02f4ac54b67c502c446286de25ee9c283fbf4908d596ddd14942834259666f50193c1fa68bd68fd1617be9d8eca69dbb403b1d1feb347de
-
Filesize
2.8MB
MD54bc970a97300b1a725d44bba23d8697a
SHA16f1eb181153692814e038e2f851d0734646f78f8
SHA256c9d8fb5311ae6018dc1ca72774cb7efeba5c115c827a5cfb795b3580499e323d
SHA51203968ca876b7e584de0a1418cca1dd2036fd0b4744f86d69aee5691a42061e284f8d9577293ef3f656be332f7da5ca276f85c6393bd6d8eb7de181baec0285f8
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
356KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
12.3MB
-
Filesize
4KB
-
Filesize
12.3MB
-
Filesize
12.3MB
-
Filesize
3.9MB
-
Filesize
12.3MB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
12KB
-
Filesize
248KB
-
Filesize
20.1MB
-
Filesize
20.1MB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
12KB
-
Filesize
12.3MB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
1.0MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.0MB
-
Filesize
1.6MB
-
Filesize
1.0MB
-
Filesize
488KB
-
Filesize
2.1MB
-
Filesize
1.0MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB