gh0strat | a4e67cc7c35482e90823dc8f8e308add7460e7dee3973fe502d4aebcd8498dbe

Analysis

max time kernel
167s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 01:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4e67cc7c35482e90823dc8f8e308add7460e7dee3973fe502d4aebcd8498dbe.exe
Size

328KB
MD5

6e51a59454b07301c18512530523c460
SHA1

f12156a108a838dcb6ff88935548ea8c70ab5dcb
SHA256

a4e67cc7c35482e90823dc8f8e308add7460e7dee3973fe502d4aebcd8498dbe
SHA512

410cf08c72ac2441f034c4cbba3c212ae0d23da640f3156a732d8ca0512c72906061b3621d97fd76c26646675af70fdf1731de0fbdbefa9b0f7e566fc3bf7882
SSDEEP

6144:TPW//k2s7OLUU9Egylsk7BPXS5Es2ATbwiEmPvs:TPW/BsOUqhylhaEbAAJ

Score

10^/10

gh0strat rat

Malware Config

Signatures

Gh0st RAT payload 2 IoCs

resource	yara_rule
behavioral2/memory/1724-132-0x0000000000400000-0x0000000000452000-memory.dmp	family_gh0strat
behavioral2/memory/1724-133-0x0000000000400000-0x0000000000452000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	a4e67cc7c35482e90823dc8f8e308add7460e7dee3973fe502d4aebcd8498dbe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	a4e67cc7c35482e90823dc8f8e308add7460e7dee3973fe502d4aebcd8498dbe.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1724	a4e67cc7c35482e90823dc8f8e308add7460e7dee3973fe502d4aebcd8498dbe.exe
1724	a4e67cc7c35482e90823dc8f8e308add7460e7dee3973fe502d4aebcd8498dbe.exe
1724	a4e67cc7c35482e90823dc8f8e308add7460e7dee3973fe502d4aebcd8498dbe.exe
1724	a4e67cc7c35482e90823dc8f8e308add7460e7dee3973fe502d4aebcd8498dbe.exe
1724	a4e67cc7c35482e90823dc8f8e308add7460e7dee3973fe502d4aebcd8498dbe.exe
1724	a4e67cc7c35482e90823dc8f8e308add7460e7dee3973fe502d4aebcd8498dbe.exe
1724	a4e67cc7c35482e90823dc8f8e308add7460e7dee3973fe502d4aebcd8498dbe.exe
1724	a4e67cc7c35482e90823dc8f8e308add7460e7dee3973fe502d4aebcd8498dbe.exe
1724	a4e67cc7c35482e90823dc8f8e308add7460e7dee3973fe502d4aebcd8498dbe.exe
1724	a4e67cc7c35482e90823dc8f8e308add7460e7dee3973fe502d4aebcd8498dbe.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1724	a4e67cc7c35482e90823dc8f8e308add7460e7dee3973fe502d4aebcd8498dbe.exe

C:\Users\Admin\AppData\Local\Temp\a4e67cc7c35482e90823dc8f8e308add7460e7dee3973fe502d4aebcd8498dbe.exe
"C:\Users\Admin\AppData\Local\Temp\a4e67cc7c35482e90823dc8f8e308add7460e7dee3973fe502d4aebcd8498dbe.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:1724

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1724-132-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1724-133-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download