Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
01/03/2025, 07:19
General
-
Target
莫贝1.27A/莫贝1.27A.exe
-
Size
2.8MB
-
MD5
aa33abc410abcd33b5410cd6150cb3f0
-
SHA1
9d5378a5b7b84aa7fbde1268bb64ed1bbade4541
-
SHA256
db0c042f2cee58f542f92d09a9fbd0faf9bd15aaa1f597056c02210dc042c3e6
-
SHA512
423c29a604479856a408ae5c1c2e028e1c9b977ba72f4e50dc77bd4acf6f172134b740d10054d162b0daddd7fa9838ae7c817f9b822e961ad5ffbca3226e44b0
-
SSDEEP
24576:8q64aDApD1mzPSKkV2FsPPg9VXB0yzGNx212qEIyI+gfUgVrRhqoSp6YeVR5BGb7:8YpDQSwF/9hYcsRvJgfpVXvQRBlydw/
Malware Config
Signatures
-
Gh0st RAT payload 14 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
UPX packed file 25 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: LoadsDriver 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\莫贝1.27A\莫贝1.27A.exe"C:\Users\Admin\AppData\Local\Temp\莫贝1.27A\莫贝1.27A.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\crass.exeC:\Windows\system32\\crass.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
584KB
MD519b547d281bfa52fe62827ebfc05cf87
SHA137d68f1cb4b888a0a11edb027c5e96b95f1b0816
SHA256e94ab3ef7693bb023305f6e3a9cf9554948f9d3236aff68e8e1e2d0d7051f084
SHA51272d440d178b5c74f7756a90887e2a20bd6dca4b0b274fc0375cdc03203dc51ad26c13564fbd554518a4cd244f048529cf3745be0bc473ac8e85cf59abc67e1a6
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
4KB
-
Filesize
248KB
-
Filesize
2.8MB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
2.8MB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB