gh0strat | 56da1798348288f01cf3bf84305836c6e0657f01c47848173c936aa3863ca541

General

Target

56da1798348288f01cf3bf84305836c6e0657f01c47848173c936aa3863ca541.exe
Size

375KB
MD5

851269ec1a296d1440471465c922769c
SHA1

0b54a098a134af224edc2f0a03cebb8033b8d462
SHA256

56da1798348288f01cf3bf84305836c6e0657f01c47848173c936aa3863ca541
SHA512

41188700e4226c2128d0557251b21f4ca6faf36c2be1ce86b4ec33794add5189fc9407f3b256fa49646654eff33ec7357f17d336437213238e78b36b39272af2
SSDEEP

6144:Rv5zQJVb5p72cHF1ybDFwekh212KhvwIb759QOaBjpaVRPu23E2rJmWjFc94:R4VOiF1WD7kE1dTYOi8V5u23zmWFy4

Score

10^/10

Malware Config

Signatures

Gh0st RAT payload 10 IoCs

resource	yara_rule
behavioral1/memory/4616-137-0x0000000010000000-0x0000000010362000-memory.dmp	family_gh0strat
behavioral1/memory/4616-136-0x0000000010000000-0x0000000010362000-memory.dmp	family_gh0strat
behavioral1/memory/4616-138-0x0000000010000000-0x0000000010362000-memory.dmp	family_gh0strat
behavioral1/memory/1952-148-0x0000000010000000-0x0000000010362000-memory.dmp	family_gh0strat
behavioral1/memory/2032-155-0x0000000010000000-0x0000000010362000-memory.dmp	family_gh0strat
behavioral1/memory/2032-156-0x0000000010000000-0x0000000010362000-memory.dmp	family_gh0strat
behavioral1/memory/1952-157-0x0000000010000000-0x0000000010362000-memory.dmp	family_gh0strat
behavioral1/memory/2032-159-0x0000000010000000-0x0000000010362000-memory.dmp	family_gh0strat
behavioral1/memory/3156-178-0x0000000010000000-0x0000000010362000-memory.dmp	family_gh0strat
behavioral1/memory/2552-180-0x0000000010000000-0x0000000010362000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Executes dropped EXE 4 IoCs

pid	Process
1952	SQLSerasi.exe
2032	SQLSerasi.exe
3156	SQLSerasi.exe
2552	SQLSerasi.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4616-133-0x0000000010000000-0x0000000010362000-memory.dmp	upx
behavioral1/memory/4616-137-0x0000000010000000-0x0000000010362000-memory.dmp	upx
behavioral1/memory/4616-136-0x0000000010000000-0x0000000010362000-memory.dmp	upx
behavioral1/memory/4616-138-0x0000000010000000-0x0000000010362000-memory.dmp	upx
behavioral1/memory/1952-148-0x0000000010000000-0x0000000010362000-memory.dmp	upx
behavioral1/memory/2032-152-0x0000000010000000-0x0000000010362000-memory.dmp	upx
behavioral1/memory/2032-155-0x0000000010000000-0x0000000010362000-memory.dmp	upx
behavioral1/memory/2032-156-0x0000000010000000-0x0000000010362000-memory.dmp	upx
behavioral1/memory/1952-157-0x0000000010000000-0x0000000010362000-memory.dmp	upx
behavioral1/memory/2032-159-0x0000000010000000-0x0000000010362000-memory.dmp	upx
behavioral1/memory/2552-180-0x0000000010000000-0x0000000010362000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	56da1798348288f01cf3bf84305836c6e0657f01c47848173c936aa3863ca541.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	SQLSerasi.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	SQLSerasi.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	SQLSerasi.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	SQLSerasi.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe	56da1798348288f01cf3bf84305836c6e0657f01c47848173c936aa3863ca541.exe
File opened for modification	C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe	56da1798348288f01cf3bf84305836c6e0657f01c47848173c936aa3863ca541.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
432	2032	WerFault.exe	83

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	SQLSerasi.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	SQLSerasi.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	SQLSerasi.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SQLSerasi.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	SQLSerasi.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SQLSerasi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SQLSerasi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SQLSerasi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	SQLSerasi.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	SQLSerasi.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	SQLSerasi.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	SQLSerasi.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	SQLSerasi.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	4616	56da1798348288f01cf3bf84305836c6e0657f01c47848173c936aa3863ca541.exe
Token: SeDebugPrivilege	1952	SQLSerasi.exe
Token: SeDebugPrivilege	2032	SQLSerasi.exe
Token: SeDebugPrivilege	2032	SQLSerasi.exe
Token: SeDebugPrivilege	2032	SQLSerasi.exe
Token: SeDebugPrivilege	3156	SQLSerasi.exe
Token: SeDebugPrivilege	2552	SQLSerasi.exe
Token: SeDebugPrivilege	2552	SQLSerasi.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 1952	4616	56da1798348288f01cf3bf84305836c6e0657f01c47848173c936aa3863ca541.exe	82
PID 4616 wrote to memory of 1952	4616	56da1798348288f01cf3bf84305836c6e0657f01c47848173c936aa3863ca541.exe	82
PID 4616 wrote to memory of 1952	4616	56da1798348288f01cf3bf84305836c6e0657f01c47848173c936aa3863ca541.exe	82
PID 2032 wrote to memory of 3156	2032	SQLSerasi.exe	86
PID 2032 wrote to memory of 3156	2032	SQLSerasi.exe	86
PID 2032 wrote to memory of 3156	2032	SQLSerasi.exe	86
PID 2032 wrote to memory of 2552	2032	SQLSerasi.exe	85
PID 2032 wrote to memory of 2552	2032	SQLSerasi.exe	85
PID 2032 wrote to memory of 2552	2032	SQLSerasi.exe	85

C:\Users\Admin\AppData\Local\Temp\56da1798348288f01cf3bf84305836c6e0657f01c47848173c936aa3863ca541.exe
"C:\Users\Admin\AppData\Local\Temp\56da1798348288f01cf3bf84305836c6e0657f01c47848173c936aa3863ca541.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe
  "C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1952

C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe
"C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe
  "C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2552
- C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe
  "C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3156
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 644
  2⤵
  - Program crash
  PID:432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2032 -ip 2032
1⤵
PID:1008

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe

Filesize
39.4MB

MD5
8b278402cf71d0095828f64284e84cee

SHA1
5d4173824eb0fef0c84986d0e60d616200b9d19e

SHA256
205ca0ea8b766c28a385487da71c7db22d3937affad4a9781e9f011e625bf6ec

SHA512
ab87a2ebdba29bead4f6a8092290c97f0041467799d6597fb4623b244c6254fd1c4f1477ca3fc14bcd842ca5474c34932182c81fab9632c4f47eac350f8955c8

Download Submit
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe

Filesize
39.4MB

MD5
8b278402cf71d0095828f64284e84cee

SHA1
5d4173824eb0fef0c84986d0e60d616200b9d19e

SHA256
205ca0ea8b766c28a385487da71c7db22d3937affad4a9781e9f011e625bf6ec

SHA512
ab87a2ebdba29bead4f6a8092290c97f0041467799d6597fb4623b244c6254fd1c4f1477ca3fc14bcd842ca5474c34932182c81fab9632c4f47eac350f8955c8

Download Submit
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe

Filesize
39.4MB

MD5
8b278402cf71d0095828f64284e84cee

SHA1
5d4173824eb0fef0c84986d0e60d616200b9d19e

SHA256
205ca0ea8b766c28a385487da71c7db22d3937affad4a9781e9f011e625bf6ec

SHA512
ab87a2ebdba29bead4f6a8092290c97f0041467799d6597fb4623b244c6254fd1c4f1477ca3fc14bcd842ca5474c34932182c81fab9632c4f47eac350f8955c8

Download Submit
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe

Filesize
39.4MB

MD5
8b278402cf71d0095828f64284e84cee

SHA1
5d4173824eb0fef0c84986d0e60d616200b9d19e

SHA256
205ca0ea8b766c28a385487da71c7db22d3937affad4a9781e9f011e625bf6ec

SHA512
ab87a2ebdba29bead4f6a8092290c97f0041467799d6597fb4623b244c6254fd1c4f1477ca3fc14bcd842ca5474c34932182c81fab9632c4f47eac350f8955c8

Download Submit
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe

Filesize
39.4MB

MD5
8b278402cf71d0095828f64284e84cee

SHA1
5d4173824eb0fef0c84986d0e60d616200b9d19e

SHA256
205ca0ea8b766c28a385487da71c7db22d3937affad4a9781e9f011e625bf6ec

SHA512
ab87a2ebdba29bead4f6a8092290c97f0041467799d6597fb4623b244c6254fd1c4f1477ca3fc14bcd842ca5474c34932182c81fab9632c4f47eac350f8955c8

Download Submit
memory/1952-157-0x0000000010000000-0x0000000010362000-memory.dmp

Filesize
3.4MB

Download
memory/1952-148-0x0000000010000000-0x0000000010362000-memory.dmp

Filesize
3.4MB

Download
memory/1952-160-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/1952-140-0x0000000000000000-mapping.dmp

Download
memory/1952-150-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2032-155-0x0000000010000000-0x0000000010362000-memory.dmp

Filesize
3.4MB

Download
memory/2032-159-0x0000000010000000-0x0000000010362000-memory.dmp

Filesize
3.4MB

Download
memory/2032-152-0x0000000010000000-0x0000000010362000-memory.dmp

Filesize
3.4MB

Download
memory/2032-156-0x0000000010000000-0x0000000010362000-memory.dmp

Filesize
3.4MB

Download
memory/2032-158-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2552-163-0x0000000000000000-mapping.dmp

Download
memory/2552-176-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2552-180-0x0000000010000000-0x0000000010362000-memory.dmp

Filesize
3.4MB

Download
memory/3156-181-0x0000000010000000-0x0000000010362000-memory.dmp

Filesize
3.4MB

Download
memory/3156-177-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/3156-161-0x0000000000000000-mapping.dmp

Download
memory/3156-178-0x0000000010000000-0x0000000010362000-memory.dmp

Filesize
3.4MB

Download
memory/3156-179-0x0000000010000000-0x0000000010362000-memory.dmp

Filesize
3.4MB

Download
memory/3156-175-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/4616-133-0x0000000010000000-0x0000000010362000-memory.dmp

Filesize
3.4MB

Download
memory/4616-139-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/4616-132-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/4616-137-0x0000000010000000-0x0000000010362000-memory.dmp

Filesize
3.4MB

Download
memory/4616-136-0x0000000010000000-0x0000000010362000-memory.dmp

Filesize
3.4MB

Download
memory/4616-138-0x0000000010000000-0x0000000010362000-memory.dmp

Filesize
3.4MB

Download
memory/4616-144-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads