gh0strat | d4e2368a849804a0c3e1c3478e53bf15618708489085a3dd988e4c51a8f2349c

Analysis

max time kernel
150s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21/10/2022, 04:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d4e2368a849804a0c3e1c3478e53bf15618708489085a3dd988e4c51a8f2349c.exe
Size

89KB
MD5

55a2a638581ce1c259a850d264d28b84
SHA1

a9e7525e238a5f1e90055397252d81dd5e00f0d2
SHA256

d4e2368a849804a0c3e1c3478e53bf15618708489085a3dd988e4c51a8f2349c
SHA512

4c7056b5973c65c187b48733109b0936a68e03cb024f1e215c8497b9d0b6397215b5b42766270d1b1cbb1c399806908e0064b93f1ae329edb1455358e4e5f23d
SSDEEP

1536:rHIygkUcLXJ1jNkk7+K3BwSFCXte5tz4yC2ASelhEAiajhenUe:rHI0JXJ1NZn3Bw1Xte5WyC2AdhEAiaje

Score

10^/10

gh0strat rat

Malware Config

Signatures

Gh0st RAT payload 8 IoCs

resource	yara_rule
behavioral2/memory/2216-133-0x0000000000400000-0x000000000044A000-memory.dmp	family_gh0strat
behavioral2/memory/2216-134-0x0000000000400000-0x000000000044A000-memory.dmp	family_gh0strat
behavioral2/memory/2652-139-0x0000000000400000-0x000000000044A000-memory.dmp	family_gh0strat
behavioral2/files/0x0007000000022e26-140.dat	family_gh0strat
behavioral2/files/0x0007000000022e26-141.dat	family_gh0strat
behavioral2/memory/2652-142-0x0000000000400000-0x000000000044A000-memory.dmp	family_gh0strat
behavioral2/files/0x0007000000022e26-143.dat	family_gh0strat
behavioral2/files/0x0007000000022e26-145.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Executes dropped EXE 1 IoCs

pid	Process
2652	fnunshqpxr

Loads dropped DLL 3 IoCs

pid	Process
4232	svchost.exe
640	svchost.exe
4484	svchost.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\nlmutmpnao	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\ntrsayyfau	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\nftbsocyxo	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\nmwpudiumd	svchost.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
3700	4232	WerFault.exe	84
3240	640	WerFault.exe	88
3776	4484	WerFault.exe	91

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2652	fnunshqpxr
2652	fnunshqpxr

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeRestorePrivilege	2652	fnunshqpxr
Token: SeBackupPrivilege	2652	fnunshqpxr
Token: SeBackupPrivilege	2652	fnunshqpxr
Token: SeRestorePrivilege	2652	fnunshqpxr
Token: SeBackupPrivilege	4232	svchost.exe
Token: SeRestorePrivilege	4232	svchost.exe
Token: SeBackupPrivilege	4232	svchost.exe
Token: SeBackupPrivilege	4232	svchost.exe
Token: SeSecurityPrivilege	4232	svchost.exe
Token: SeSecurityPrivilege	4232	svchost.exe
Token: SeBackupPrivilege	4232	svchost.exe
Token: SeBackupPrivilege	4232	svchost.exe
Token: SeSecurityPrivilege	4232	svchost.exe
Token: SeBackupPrivilege	4232	svchost.exe
Token: SeBackupPrivilege	4232	svchost.exe
Token: SeSecurityPrivilege	4232	svchost.exe
Token: SeBackupPrivilege	4232	svchost.exe
Token: SeRestorePrivilege	4232	svchost.exe
Token: SeBackupPrivilege	640	svchost.exe
Token: SeRestorePrivilege	640	svchost.exe
Token: SeBackupPrivilege	640	svchost.exe
Token: SeBackupPrivilege	640	svchost.exe
Token: SeSecurityPrivilege	640	svchost.exe
Token: SeSecurityPrivilege	640	svchost.exe
Token: SeBackupPrivilege	640	svchost.exe
Token: SeBackupPrivilege	640	svchost.exe
Token: SeSecurityPrivilege	640	svchost.exe
Token: SeBackupPrivilege	4484	svchost.exe
Token: SeRestorePrivilege	4484	svchost.exe
Token: SeBackupPrivilege	4484	svchost.exe
Token: SeBackupPrivilege	4484	svchost.exe
Token: SeSecurityPrivilege	4484	svchost.exe
Token: SeSecurityPrivilege	4484	svchost.exe
Token: SeBackupPrivilege	4484	svchost.exe
Token: SeBackupPrivilege	4484	svchost.exe
Token: SeSecurityPrivilege	4484	svchost.exe
Token: SeBackupPrivilege	4484	svchost.exe
Token: SeBackupPrivilege	4484	svchost.exe
Token: SeSecurityPrivilege	4484	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2652	2216	d4e2368a849804a0c3e1c3478e53bf15618708489085a3dd988e4c51a8f2349c.exe	81
PID 2216 wrote to memory of 2652	2216	d4e2368a849804a0c3e1c3478e53bf15618708489085a3dd988e4c51a8f2349c.exe	81
PID 2216 wrote to memory of 2652	2216	d4e2368a849804a0c3e1c3478e53bf15618708489085a3dd988e4c51a8f2349c.exe	81

C:\Users\Admin\AppData\Local\Temp\d4e2368a849804a0c3e1c3478e53bf15618708489085a3dd988e4c51a8f2349c.exe
"C:\Users\Admin\AppData\Local\Temp\d4e2368a849804a0c3e1c3478e53bf15618708489085a3dd988e4c51a8f2349c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2216
- \??\c:\users\admin\appdata\local\fnunshqpxr
  "C:\Users\Admin\AppData\Local\Temp\d4e2368a849804a0c3e1c3478e53bf15618708489085a3dd988e4c51a8f2349c.exe" a -sc:\users\admin\appdata\local\temp\d4e2368a849804a0c3e1c3478e53bf15618708489085a3dd988e4c51a8f2349c.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2652

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4232
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 936
  2⤵
  - Program crash
  PID:3700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4232 -ip 4232
1⤵
PID:4648

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 1112
  2⤵
  - Program crash
  PID:3240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 640 -ip 640
1⤵
PID:1828

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4484
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 776
  2⤵
  - Program crash
  PID:3776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 4484 -ip 4484
1⤵
PID:3600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\DRM\%SESSIONNAME%\viqxq.cc3

Filesize
20.0MB

MD5
7b5a4ceb8430577682867c694e4ccc0b

SHA1
4593ba4b80657fcfb454e843034380408e15fa6c

SHA256
90b9f05b4f356901ded384b3553653871223a91be5133ec8a127c1dd83e05399

SHA512
6096931fea4e03d462bcd621c17cb447dff0e7c2774602d5967ed3e1f2660da39318fb5c3b66664856918f97273774cc41e04acdc86c4ec6abb4ccb8a96eea2e

Download Submit
C:\ProgramData\DRM\%SESSIONNAME%\viqxq.cc3

Filesize
20.0MB

MD5
7b5a4ceb8430577682867c694e4ccc0b

SHA1
4593ba4b80657fcfb454e843034380408e15fa6c

SHA256
90b9f05b4f356901ded384b3553653871223a91be5133ec8a127c1dd83e05399

SHA512
6096931fea4e03d462bcd621c17cb447dff0e7c2774602d5967ed3e1f2660da39318fb5c3b66664856918f97273774cc41e04acdc86c4ec6abb4ccb8a96eea2e

Download Submit
C:\ProgramData\DRM\%SESSIONNAME%\viqxq.cc3

Filesize
20.0MB

MD5
7b5a4ceb8430577682867c694e4ccc0b

SHA1
4593ba4b80657fcfb454e843034380408e15fa6c

SHA256
90b9f05b4f356901ded384b3553653871223a91be5133ec8a127c1dd83e05399

SHA512
6096931fea4e03d462bcd621c17cb447dff0e7c2774602d5967ed3e1f2660da39318fb5c3b66664856918f97273774cc41e04acdc86c4ec6abb4ccb8a96eea2e

Download Submit
C:\Users\Admin\AppData\Local\fnunshqpxr

Filesize
23.0MB

MD5
e09b3d0a2a4a6f9e1760c47f6c734bd6

SHA1
cfc258e19aa72a143655e9a3c8b7c224cdfaf202

SHA256
9add47187274cf7eddfd9dfa10ee56c09cde3b46748dadbfbdd27f0607fecf58

SHA512
34097ed9d8f467100efdb306a7a65f696eeece3ccb928592c7081e67bf64198916e71fd6669861e24c9071b6935c803cf4dd7be7187ddb0125e8609b77ddcde4

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
161B

MD5
af9648c9ea164b0e8f0ddde1d7830815

SHA1
058454fcd0998f973ca922302bd7b8d39f73f1b6

SHA256
15d526fe5ff74cf5f745183ae250d5336ee6c7f16022ab65b06e8bb94082e719

SHA512
52a2ba8ac9b31547a1ee6ebbc34bbc3cfcbec96dea406fc96acc7bc7a344dcd9504b29c25c6a1ab06c1c5b5e57693152144f4ddfcb38c1b4cea0516b63a4fc94

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
304B

MD5
9ac775fc9856c3812665b7ea2a3e9e48

SHA1
22966869acc42c01fd2ad5cb486f34b32668f9db

SHA256
13d25e903983f7dfb8c06efb921e3ff4e55c9bbc3bdc26dae4c20cc6f52ad670

SHA512
56f0cda4e5e7901c3af70cb603892c1ec48368a4d1a7f5dceda9d2dfd0a28828baed912e738a91e2172b54a16cd2c4476bb81c74001ea11d9f314fc186d6ff45

Download Submit
\??\c:\programdata\drm\%sessionname%\viqxq.cc3

Filesize
20.0MB

MD5
7b5a4ceb8430577682867c694e4ccc0b

SHA1
4593ba4b80657fcfb454e843034380408e15fa6c

SHA256
90b9f05b4f356901ded384b3553653871223a91be5133ec8a127c1dd83e05399

SHA512
6096931fea4e03d462bcd621c17cb447dff0e7c2774602d5967ed3e1f2660da39318fb5c3b66664856918f97273774cc41e04acdc86c4ec6abb4ccb8a96eea2e

Download Submit
\??\c:\users\admin\appdata\local\fnunshqpxr

Filesize
23.0MB

MD5
e09b3d0a2a4a6f9e1760c47f6c734bd6

SHA1
cfc258e19aa72a143655e9a3c8b7c224cdfaf202

SHA256
9add47187274cf7eddfd9dfa10ee56c09cde3b46748dadbfbdd27f0607fecf58

SHA512
34097ed9d8f467100efdb306a7a65f696eeece3ccb928592c7081e67bf64198916e71fd6669861e24c9071b6935c803cf4dd7be7187ddb0125e8609b77ddcde4

Download Submit
memory/2216-133-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2216-134-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2216-132-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2652-142-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2652-139-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2652-138-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download