gh0strat | e1691bda323c46c3dd3926b242861fb88452191742395365c48c38a454da916b

General

Target

e1691bda323c46c3dd3926b242861fb88452191742395365c48c38a454da916b.exe
Size

156KB
MD5

638d922d3a1acb3756dda409b8b50700
SHA1

6c416852f4c750931281b76fa6e69a9996da7882
SHA256

e1691bda323c46c3dd3926b242861fb88452191742395365c48c38a454da916b
SHA512

a5e400a843be5b102be00a5fb30f96970d7b18f2f2259fadd2c6e721461ceacd0239737f05bfae6348887d03e5c81f89505e28cd75d09e5c6240607acb325d6a
SSDEEP

3072:dVZd5rnmoWOQrkdJv5hMFULTvtcMk8Lyji8lkivl05Kui+ITqn:dXd5rmoWOQsJRG4GMkSQi8Tvl05KuDIk

Score

10^/10

Malware Config

Signatures

Gh0st RAT payload 4 IoCs

resource	yara_rule
behavioral2/files/0x0009000000022e01-133.dat	family_gh0strat
behavioral2/files/0x0009000000022e01-134.dat	family_gh0strat
behavioral2/files/0x0006000000022e0b-136.dat	family_gh0strat
behavioral2/files/0x0006000000022e0b-137.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Executes dropped EXE 1 IoCs

pid	Process
440	inhwoipfi.exe

Modifies Installed Components in the registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{powxcxlq-uetz-cegd-ovjl-zonovtrvtvur}	e1691bda323c46c3dd3926b242861fb88452191742395365c48c38a454da916b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{powxcxlq-uetz-cegd-ovjl-zonovtrvtvur}\ = "ÏµÍ³ÉèÖÃ"	e1691bda323c46c3dd3926b242861fb88452191742395365c48c38a454da916b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{powxcxlq-uetz-cegd-ovjl-zonovtrvtvur}\stubpath = "C:\\Windows\\System32\\inhwoipfi.exe"	e1691bda323c46c3dd3926b242861fb88452191742395365c48c38a454da916b.exe

Loads dropped DLL 1 IoCs

pid	Process
4480	userinit.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\inhwoipfi.exe	e1691bda323c46c3dd3926b242861fb88452191742395365c48c38a454da916b.exe
File created	C:\Windows\SysWOW64\inhwoipfi.exe_lang.ini	e1691bda323c46c3dd3926b242861fb88452191742395365c48c38a454da916b.exe
File opened for modification	C:\Windows\SysWOW64\inhwoipfi.exe_lang.ini	e1691bda323c46c3dd3926b242861fb88452191742395365c48c38a454da916b.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2120	e1691bda323c46c3dd3926b242861fb88452191742395365c48c38a454da916b.exe
2120	e1691bda323c46c3dd3926b242861fb88452191742395365c48c38a454da916b.exe
440	inhwoipfi.exe
440	inhwoipfi.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2120	e1691bda323c46c3dd3926b242861fb88452191742395365c48c38a454da916b.exe
Token: SeDebugPrivilege	440	inhwoipfi.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 440	2120	e1691bda323c46c3dd3926b242861fb88452191742395365c48c38a454da916b.exe	84
PID 2120 wrote to memory of 440	2120	e1691bda323c46c3dd3926b242861fb88452191742395365c48c38a454da916b.exe	84
PID 2120 wrote to memory of 440	2120	e1691bda323c46c3dd3926b242861fb88452191742395365c48c38a454da916b.exe	84
PID 440 wrote to memory of 4480	440	inhwoipfi.exe	85
PID 440 wrote to memory of 4480	440	inhwoipfi.exe	85
PID 440 wrote to memory of 4480	440	inhwoipfi.exe	85
PID 440 wrote to memory of 4480	440	inhwoipfi.exe	85

C:\Users\Admin\AppData\Local\Temp\e1691bda323c46c3dd3926b242861fb88452191742395365c48c38a454da916b.exe
"C:\Users\Admin\AppData\Local\Temp\e1691bda323c46c3dd3926b242861fb88452191742395365c48c38a454da916b.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\SysWOW64\inhwoipfi.exe
  C:\Windows\System32\inhwoipfi.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:440
- - C:\Windows\SysWOW64\userinit.exe
    userinit.exe
    3⤵
    - Loads dropped DLL
    PID:4480

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\240562234_lang.dll

Filesize
114KB

MD5
7ebc1ba26892a0464b3d65fecac07ffc

SHA1
e120b6b7b6e86d00149f45b0cc4b68cffaf56916

SHA256
8c404e23655f5e1e607ed413e1b1963c257e4a18f05793de790b6b98fc026ab2

SHA512
b1652468e5fd94414a1fa586fb304c8c68194f860292e5ab0aba0998cd6d2c62c4e500813a027c6418f65ecf7278080ba7079d1495e230507b6a4383f376025e

Download Submit
C:\Users\Admin\AppData\Local\Temp\240562234_lang.dll

Filesize
114KB

MD5
7ebc1ba26892a0464b3d65fecac07ffc

SHA1
e120b6b7b6e86d00149f45b0cc4b68cffaf56916

SHA256
8c404e23655f5e1e607ed413e1b1963c257e4a18f05793de790b6b98fc026ab2

SHA512
b1652468e5fd94414a1fa586fb304c8c68194f860292e5ab0aba0998cd6d2c62c4e500813a027c6418f65ecf7278080ba7079d1495e230507b6a4383f376025e

Download Submit
C:\Windows\SysWOW64\inhwoipfi.exe

Filesize
156KB

MD5
e32719f4de53205a9270e093632b182a

SHA1
badf366cc7eab58a0e4f1af794a4c7fc2070da3f

SHA256
548e92107c0e2aebda9b2f48fb871b00c11a06757801455d76058c252d7ff847

SHA512
0703d3fa37c351981d3ecb6151f9df20aa3b26fab87df7418b239ae280bb6b20175c9283cc68f62717aaee8e197e8ca52356a49e578f451b568ccfd95676aeda

Download Submit
C:\Windows\SysWOW64\inhwoipfi.exe

Filesize
156KB

MD5
e32719f4de53205a9270e093632b182a

SHA1
badf366cc7eab58a0e4f1af794a4c7fc2070da3f

SHA256
548e92107c0e2aebda9b2f48fb871b00c11a06757801455d76058c252d7ff847

SHA512
0703d3fa37c351981d3ecb6151f9df20aa3b26fab87df7418b239ae280bb6b20175c9283cc68f62717aaee8e197e8ca52356a49e578f451b568ccfd95676aeda

Download Submit

Analysis

Sharing