gh0strat | 31cda9f11ff43653f4acdf0c63c85284b9e0c78f6335473fdfa2e818aabfcfee

Analysis

max time kernel
112s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 12:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31cda9f11ff43653f4acdf0c63c85284b9e0c78f6335473fdfa2e818aabfcfee.exe
Size

1.2MB
MD5

9acddd1637acf921ebff8db1a3123fd2
SHA1

c6025e4a8444987ac72c16c4b2dfcf2e7f79b4fa
SHA256

31cda9f11ff43653f4acdf0c63c85284b9e0c78f6335473fdfa2e818aabfcfee
SHA512

81d0f3c3978e88bc0b7fe6e7d7c7b5aa1e55d93001f1b151fc235374084cade438ade947a5ff02a8c7d399850094589bd8bb7808b520e47964a611f526dff8ed
SSDEEP

24576:Tek86PekiQ/4kg761n6WqMJjmh7X3hxOQsssReBeP6Ik9C2iu:xfPeki6g761R+7XR0nHReBy6I5Vu

Score

10^/10

gh0strat evasion persistence rat

Malware Config

Signatures

Gh0st RAT payload 3 IoCs

resource	yara_rule
behavioral2/memory/3452-136-0x0000000010000000-0x0000000010121000-memory.dmp	family_gh0strat
behavioral2/memory/3452-137-0x0000000010000000-0x0000000010121000-memory.dmp	family_gh0strat
behavioral2/memory/3452-140-0x0000000010000000-0x0000000010121000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	31cda9f11ff43653f4acdf0c63c85284b9e0c78f6335473fdfa2e818aabfcfee.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Wine	31cda9f11ff43653f4acdf0c63c85284b9e0c78f6335473fdfa2e818aabfcfee.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	31cda9f11ff43653f4acdf0c63c85284b9e0c78f6335473fdfa2e818aabfcfee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XXXXXX0D49E606 = "C:\\Windows\\XXXXXX0D49E606\\svchsot.exe"	31cda9f11ff43653f4acdf0c63c85284b9e0c78f6335473fdfa2e818aabfcfee.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Default	31cda9f11ff43653f4acdf0c63c85284b9e0c78f6335473fdfa2e818aabfcfee.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3452	31cda9f11ff43653f4acdf0c63c85284b9e0c78f6335473fdfa2e818aabfcfee.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\XXXXXX0D49E606\svchsot.exe	31cda9f11ff43653f4acdf0c63c85284b9e0c78f6335473fdfa2e818aabfcfee.exe
File opened for modification	C:\Windows\XXXXXX0D49E606\svchsot.exe	31cda9f11ff43653f4acdf0c63c85284b9e0c78f6335473fdfa2e818aabfcfee.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3452	31cda9f11ff43653f4acdf0c63c85284b9e0c78f6335473fdfa2e818aabfcfee.exe
3452	31cda9f11ff43653f4acdf0c63c85284b9e0c78f6335473fdfa2e818aabfcfee.exe
3452	31cda9f11ff43653f4acdf0c63c85284b9e0c78f6335473fdfa2e818aabfcfee.exe
3452	31cda9f11ff43653f4acdf0c63c85284b9e0c78f6335473fdfa2e818aabfcfee.exe
3452	31cda9f11ff43653f4acdf0c63c85284b9e0c78f6335473fdfa2e818aabfcfee.exe
3452	31cda9f11ff43653f4acdf0c63c85284b9e0c78f6335473fdfa2e818aabfcfee.exe
3452	31cda9f11ff43653f4acdf0c63c85284b9e0c78f6335473fdfa2e818aabfcfee.exe
3452	31cda9f11ff43653f4acdf0c63c85284b9e0c78f6335473fdfa2e818aabfcfee.exe

C:\Users\Admin\AppData\Local\Temp\31cda9f11ff43653f4acdf0c63c85284b9e0c78f6335473fdfa2e818aabfcfee.exe
"C:\Users\Admin\AppData\Local\Temp\31cda9f11ff43653f4acdf0c63c85284b9e0c78f6335473fdfa2e818aabfcfee.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Identifies Wine through registry keys
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:3452

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3452-132-0x0000000000400000-0x000000000067D000-memory.dmp

Filesize
2.5MB

Download
memory/3452-133-0x0000000077190000-0x0000000077333000-memory.dmp

Filesize
1.6MB

Download
memory/3452-134-0x0000000010000000-0x0000000010121000-memory.dmp

Filesize
1.1MB

Download
memory/3452-136-0x0000000010000000-0x0000000010121000-memory.dmp

Filesize
1.1MB

Download
memory/3452-137-0x0000000010000000-0x0000000010121000-memory.dmp

Filesize
1.1MB

Download
memory/3452-139-0x0000000000400000-0x000000000067D000-memory.dmp

Filesize
2.5MB

Download
memory/3452-140-0x0000000010000000-0x0000000010121000-memory.dmp

Filesize
1.1MB

Download
memory/3452-141-0x0000000000400000-0x000000000067D000-memory.dmp

Filesize
2.5MB

Download
memory/3452-142-0x0000000077190000-0x0000000077333000-memory.dmp

Filesize
1.6MB

Download
memory/3452-143-0x0000000000400000-0x000000000067D000-memory.dmp

Filesize
2.5MB

Download