Analysis
-
max time kernel
106s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20250313-en -
resource tags
-
submitted
30/03/2025, 16:01
General
-
Target
lsass.exe
-
Size
125KB
-
MD5
1afb1f75153d736af51789988f9e83aa
-
SHA1
fabc13289ddce2ed0a851149feb1b7511c986b4c
-
SHA256
c52884d63cadf9dc9a8ff4b66a7bcdd426e5bbcecc0873c4f28488bba3428c2d
-
SHA512
bd9aa0ff6d64e35f56e6e9377f2812c4586b257a7582753abad25d99b24d6d77d4fbd36c7366a110fbbaa674326b3131b87914e7179fe2d9d64915b99b1d403f
-
SSDEEP
3072:RQhZkOLfuDg0PtOqzKONqsEykRLSDYpFweWt6HY:xOFStZzKqqsE6a/4
Score
10/10
Malware Config
Signatures
-
Gh0st RAT payload 4 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\lsass.exe"C:\Users\Admin\AppData\Local\Temp\lsass.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 6082⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3228 -ip 32281⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
236KB