Ghost Temp[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Ghost Temp.exe
Size 2.3MB
Sample260926-we15fsff52
SHA256 bc11649afa0295cdb87080a634f7c2e235ce1d0bc495873151e6a02c4580adaa
MD5 32e113d5f4ec5de5d99a41e393798922
SHA1 23686795d4c6547b01b08305ad4e744fa4021552
SHA512 cd8bbcf8986b3c0394803057d60d41645bfcdf91c0f878ec09500e53eb9e799e95898950d11ca6bf2eb98e735b78c83808261c92d89dee54e164f7dd57314d38
SSDEEP 49152:gzs+qdwsOH2VWRnjFfJuGBsuf9iP1VRs+Ea0ErvNnPZgmJaEPi3:3LInjFfJuGBsuf9i9VOBa5Z1aEO
TLSH
T115B5BE4BB3A501EDC267D278C616970BE7B17419132097DF23D08AA62F53AE16FFA311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Ghost Temp.exe

File Explorer

Ghost Temp.exe

.exe 2.3MB

Ghost Temp.exe

IMPHASH 0e4574cad9c8f95803b9e4fcc238d134
SHA256 bc11649afa0295cdb87080a634f7c2e235ce1d0bc495873151e6a02c4580adaa
MD5 32e113d5f4ec5de5d99a41e393798922
SHA1 23686795d4c6547b01b08305ad4e744fa4021552
SHA512 cd8bbcf8986b3c0394803057d60d41645bfcdf91c0f878ec09500e53eb9e799e95898950d11ca6bf2eb98e735b78c83808261c92d89dee54e164f7dd57314d38
SSDEEP 49152:gzs+qdwsOH2VWRnjFfJuGBsuf9iP1VRs+Ea0ErvNnPZgmJaEPi3:3LInjFfJuGBsuf9i9VOBa5Z1aEO
TLSH
T115B5BE4BB3A501EDC267D278C616970BE7B17419132097DF23D08AA62F53AE16FFA311
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

984572

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\fivem\Desktop\cleaner\SpooferUI(1)\SpooferUI(1)\x64\Release\Dominate.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

advapi32

CryptImportKey OpenProcessToken AddAccessAllowedAce GetLengthSid RegOpenKeyExA RegQueryValueExA RegCloseKey GetTokenInformation InitializeAcl IsValidSid RegCreateKeyExA RegDeleteKeyA SetSecurityInfo CopySid ConvertSidToStringSidA CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptEncrypt CryptDestroyHash SystemFunction036 CryptDestroyKey

kernel32

SetFileInformationByHandle GetConsoleWindow GetModuleHandleW GetModuleFileNameW GetLastError CreateFileW SetLastError GetCurrentProcessId GetCurrentThreadId GlobalMemoryStatusEx GetDiskFreeSpaceExW CreateDirectoryA LocalFree CloseHandle Sleep WaitForSingleObject GetFileAttributesExW FindFirstFileW FindClose AddVectoredExceptionHandler HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection GetCurrentProcess CreateThread GetFileInformationByHandleEx VirtualProtect CreateFileMappingW MapViewOfFile UnmapViewOfFile GetModuleFileNameA QueryFullProcessImageNameW FormatMessageW WakeAllConditionVariable ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetSystemDirectoryW LoadLibraryW SleepEx GetSystemInfo GetTickCount MoveFileExW WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetFileType SetUnhandledExceptionFilter ReadFile PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW GetFileSizeEx FormatMessageA GetLocaleInfoEx GetSystemTimeAsFileTime QueryPerformanceCounter FreeLibrary VerSetConditionMask GetProcAddress QueryPerformanceFrequency LoadLibraryA GetModuleHandleA GlobalUnlock WideCharToMultiByte InitializeSListHead IsDebuggerPresent OutputDebugStringW SleepConditionVariableSRW GetCurrentDirectoryW CreateDirectoryW GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar AreFileApisANSI CreateFile2

user32

GetForegroundWindow SetCursor ClientToScreen LoadCursorW GetCapture TrackMouseEvent MessageBoxA GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData SetCapture ScreenToClient GetWindowLongW GetKeyState DestroyWindow CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW DispatchMessageW SetWindowLongA PeekMessageW SetLayeredWindowAttributes TranslateMessage PostQuitMessage UpdateWindow EnumDisplayDevicesW GetWindowRect GetActiveWindow ShowWindow MoveWindow DefWindowProcW

shell32

ShellExecuteA ShellExecuteExW

ole32

CoUninitialize CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoCreateInstance

oleaut32

VariantClear SysAllocString SysFreeString

msvcp140

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??7ios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ _Query_perf_frequency _Query_perf_counter ?_Xinvalid_argument@std@@YAXPEBD@Z _Xtime_get_ticks ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?_Random_device@std@@YAIXZ ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?id@?$ctype@D@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ??Bios_base@std@@QEBA_NXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?uncaught_exceptions@std@@YAHXZ ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Xlength_error@std@@YAXPEBD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z _Thrd_detach _Cnd_do_broadcast_at_thread_exit ?_Throw_Cpp_error@std@@YAXH@Z ?_Xbad_function_call@std@@YAXXZ ?good@ios_base@std@@QEBA_NXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z

iphlpapi

GetAdaptersInfo

imm32

ImmSetCompositionWindow ImmGetContext ImmReleaseContext ImmSetCandidateWindow

dwmapi

DwmExtendFrameIntoClientArea

urlmon

URLDownloadToFileA

psapi

GetModuleInformation

shlwapi

PathFindFileNameW

userenv

UnloadUserProfile

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy __std_exception_copy __std_terminate strstr strchr _CxxThrowException memchr memcmp memcpy memmove memset strrchr wcschr __C_specific_handler __current_exception __current_exception_context longjmp __intrinsic_setjmp

api-ms-win-crt-heap-l1-1-0

calloc free realloc _callnewh _set_new_mode malloc

api-ms-win-crt-string-l1-1-0

tolower strcpy_s _wcsdup strcspn wcslen wcspbrk strspn strcmp wcsncmp strpbrk wcsncpy strncmp strncpy _strdup strlen isalnum

api-ms-win-crt-stdio-l1-1-0

_get_stream_buffer_pointers ungetc fgets setvbuf fgetpos _pclose fsetpos fgetc fputs fputc feof _wopen _lseeki64 _popen fopen _close _fileno _write _read __p__commode __stdio_common_vsscanf fread _set_fmode __stdio_common_vsprintf _fseeki64 fwrite __stdio_common_vfprintf fseek fclose fflush __acrt_iob_func ftell _wfopen

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-convert-l1-1-0

atoi strtoul wcstombs strtoull strtoll strtol strtod

api-ms-win-crt-runtime-l1-1-0

_exit system __p___argv exit _resetstkoflw _invalid_parameter_noinfo abort _configure_narrow_argv _initterm_e __sys_nerr __sys_errlist _beginthreadex _initialize_onexit_table _register_onexit_function _crt_atexit terminate _initterm _get_initial_narrow_environment _c_exit _set_app_type _seh_filter_exe _register_thread_local_exe_atexit_callback _errno _invalid_parameter_noinfo_noreturn _initialize_narrow_environment __p___argc _cexit

api-ms-win-crt-filesystem-l1-1-0

_lock_file _fstat64 _wstat64 _unlock_file _unlink

api-ms-win-crt-time-l1-1-0

_time64 _gmtime64 strftime _localtime64

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-math-l1-1-0

acosf _dsign __setusermatherr roundf powf ceilf fmodf _fdopen sinf cosf sqrtf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv ___lc_codepage_func

ws2_32

inet_pton WSAGetLastError WSASetLastError closesocket WSAWaitForMultipleEvents WSAResetEvent ntohs WSAEventSelect gethostname ioctlsocket sendto recvfrom freeaddrinfo WSAEnumNetworkEvents getaddrinfo listen htonl accept socket select __WSAFDIsSet WSAIoctl WSACreateEvent setsockopt recv htons getsockname getpeername connect bind WSACleanup WSAStartup getsockopt send WSACloseEvent inet_ntop

crypt32

CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore