gh0strat | a9d600219f781741acc330a123e102aff9570b30a3a9ce355687e299bff4e3cd

Analysis

max time kernel
153s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 01:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9d600219f781741acc330a123e102aff9570b30a3a9ce355687e299bff4e3cd.exe
Size

76KB
MD5

625a18ad5cc6c899205a15c09b2efc37
SHA1

0fa112d6eb2eaabf7ed9f5ff3c665f491860369f
SHA256

a9d600219f781741acc330a123e102aff9570b30a3a9ce355687e299bff4e3cd
SHA512

95c83500fb3d2ddcdb00b6bcd7c47677368ec67669e4d54bba7e682833d9293c84d7247d0402b1ea5077fa1a99123a03ec04f4337096c5f2b36b96f5d9daa0ce
SSDEEP

1536:gX3HgJ+kgZj2N6WcPSQf3LeXFUHQqMuuQO:gX3H6vgZj2N6WsSq3LsFUHQTQO

Score

10^/10

gh0strat rat

Malware Config

Signatures

Gh0st RAT payload 3 IoCs

resource	yara_rule
behavioral2/files/0x0002000000022dd5-135.dat	family_gh0strat
behavioral2/files/0x0002000000022dd5-141.dat	family_gh0strat
behavioral2/files/0x0002000000022dd5-140.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Executes dropped EXE 3 IoCs

pid	Process
3780	iexplcrer.exe
4980	iexplcrer.exe
656	iexplcrer.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	a9d600219f781741acc330a123e102aff9570b30a3a9ce355687e299bff4e3cd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 34 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	iexplcrer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host	WScript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	scrcons.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81E9010-6EA4-11CE-A7FF-00AA003CA9F6} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 010000000000000063c14c6dc9cbd801	scrcons.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	scrcons.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	iexplcrer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WScript.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2BF9676-5F8F-435C-97EB-11607A5BEDF7} {A08CE4D0-FA25-44AB-B57C-C7B1C323E0B9} 0xFFFF = 01000000000000001e83516dc9cbd801	scrcons.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\SlowContextMenuEntries = 6024b221ea3a6910a2dc08002b30309dac0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	scrcons.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	scrcons.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\JITDebug = "0"	scrcons.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	scrcons.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{35786D3C-B075-49B9-88DD-029876E11C01} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = 0100000000000000ef3b4e6ec9cbd801	iexplcrer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1D27F844-3A1F-4410-85AC-14651078412D} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 010000000000000019715d6dc9cbd801	scrcons.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	scrcons.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings	scrcons.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{99D353BC-C813-41EC-8F28-EAE61E702E57} {A08CE4D0-FA25-44AB-B57C-C7B1C323E0B9} 0xFFFF = 010000000000000063c14c6dc9cbd801	scrcons.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{470C0EBD-5D73-4D58-9CED-E91E22E23282} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 01000000000000006c145b6dc9cbd801	scrcons.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{289AF617-1CC3-42A6-926C-E6A863F0E3BA} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = 01000000000000005c78496ec9cbd801	iexplcrer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	iexplcrer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	WScript.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{596AB062-B4D2-4215-9F74-E9109B0A8153} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 010000000000000097a9396dc9cbd801	scrcons.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{23170F69-40C1-278A-1000-000100020000} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000e2e5536dc9cbd801	scrcons.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	scrcons.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	scrcons.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	WScript.exe
Key created	\REGISTRY\USER\S-1-5-18_Classes\Local Settings	iexplcrer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	WScript.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{474C98EE-CF3D-41F5-80E3-4AAB0AB04301} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 010000000000000081713e6dc9cbd801	scrcons.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	iexplcrer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	iexplcrer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E61BF828-5E63-4287-BEF1-60B1A4FDE0E3} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000ba5d4a6dc9cbd801	scrcons.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2BF9676-5F8F-435C-97EB-11607A5BEDF7} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 01000000000000001e83516dc9cbd801	scrcons.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	iexplcrer.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	a9d600219f781741acc330a123e102aff9570b30a3a9ce355687e299bff4e3cd.exe

Suspicious behavior: RenamesItself 2 IoCs

pid	Process
2292	a9d600219f781741acc330a123e102aff9570b30a3a9ce355687e299bff4e3cd.exe
3780	iexplcrer.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 3144	2292	a9d600219f781741acc330a123e102aff9570b30a3a9ce355687e299bff4e3cd.exe	83
PID 2292 wrote to memory of 3144	2292	a9d600219f781741acc330a123e102aff9570b30a3a9ce355687e299bff4e3cd.exe	83
PID 2292 wrote to memory of 3144	2292	a9d600219f781741acc330a123e102aff9570b30a3a9ce355687e299bff4e3cd.exe	83
PID 4764 wrote to memory of 3780	4764	scrcons.exe	100
PID 4764 wrote to memory of 3780	4764	scrcons.exe	100
PID 4764 wrote to memory of 3780	4764	scrcons.exe	100
PID 3780 wrote to memory of 4108	3780	iexplcrer.exe	101
PID 3780 wrote to memory of 4108	3780	iexplcrer.exe	101
PID 3780 wrote to memory of 4108	3780	iexplcrer.exe	101
PID 4764 wrote to memory of 656	4764	scrcons.exe	104
PID 4764 wrote to memory of 656	4764	scrcons.exe	104
PID 4764 wrote to memory of 656	4764	scrcons.exe	104
PID 4764 wrote to memory of 4980	4764	scrcons.exe	103
PID 4764 wrote to memory of 4980	4764	scrcons.exe	103
PID 4764 wrote to memory of 4980	4764	scrcons.exe	103

C:\Users\Admin\AppData\Local\Temp\a9d600219f781741acc330a123e102aff9570b30a3a9ce355687e299bff4e3cd.exe
"C:\Users\Admin\AppData\Local\Temp\a9d600219f781741acc330a123e102aff9570b30a3a9ce355687e299bff4e3cd.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\8rt8usnfrq9blse9qer2.vbs"
  2⤵
  PID:3144

C:\Windows\system32\wbem\scrcons.exe
C:\Windows\system32\wbem\scrcons.exe -Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4764
- C:\iexplcrer.exe
  "C:\iexplcrer.exe"
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:3780
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\8rt8usnfrq9blse9qer2.vbs"
    3⤵
    - Modifies data under HKEY_USERS
    PID:4108
- C:\iexplcrer.exe
  "C:\iexplcrer.exe"
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\iexplcrer.exe
  "C:\iexplcrer.exe"
  2⤵
  - Executes dropped EXE
  PID:656

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\8rt8usnfrq9blse9qer2.vbs

Filesize
1KB

MD5
c4017f421eb87067425ce9bb3c5f3f58

SHA1
488e9e422a054598a8ac5b46704ced9fbf4374de

SHA256
eb998c38501f09f993141d81adfdbc1fe90f17a236a0aa26e97949796c843877

SHA512
8d1de778dba5b2045398847d8300b1c61d263b0fb2b7b827685b79c20d313bca7a0442f9610a9b4edb47a8278fda468bdfb7d04af7fd263fb1798784f864bb1f

Download Submit
C:\8rt8usnfrq9blse9qer2.vbs

Filesize
1KB

MD5
c4017f421eb87067425ce9bb3c5f3f58

SHA1
488e9e422a054598a8ac5b46704ced9fbf4374de

SHA256
eb998c38501f09f993141d81adfdbc1fe90f17a236a0aa26e97949796c843877

SHA512
8d1de778dba5b2045398847d8300b1c61d263b0fb2b7b827685b79c20d313bca7a0442f9610a9b4edb47a8278fda468bdfb7d04af7fd263fb1798784f864bb1f

Download Submit
C:\iexplcrer.exe

Filesize
76KB

MD5
625a18ad5cc6c899205a15c09b2efc37

SHA1
0fa112d6eb2eaabf7ed9f5ff3c665f491860369f

SHA256
a9d600219f781741acc330a123e102aff9570b30a3a9ce355687e299bff4e3cd

SHA512
95c83500fb3d2ddcdb00b6bcd7c47677368ec67669e4d54bba7e682833d9293c84d7247d0402b1ea5077fa1a99123a03ec04f4337096c5f2b36b96f5d9daa0ce

Download Submit
C:\iexplcrer.exe

Filesize
76KB

MD5
625a18ad5cc6c899205a15c09b2efc37

SHA1
0fa112d6eb2eaabf7ed9f5ff3c665f491860369f

SHA256
a9d600219f781741acc330a123e102aff9570b30a3a9ce355687e299bff4e3cd

SHA512
95c83500fb3d2ddcdb00b6bcd7c47677368ec67669e4d54bba7e682833d9293c84d7247d0402b1ea5077fa1a99123a03ec04f4337096c5f2b36b96f5d9daa0ce

Download Submit
C:\iexplcrer.exe

Filesize
76KB

MD5
625a18ad5cc6c899205a15c09b2efc37

SHA1
0fa112d6eb2eaabf7ed9f5ff3c665f491860369f

SHA256
a9d600219f781741acc330a123e102aff9570b30a3a9ce355687e299bff4e3cd

SHA512
95c83500fb3d2ddcdb00b6bcd7c47677368ec67669e4d54bba7e682833d9293c84d7247d0402b1ea5077fa1a99123a03ec04f4337096c5f2b36b96f5d9daa0ce

Download Submit