Analysis
-
max time kernel
92s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
04/03/2025, 13:33
General
-
Target
CF天空VIP V7.8版 8.29 日破解版/天空vip.exe
-
Size
1.3MB
-
MD5
27f4e7a15d2a4624eb6f3adabd70e97d
-
SHA1
9c2eafe637e33fd260cee1d65f3d7a113256c7f6
-
SHA256
d49ab1f371ffc533a82826611c042a83458f49a82b3a57e35e5cea8b15aca98b
-
SHA512
3055a4293578b346fe3c83d161285b4f78cd13a586f0e91231cf0c09aa3b3e2563577733eddb6381ce126f0a5a0120e4bbd1eb8522bf3e8860d24ac65e29637c
-
SSDEEP
24576:3ZIJ8lG4o3PE+WGEky00Eyb/LOh7FTVLYyMrc7LcvOrZfJoM0FQm9NsWTVVRuxqL:9lG4ofRC00Eyja7jYmLvoM0z7uxSd
Malware Config
Signatures
-
Gh0st RAT payload 6 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Drops file in System32 directory 6 IoCs
-
UPX packed file 26 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 56 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\CF天空VIP V7.8版 8.29 日破解版\天空vip.exe"C:\Users\Admin\AppData\Local\Temp\CF天空VIP V7.8版 8.29 日破解版\天空vip.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\erpxyctmuh"C:\Users\Admin\AppData\Local\Temp\server.exe" a -sc:\users\admin\appdata\local\temp\server.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\天空vip.exe"C:\Users\Admin\AppData\Local\Temp\天空vip.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 408 -s 8402⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 408 -ip 4081⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 11002⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4688 -ip 46881⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4984 -s 7482⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4984 -ip 49841⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
196KB
MD56143117050965152ba482b72c75768fb
SHA1c13234982f9818b6679c56e24b13c181deee417b
SHA256da66601f0b0b62302f0f4b99df958ac417f6d271715afaebf8313154a8059175
SHA51252a8f542ab52725c4f3c6b014a36164691af9b5a95f72c4a35bcc91c90ebff825417a28a1a4015bcb684f3a79623e0bfaddf7ed9e4ba134c3f702aacaf17d51f
-
Filesize
2.1MB
MD5728080054e4108c4244e9d240c1bbc99
SHA18d60c0102a534695c58ab4e738bf24772c2d90ae
SHA256d3e00e23521c92e28b19d7c77a866eb531a45c03297dd275808a632117771b04
SHA51240f8823dce900383df2be43969ad161631d1a6ae7b57d7330453e743cfc9ff620fec718a992982ba9e070324e3a8fe3daa69e4f33a86d62feaa82c83cd193efd
-
Filesize
24.6MB
MD5b9ba4923626556b2352e318ba785663b
SHA1f08ab221c6e3fb6b1345af69b1d3c14bb2f90b8d
SHA2567b7fa76ef6b494d4facc5f028de16d87d6a244ec411f2bdeaa014c86f5883ae5
SHA51215fc5ddc3f2cfd965b22c8b8b86da018d7f2091b704a1a29d1c194f559bb3ea7498f01fbc96297638aa72fb21420eabdbc6fe0b1d23e91e911f06159cceadfe6
-
Filesize
202B
MD588e102f9ae26a9ba5c44fbada9d2ad7e
SHA158fa41ecb2bbafae1bc2a12282ef06e43dbd79ac
SHA2568fb5a7ebf59bc094cc3cb333076a9e83aa72c918f48fdf2dd9602eb3a9a89930
SHA5124e962dc0bb0331f00a9754b790f09b64b919e211acb72671db5f8bf48e46a3b085065a4e3f3d87b4d6c519335302897ec0c0a1cc1fe308e64437e584e71b037c
-
Filesize
303B
MD5817df372e6167ddaafd933c84aae31e2
SHA1b1a131b4cd36ccbcad3a1c90bbbd47c493d66c37
SHA256390f986b44dbfd1e73ae855739ce02995b1b8ef60d0875a70adf3db83e70701c
SHA5125d8085c5823bf1831abef7976f12b823dc0b74fe4908483dd404a3bf922c9992108a449bd21524fa334c7ec0f1cb2675ea4e0145a5124e081e052fedcf924e58
-
Filesize
19.1MB
MD5ddfe3287f9b35341e458e9c73e1a99b7
SHA1bf55b1f93225e404bba63f1a50c9f576d2251742
SHA2567c94f35e288665d61025bf9ae514e800ce0d5962151fae6a92674f7c0c6ee1a7
SHA5125dc5bc78f1e41e60afbde6f75866f806496aaabb83194fe1f68cd002b96f809df42e6ff10e52ab771ac936bdb145d6b5f9e1af2f9042f1ba240c015f3457e1b7
-
Filesize
156KB
-
Filesize
4KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
156KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
156KB