gh0strat | 18197dcff54112f37c0917fc3c33ccc82fcadf7c7cb3b735b4e5e9a3b8cd2e3d

General

Target

18197dcff54112f37c0917fc3c33ccc82fcadf7c7cb3b735b4e5e9a3b8cd2e3d.exe
Size

133KB
MD5

4f9aeb9a6e05b7979cb0fad254da6df6
SHA1

907b2001d213a0b657821c4cb9257e4d851fcf61
SHA256

18197dcff54112f37c0917fc3c33ccc82fcadf7c7cb3b735b4e5e9a3b8cd2e3d
SHA512

38f73e0a67bb53accff779cb0d89d24d80d589723e2200ecd3819c8e6d9f468bf4256bdb05b661ecfc769e2770e9475d710f3fa38e0205afbba5fdcc8d952ec0
SSDEEP

3072:wgd4UOCGh9eqkQ9DM3Zxpdhj/W7j7FCw4nNooBzmAw8zfXyhDw:wORfa9gBQAw47BSEzfXKE

Score

10^/10

gh0strat rat

Malware Config

Signatures

Gh0st RAT payload 3 IoCs

resource	yara_rule
behavioral2/memory/4380-132-0x0000000000400000-0x0000000000423000-memory.dmp	family_gh0strat
behavioral2/files/0x0006000000022e69-136.dat	family_gh0strat
behavioral2/memory/4924-137-0x0000000000400000-0x0000000000423000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Executes dropped EXE 1 IoCs

pid	Process
4924	svchost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\svchost.exe	18197dcff54112f37c0917fc3c33ccc82fcadf7c7cb3b735b4e5e9a3b8cd2e3d.exe
File opened for modification	C:\WINDOWS\svchost.exe	svchost.exe

Modifies data under HKEY_USERS 25 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	wscript.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{596AB062-B4D2-4215-9F74-E9109B0A8153} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 01000000000000003fc9fa154de5d801	scrcons.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1D27F844-3A1F-4410-85AC-14651078412D} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 010000000000000036f120164de5d801	scrcons.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	scrcons.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{23170F69-40C1-278A-1000-000100020000} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000d00415164de5d801	scrcons.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	scrcons.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	scrcons.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\JITDebug = "0"	scrcons.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{474C98EE-CF3D-41F5-80E3-4AAB0AB04301} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000562bfd154de5d801	scrcons.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2BF9676-5F8F-435C-97EB-11607A5BEDF7} {A08CE4D0-FA25-44AB-B57C-C7B1C323E0B9} 0xFFFF = 0100000000000000503d10164de5d801	scrcons.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\SlowContextMenuEntries = 6024b221ea3a6910a2dc08002b30309d7d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	scrcons.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	scrcons.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	wscript.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81E9010-6EA4-11CE-A7FF-00AA003CA9F6} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 01000000000000001c790b164de5d801	scrcons.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{99D353BC-C813-41EC-8F28-EAE61E702E57} {A08CE4D0-FA25-44AB-B57C-C7B1C323E0B9} 0xFFFF = 01000000000000001c790b164de5d801	scrcons.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2BF9676-5F8F-435C-97EB-11607A5BEDF7} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 01000000000000005eda0d164de5d801	scrcons.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{470C0EBD-5D73-4D58-9CED-E91E22E23282} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 010000000000000070901e164de5d801	scrcons.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	scrcons.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	scrcons.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings	scrcons.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	scrcons.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E61BF828-5E63-4287-BEF1-60B1A4FDE0E3} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000b41b09164de5d801	scrcons.exe

Suspicious behavior: RenamesItself 2 IoCs

pid	Process
4380	18197dcff54112f37c0917fc3c33ccc82fcadf7c7cb3b735b4e5e9a3b8cd2e3d.exe
4924	svchost.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 5100	4380	18197dcff54112f37c0917fc3c33ccc82fcadf7c7cb3b735b4e5e9a3b8cd2e3d.exe	82
PID 4380 wrote to memory of 5100	4380	18197dcff54112f37c0917fc3c33ccc82fcadf7c7cb3b735b4e5e9a3b8cd2e3d.exe	82
PID 4380 wrote to memory of 5100	4380	18197dcff54112f37c0917fc3c33ccc82fcadf7c7cb3b735b4e5e9a3b8cd2e3d.exe	82
PID 4144 wrote to memory of 4924	4144	scrcons.exe	91
PID 4144 wrote to memory of 4924	4144	scrcons.exe	91
PID 4144 wrote to memory of 4924	4144	scrcons.exe	91
PID 4924 wrote to memory of 3984	4924	svchost.exe	92
PID 4924 wrote to memory of 3984	4924	svchost.exe	92
PID 4924 wrote to memory of 3984	4924	svchost.exe	92

C:\Users\Admin\AppData\Local\Temp\18197dcff54112f37c0917fc3c33ccc82fcadf7c7cb3b735b4e5e9a3b8cd2e3d.exe
"C:\Users\Admin\AppData\Local\Temp\18197dcff54112f37c0917fc3c33ccc82fcadf7c7cb3b735b4e5e9a3b8cd2e3d.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\system32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\uszlafach.vbs" //B //Nologo
  2⤵
  PID:5100

C:\Windows\system32\wbem\scrcons.exe
C:\Windows\system32\wbem\scrcons.exe -Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4144
- C:\WINDOWS\svchost.exe
  "C:\WINDOWS\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:4924
- - C:\Windows\SysWOW64\wscript.exe
    "C:\Windows\system32\wscript.exe" "C:\Windows\TEMP\marjbxzrmv.vbs" //B //Nologo
    3⤵
    - Modifies data under HKEY_USERS
    PID:3984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\uszlafach.vbs

Filesize
1KB

MD5
b8f409f181634e11b66d599fc87a4b3a

SHA1
27944003671d53684adcfb48c9487793384f7ebb

SHA256
df79f53aec056ce4bbaafcb60a3dc5710337ec49f509b8faca86781d2dc267ae

SHA512
65dd9149e9e6ec0c0703ffb8142e18ded14f7d9b91a22789a9ce9b2bd68855ad027b9275ff9d2294d3757306a6e5945164d9d7f42eeb4eb73c8ca0ec60291b6a

Download Submit
C:\Windows\TEMP\marjbxzrmv.vbs

Filesize
1KB

MD5
b8f409f181634e11b66d599fc87a4b3a

SHA1
27944003671d53684adcfb48c9487793384f7ebb

SHA256
df79f53aec056ce4bbaafcb60a3dc5710337ec49f509b8faca86781d2dc267ae

SHA512
65dd9149e9e6ec0c0703ffb8142e18ded14f7d9b91a22789a9ce9b2bd68855ad027b9275ff9d2294d3757306a6e5945164d9d7f42eeb4eb73c8ca0ec60291b6a

Download Submit
C:\Windows\svchost.exe

Filesize
133KB

MD5
4f9aeb9a6e05b7979cb0fad254da6df6

SHA1
907b2001d213a0b657821c4cb9257e4d851fcf61

SHA256
18197dcff54112f37c0917fc3c33ccc82fcadf7c7cb3b735b4e5e9a3b8cd2e3d

SHA512
38f73e0a67bb53accff779cb0d89d24d80d589723e2200ecd3819c8e6d9f468bf4256bdb05b661ecfc769e2770e9475d710f3fa38e0205afbba5fdcc8d952ec0

Download Submit
memory/3984-138-0x0000000000000000-mapping.dmp

Download
memory/4380-132-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4924-135-0x0000000000000000-mapping.dmp

Download
memory/4924-137-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/5100-133-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing