gh0strat | faf1d5c19a3894981e8af6624191b8660f5e838b97e239adaab92e993c8651c1

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04/10/2022, 07:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

faf1d5c19a3894981e8af6624191b8660f5e838b97e239adaab92e993c8651c1.exe
Size

436KB
MD5

513628ce34a1b3b8e8c98463e902c70b
SHA1

0c47171dc4c8869ec290e572f3619cbc87241178
SHA256

faf1d5c19a3894981e8af6624191b8660f5e838b97e239adaab92e993c8651c1
SHA512

d78d402a289046c03de48ba32923f19e6463c2901580abc669e7eef933c3ef4b99163ec54f1513e1b7af5b1d4a8ab3cb14b39d877c0d8bc0031967d391eb3739
SSDEEP

6144:ofokeqoQbN2l3f6KgZZWMwleY8OSDawleY8OSDwuavt5Geqo7:of20OiKOllZalZn4Bn

Score

10^/10

gh0strat rat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/files/0x000500000000b2d2-57.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Executes dropped EXE 1 IoCs

pid	Process
2044	A6AEF25E.exe

Deletes itself 1 IoCs

pid	Process
1808	cmd.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\A6AEF25E.exe	faf1d5c19a3894981e8af6624191b8660f5e838b97e239adaab92e993c8651c1.exe
File opened for modification	\??\c:\Windows\A6AEF25E.exe	faf1d5c19a3894981e8af6624191b8660f5e838b97e239adaab92e993c8651c1.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
844	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	844	taskkill.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 844	1264	faf1d5c19a3894981e8af6624191b8660f5e838b97e239adaab92e993c8651c1.exe	27
PID 1264 wrote to memory of 844	1264	faf1d5c19a3894981e8af6624191b8660f5e838b97e239adaab92e993c8651c1.exe	27
PID 1264 wrote to memory of 844	1264	faf1d5c19a3894981e8af6624191b8660f5e838b97e239adaab92e993c8651c1.exe	27
PID 1264 wrote to memory of 844	1264	faf1d5c19a3894981e8af6624191b8660f5e838b97e239adaab92e993c8651c1.exe	27
PID 1264 wrote to memory of 844	1264	faf1d5c19a3894981e8af6624191b8660f5e838b97e239adaab92e993c8651c1.exe	27
PID 1264 wrote to memory of 844	1264	faf1d5c19a3894981e8af6624191b8660f5e838b97e239adaab92e993c8651c1.exe	27
PID 1264 wrote to memory of 844	1264	faf1d5c19a3894981e8af6624191b8660f5e838b97e239adaab92e993c8651c1.exe	27
PID 1264 wrote to memory of 2044	1264	faf1d5c19a3894981e8af6624191b8660f5e838b97e239adaab92e993c8651c1.exe	29
PID 1264 wrote to memory of 2044	1264	faf1d5c19a3894981e8af6624191b8660f5e838b97e239adaab92e993c8651c1.exe	29
PID 1264 wrote to memory of 2044	1264	faf1d5c19a3894981e8af6624191b8660f5e838b97e239adaab92e993c8651c1.exe	29
PID 1264 wrote to memory of 2044	1264	faf1d5c19a3894981e8af6624191b8660f5e838b97e239adaab92e993c8651c1.exe	29
PID 1264 wrote to memory of 2044	1264	faf1d5c19a3894981e8af6624191b8660f5e838b97e239adaab92e993c8651c1.exe	29
PID 1264 wrote to memory of 2044	1264	faf1d5c19a3894981e8af6624191b8660f5e838b97e239adaab92e993c8651c1.exe	29
PID 1264 wrote to memory of 2044	1264	faf1d5c19a3894981e8af6624191b8660f5e838b97e239adaab92e993c8651c1.exe	29
PID 1264 wrote to memory of 1808	1264	faf1d5c19a3894981e8af6624191b8660f5e838b97e239adaab92e993c8651c1.exe	31
PID 1264 wrote to memory of 1808	1264	faf1d5c19a3894981e8af6624191b8660f5e838b97e239adaab92e993c8651c1.exe	31
PID 1264 wrote to memory of 1808	1264	faf1d5c19a3894981e8af6624191b8660f5e838b97e239adaab92e993c8651c1.exe	31
PID 1264 wrote to memory of 1808	1264	faf1d5c19a3894981e8af6624191b8660f5e838b97e239adaab92e993c8651c1.exe	31
PID 1264 wrote to memory of 1808	1264	faf1d5c19a3894981e8af6624191b8660f5e838b97e239adaab92e993c8651c1.exe	31
PID 1264 wrote to memory of 1808	1264	faf1d5c19a3894981e8af6624191b8660f5e838b97e239adaab92e993c8651c1.exe	31
PID 1264 wrote to memory of 1808	1264	faf1d5c19a3894981e8af6624191b8660f5e838b97e239adaab92e993c8651c1.exe	31

C:\Users\Admin\AppData\Local\Temp\faf1d5c19a3894981e8af6624191b8660f5e838b97e239adaab92e993c8651c1.exe
"C:\Users\Admin\AppData\Local\Temp\faf1d5c19a3894981e8af6624191b8660f5e838b97e239adaab92e993c8651c1.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im KSafeTray.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:844
- \??\c:\Windows\A6AEF25E.exe
  c:\Windows\A6AEF25E.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\SysWOW64\cmd.exe
  cmd /c afc9fe2f418b00a0.bat
  2⤵
  - Deletes itself
  PID:1808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\afc9fe2f418b00a0.bat

Filesize
2KB

MD5
5daf1f14f3df2c5c2b6e31260da56ba0

SHA1
24721d7c2b89fa32b13544111e84577a1346493c

SHA256
e3be7951141dcb68cc78139fc0b9ee1d4179b2af866b4ee9b46161595f2a9ed4

SHA512
831aa8235f957717297a2c828550af6cb90d7d5c6b0fafd4794c1d7fcb5dd3d82dba30b1f33c067b8830d49a7acfa96fe5b67ee5322efbb8dedeb7a8b2cbf94e

Download Submit
C:\Windows\A6AEF25E.exe

Filesize
368KB

MD5
9e9bfd8427c8bd307550c6f0ed860e24

SHA1
bb6a8bb77b0b1e900145b9cab25f751ecc995bf7

SHA256
64731caa349ffd1e7f5501fc17ea9dda4f8a1bfe3dc3a89923f8ff96519bbd68

SHA512
fcc5a273ff8c46edfb6ae41530c2ce498929100458e5ce1186cb383d0b5b124d9418dfd34d409377842dca0d2575baebc39ca1848b8dfa385f66af984881936e

Download Submit
memory/1264-54-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download