gh0strat | a61d6710e926e7fd090224403b1df7a130508bb1914157523886b33729f7839b

Analysis

max time kernel
150s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 15:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a61d6710e926e7fd090224403b1df7a130508bb1914157523886b33729f7839b.exe
Size

111KB
MD5

646a7d30d99381fa55728002cd353a44
SHA1

7a9fef4d4b9eb9c7fc117c4a7b308aa05e3c47b6
SHA256

a61d6710e926e7fd090224403b1df7a130508bb1914157523886b33729f7839b
SHA512

3d61013fb3e300fec5e49f673c5a5f35e09996de5c709d588ed21b6fce6727ce117896de42895507566afc157c825f86a1114654c64dc28ebf15f93dd2b020ba
SSDEEP

3072:dZ8BZsGA6P1XhkUVg8H8pd9Ti6dki1z3W:dZ8TsOtx1geCd9i6yi1bW

Score

10^/10

gh0strat persistence rat

Malware Config

Signatures

Gh0st RAT payload 3 IoCs

resource	yara_rule
behavioral1/memory/1932-55-0x0000000000400000-0x000000000041E000-memory.dmp	family_gh0strat
behavioral1/files/0x00140000000054ab-54.dat	family_gh0strat
behavioral1/files/0x00140000000054ab-56.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Microsoft MR\Parameters\ServiceDll = "C:\\Windows\\system32\\360SP2.dll"	a61d6710e926e7fd090224403b1df7a130508bb1914157523886b33729f7839b.exe

Deletes itself 1 IoCs

pid	Process
1804	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
1804	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\360SP2.dll	a61d6710e926e7fd090224403b1df7a130508bb1914157523886b33729f7839b.exe

C:\Users\Admin\AppData\Local\Temp\a61d6710e926e7fd090224403b1df7a130508bb1914157523886b33729f7839b.exe
"C:\Users\Admin\AppData\Local\Temp\a61d6710e926e7fd090224403b1df7a130508bb1914157523886b33729f7839b.exe"
1⤵
- Sets DLL path for service in the registry
- Drops file in System32 directory
PID:1932

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Deletes itself
- Loads dropped DLL
PID:1804

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\360sp2.dll

Filesize
104KB

MD5
a04a557b9969f8ea72ea6c3f46124e60

SHA1
6690ee20ad185beb5275551597754d5ea7d6750b

SHA256
8a396bd8ac1f1f5e22b64007352fa5231c069d6e3e545eb68b95444edb3f32c8

SHA512
dbbee674a2387b3e714dea81c6f98e74d162887416ff9e146c826932771903823ebccbaf51b945a52f3abf1cdc762e3a10d366ff3cc17af29ac4b3b8395384a8

Download Submit
\Windows\SysWOW64\360SP2.dll

Filesize
104KB

MD5
a04a557b9969f8ea72ea6c3f46124e60

SHA1
6690ee20ad185beb5275551597754d5ea7d6750b

SHA256
8a396bd8ac1f1f5e22b64007352fa5231c069d6e3e545eb68b95444edb3f32c8

SHA512
dbbee674a2387b3e714dea81c6f98e74d162887416ff9e146c826932771903823ebccbaf51b945a52f3abf1cdc762e3a10d366ff3cc17af29ac4b3b8395384a8

Download Submit
memory/1804-57-0x0000000075F51000-0x0000000075F53000-memory.dmp

Filesize
8KB

Download
memory/1932-55-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download