gh0strat | 31cda9f11ff43653f4acdf0c63c85284b9e0c78f6335473fdfa2e818aabfcfee

Analysis

max time kernel
42s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19-09-2022 12:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31cda9f11ff43653f4acdf0c63c85284b9e0c78f6335473fdfa2e818aabfcfee.exe
Size

1.2MB
MD5

9acddd1637acf921ebff8db1a3123fd2
SHA1

c6025e4a8444987ac72c16c4b2dfcf2e7f79b4fa
SHA256

31cda9f11ff43653f4acdf0c63c85284b9e0c78f6335473fdfa2e818aabfcfee
SHA512

81d0f3c3978e88bc0b7fe6e7d7c7b5aa1e55d93001f1b151fc235374084cade438ade947a5ff02a8c7d399850094589bd8bb7808b520e47964a611f526dff8ed
SSDEEP

24576:Tek86PekiQ/4kg761n6WqMJjmh7X3hxOQsssReBeP6Ik9C2iu:xfPeki6g761R+7XR0nHReBy6I5Vu

Score

10^/10

gh0strat evasion persistence rat

Malware Config

Signatures

Gh0st RAT payload 3 IoCs

resource	yara_rule
behavioral1/memory/2016-58-0x0000000010000000-0x0000000010121000-memory.dmp	family_gh0strat
behavioral1/memory/2016-61-0x00000000778A0000-0x0000000077A20000-memory.dmp	family_gh0strat
behavioral1/memory/2016-63-0x0000000010000000-0x0000000010121000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	31cda9f11ff43653f4acdf0c63c85284b9e0c78f6335473fdfa2e818aabfcfee.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Wine	31cda9f11ff43653f4acdf0c63c85284b9e0c78f6335473fdfa2e818aabfcfee.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	31cda9f11ff43653f4acdf0c63c85284b9e0c78f6335473fdfa2e818aabfcfee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\XXXXXX0D49E606 = "C:\\Windows\\XXXXXX0D49E606\\svchsot.exe"	31cda9f11ff43653f4acdf0c63c85284b9e0c78f6335473fdfa2e818aabfcfee.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2016	31cda9f11ff43653f4acdf0c63c85284b9e0c78f6335473fdfa2e818aabfcfee.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\XXXXXX0D49E606\svchsot.exe	31cda9f11ff43653f4acdf0c63c85284b9e0c78f6335473fdfa2e818aabfcfee.exe
File opened for modification	C:\Windows\XXXXXX0D49E606\svchsot.exe	31cda9f11ff43653f4acdf0c63c85284b9e0c78f6335473fdfa2e818aabfcfee.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2016	31cda9f11ff43653f4acdf0c63c85284b9e0c78f6335473fdfa2e818aabfcfee.exe
2016	31cda9f11ff43653f4acdf0c63c85284b9e0c78f6335473fdfa2e818aabfcfee.exe
2016	31cda9f11ff43653f4acdf0c63c85284b9e0c78f6335473fdfa2e818aabfcfee.exe
2016	31cda9f11ff43653f4acdf0c63c85284b9e0c78f6335473fdfa2e818aabfcfee.exe

C:\Users\Admin\AppData\Local\Temp\31cda9f11ff43653f4acdf0c63c85284b9e0c78f6335473fdfa2e818aabfcfee.exe
"C:\Users\Admin\AppData\Local\Temp\31cda9f11ff43653f4acdf0c63c85284b9e0c78f6335473fdfa2e818aabfcfee.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2016

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2016-54-0x0000000000400000-0x000000000067D000-memory.dmp

Filesize
2.5MB

Download
memory/2016-55-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download
memory/2016-56-0x0000000010000000-0x0000000010121000-memory.dmp

Filesize
1.1MB

Download
memory/2016-58-0x0000000010000000-0x0000000010121000-memory.dmp

Filesize
1.1MB

Download
memory/2016-61-0x00000000778A0000-0x0000000077A20000-memory.dmp

Filesize
1.5MB

Download
memory/2016-62-0x0000000000400000-0x000000000067D000-memory.dmp

Filesize
2.5MB

Download
memory/2016-63-0x0000000010000000-0x0000000010121000-memory.dmp

Filesize
1.1MB

Download
memory/2016-64-0x0000000000400000-0x000000000067D000-memory.dmp

Filesize
2.5MB

Download
memory/2016-65-0x00000000778A0000-0x0000000077A20000-memory.dmp

Filesize
1.5MB

Download
memory/2016-66-0x0000000000400000-0x000000000067D000-memory.dmp

Filesize
2.5MB

Download