gh0strat | faf1d5c19a3894981e8af6624191b8660f5e838b97e239adaab92e993c8651c1

Analysis

max time kernel
144s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2022, 07:53

Target

faf1d5c19a3894981e8af6624191b8660f5e838b97e239adaab92e993c8651c1.exe
Size

436KB
MD5

513628ce34a1b3b8e8c98463e902c70b
SHA1

0c47171dc4c8869ec290e572f3619cbc87241178
SHA256

faf1d5c19a3894981e8af6624191b8660f5e838b97e239adaab92e993c8651c1
SHA512

d78d402a289046c03de48ba32923f19e6463c2901580abc669e7eef933c3ef4b99163ec54f1513e1b7af5b1d4a8ab3cb14b39d877c0d8bc0031967d391eb3739
SSDEEP

6144:ofokeqoQbN2l3f6KgZZWMwleY8OSDawleY8OSDwuavt5Geqo7:of20OiKOllZalZn4Bn

Score

10^/10

gh0strat rat

Gh0st RAT payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000a000000022e4f-134.dat	family_gh0strat
behavioral2/files/0x000a000000022e4f-135.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Executes dropped EXE 1 IoCs

pid	Process
4100	E3915A75.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\E3915A75.exe	faf1d5c19a3894981e8af6624191b8660f5e838b97e239adaab92e993c8651c1.exe
File opened for modification	\??\c:\Windows\E3915A75.exe	faf1d5c19a3894981e8af6624191b8660f5e838b97e239adaab92e993c8651c1.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
1004	taskkill.exe

Suspicious behavior: LoadsDriver 6 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1004	taskkill.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3304 wrote to memory of 1004	3304	faf1d5c19a3894981e8af6624191b8660f5e838b97e239adaab92e993c8651c1.exe	81
PID 3304 wrote to memory of 1004	3304	faf1d5c19a3894981e8af6624191b8660f5e838b97e239adaab92e993c8651c1.exe	81
PID 3304 wrote to memory of 1004	3304	faf1d5c19a3894981e8af6624191b8660f5e838b97e239adaab92e993c8651c1.exe	81
PID 3304 wrote to memory of 4100	3304	faf1d5c19a3894981e8af6624191b8660f5e838b97e239adaab92e993c8651c1.exe	83
PID 3304 wrote to memory of 4100	3304	faf1d5c19a3894981e8af6624191b8660f5e838b97e239adaab92e993c8651c1.exe	83
PID 3304 wrote to memory of 4100	3304	faf1d5c19a3894981e8af6624191b8660f5e838b97e239adaab92e993c8651c1.exe	83
PID 3304 wrote to memory of 2136	3304	faf1d5c19a3894981e8af6624191b8660f5e838b97e239adaab92e993c8651c1.exe	89
PID 3304 wrote to memory of 2136	3304	faf1d5c19a3894981e8af6624191b8660f5e838b97e239adaab92e993c8651c1.exe	89
PID 3304 wrote to memory of 2136	3304	faf1d5c19a3894981e8af6624191b8660f5e838b97e239adaab92e993c8651c1.exe	89

C:\Users\Admin\AppData\Local\Temp\faf1d5c19a3894981e8af6624191b8660f5e838b97e239adaab92e993c8651c1.exe
"C:\Users\Admin\AppData\Local\Temp\faf1d5c19a3894981e8af6624191b8660f5e838b97e239adaab92e993c8651c1.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im KSafeTray.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1004
- \??\c:\Windows\E3915A75.exe
  c:\Windows\E3915A75.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c afc9fe2f418b00a0.bat
  2⤵
  PID:2136

C:\Users\Admin\AppData\Local\Temp\afc9fe2f418b00a0.bat

Filesize
2KB

MD5
5daf1f14f3df2c5c2b6e31260da56ba0

SHA1
24721d7c2b89fa32b13544111e84577a1346493c

SHA256
e3be7951141dcb68cc78139fc0b9ee1d4179b2af866b4ee9b46161595f2a9ed4

SHA512
831aa8235f957717297a2c828550af6cb90d7d5c6b0fafd4794c1d7fcb5dd3d82dba30b1f33c067b8830d49a7acfa96fe5b67ee5322efbb8dedeb7a8b2cbf94e

Download Submit
C:\Windows\E3915A75.exe

Filesize
368KB

MD5
e9c0dc97ff58081d00dea7b104ba4a27

SHA1
689920b9a9d2d29e3e6375446971f92df3298d3d

SHA256
90f1dc9c670909c98216dfc7d71fe53dcbef4bf2b4a667f8b6abc274a0f22a9d

SHA512
f7287686ce8a233dbf0ea70fc229c598d0432691a8ace7e1f1290f1e4bbeb193aff5a321c892f23077e92637cae11714fa5bebe543cd0126ce7de41f0221112c

Download Submit
\??\c:\Windows\E3915A75.exe

Filesize
368KB

MD5
e9c0dc97ff58081d00dea7b104ba4a27

SHA1
689920b9a9d2d29e3e6375446971f92df3298d3d

SHA256
90f1dc9c670909c98216dfc7d71fe53dcbef4bf2b4a667f8b6abc274a0f22a9d

SHA512
f7287686ce8a233dbf0ea70fc229c598d0432691a8ace7e1f1290f1e4bbeb193aff5a321c892f23077e92637cae11714fa5bebe543cd0126ce7de41f0221112c

Download Submit