gh0strat | 0acc8567f8d5e57993cb7513038d27482618586f0c3c63a646437dcf6eb5ee82

Analysis

max time kernel
150s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 23:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0acc8567f8d5e57993cb7513038d27482618586f0c3c63a646437dcf6eb5ee82.exe
Size

229KB
MD5

3c986235087ff0c87b114c154a163396
SHA1

5f3ac273e16c3c3c2df43d469809f7885748220a
SHA256

0acc8567f8d5e57993cb7513038d27482618586f0c3c63a646437dcf6eb5ee82
SHA512

412f7cc11fbcc4f68af3f0996ca4a5ee52054c5ac80f5b08e3b661a1746a3bd95ae2d7851f646aa4d6fc28d10947178d8c419d87140ff41aabb3dcd89c4d42d4
SSDEEP

6144:XlSyG0+MQNs8Cifew+IUAOvcIAaIKLK2tGLa:1SedQNs8f1seaIKLKGGLa

Score

10^/10

gh0strat persistence rat

Malware Config

Signatures

Gh0st RAT payload 3 IoCs

resource	yara_rule
behavioral1/memory/1688-55-0x0000000000400000-0x000000000043B000-memory.dmp	family_gh0strat
behavioral1/files/0x00140000000054ab-54.dat	family_gh0strat
behavioral1/files/0x00140000000054ab-56.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibilityex.dll"	0acc8567f8d5e57993cb7513038d27482618586f0c3c63a646437dcf6eb5ee82.exe

Deletes itself 1 IoCs

pid	Process
892	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
892	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\FastUserSwitchingCompatibilityex.dll	0acc8567f8d5e57993cb7513038d27482618586f0c3c63a646437dcf6eb5ee82.exe

C:\Users\Admin\AppData\Local\Temp\0acc8567f8d5e57993cb7513038d27482618586f0c3c63a646437dcf6eb5ee82.exe
"C:\Users\Admin\AppData\Local\Temp\0acc8567f8d5e57993cb7513038d27482618586f0c3c63a646437dcf6eb5ee82.exe"
1⤵
- Sets DLL path for service in the registry
- Drops file in System32 directory
PID:1688

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Deletes itself
- Loads dropped DLL
PID:892

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\fastuserswitchingcompatibilityex.dll

Filesize
96KB

MD5
0f163d6be15b17cedb5d994e27120811

SHA1
c07f28bdd1fa18f260ef5106ab6e3d0c61814195

SHA256
2e080397dddc878d84c8d9c66189d4cb01a48ba3443f82b1fb9c276f04b8de17

SHA512
149efde634a2f195fc5a0e2272ed731c502c9083927f3ce0ace705c6a53b55553f9a5ffdddd62103056ac48142c13ac40fce2aa9964063ff3248817f7ad70cfb

Download Submit
\Windows\SysWOW64\FastUserSwitchingCompatibilityex.dll

Filesize
96KB

MD5
0f163d6be15b17cedb5d994e27120811

SHA1
c07f28bdd1fa18f260ef5106ab6e3d0c61814195

SHA256
2e080397dddc878d84c8d9c66189d4cb01a48ba3443f82b1fb9c276f04b8de17

SHA512
149efde634a2f195fc5a0e2272ed731c502c9083927f3ce0ace705c6a53b55553f9a5ffdddd62103056ac48142c13ac40fce2aa9964063ff3248817f7ad70cfb

Download Submit
memory/892-57-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download
memory/1688-55-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download