gh0strat | 4809eb31780117099ca2c2672571db362cd589a74a29d1b6bc08f7780053c15c

General

Target

4809eb31780117099ca2c2672571db362cd589a74a29d1b6bc08f7780053c15c.exe
Size

754KB
MD5

82abb62490052752f815c104af6d63e2
SHA1

051f8f8f421c988375305a445c737b587c7c5535
SHA256

4809eb31780117099ca2c2672571db362cd589a74a29d1b6bc08f7780053c15c
SHA512

8f492bf54dca92e5ff893f42c9f0a73583620092972264f5bd1c0a753f8e96d5d28dfb4c44feeeef296bc2ab4c94d99ba17c586f0a3aa28ace07332fcdc8b13e
SSDEEP

12288:qZ9V/Vw4Zc6bjcCPkLU3DcEMbIKOPBhIfnrJYXMcQ/BYfUocX5AsCes5OFlZboZQ:qvV/nc6sSko3DcfIKOJh+n9Y05gUocpi

Score

10^/10

gh0strat evasion persistence rat themida

Malware Config

Signatures

Gh0st RAT payload 3 IoCs

resource	yara_rule
behavioral1/memory/1596-58-0x0000000000400000-0x000000000059B000-memory.dmp	family_gh0strat
behavioral1/files/0x00140000000054ab-59.dat	family_gh0strat
behavioral1/files/0x00140000000054ab-60.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Modifies Installed Components in the registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{d6omds2q-okcx-tdqe-jcwu-a4gi0z0e3iwp}\stubpath = "þÿÿÿX"	userinit.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{d6omds2q-okcx-tdqe-jcwu-a4gi0z0e3iwp}	userinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{d6omds2q-okcx-tdqe-jcwu-a4gi0z0e3iwp}\ = "ÏµÍ³ÉèÖÃ"	userinit.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Wine	4809eb31780117099ca2c2672571db362cd589a74a29d1b6bc08f7780053c15c.exe

Loads dropped DLL 1 IoCs

pid	Process
2040	userinit.exe

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/1596-58-0x0000000000400000-0x000000000059B000-memory.dmp	themida

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1596	4809eb31780117099ca2c2672571db362cd589a74a29d1b6bc08f7780053c15c.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1596	4809eb31780117099ca2c2672571db362cd589a74a29d1b6bc08f7780053c15c.exe
1596	4809eb31780117099ca2c2672571db362cd589a74a29d1b6bc08f7780053c15c.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1596	4809eb31780117099ca2c2672571db362cd589a74a29d1b6bc08f7780053c15c.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 2040	1596	4809eb31780117099ca2c2672571db362cd589a74a29d1b6bc08f7780053c15c.exe	27
PID 1596 wrote to memory of 2040	1596	4809eb31780117099ca2c2672571db362cd589a74a29d1b6bc08f7780053c15c.exe	27
PID 1596 wrote to memory of 2040	1596	4809eb31780117099ca2c2672571db362cd589a74a29d1b6bc08f7780053c15c.exe	27
PID 1596 wrote to memory of 2040	1596	4809eb31780117099ca2c2672571db362cd589a74a29d1b6bc08f7780053c15c.exe	27
PID 1596 wrote to memory of 2040	1596	4809eb31780117099ca2c2672571db362cd589a74a29d1b6bc08f7780053c15c.exe	27
PID 1596 wrote to memory of 2040	1596	4809eb31780117099ca2c2672571db362cd589a74a29d1b6bc08f7780053c15c.exe	27
PID 1596 wrote to memory of 2040	1596	4809eb31780117099ca2c2672571db362cd589a74a29d1b6bc08f7780053c15c.exe	27
PID 1596 wrote to memory of 2040	1596	4809eb31780117099ca2c2672571db362cd589a74a29d1b6bc08f7780053c15c.exe	27

C:\Users\Admin\AppData\Local\Temp\4809eb31780117099ca2c2672571db362cd589a74a29d1b6bc08f7780053c15c.exe
"C:\Users\Admin\AppData\Local\Temp\4809eb31780117099ca2c2672571db362cd589a74a29d1b6bc08f7780053c15c.exe"
1⤵
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Windows\SysWOW64\userinit.exe
  userinit.exe
  2⤵
  - Modifies Installed Components in the registry
  - Loads dropped DLL
  PID:2040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

1

T1012

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7081790_lang.dll

Filesize
114KB

MD5
c73df762965b58faadcb0db875ffe662

SHA1
82e72b60dec32ba6f8636485d58be11610d9b140

SHA256
00673e9b0d5a5a8920363b847a42d4e0e9e9fa9deddfaf0aa9117b9b92968cbc

SHA512
78e0ccce88b3673d825544cf764e576551d946ea4955f6003ac5fee26d819511fb2d1341469f81525823c7627ceb97970823f47521d08cf261cf9abb268557fc

Download Submit
\Users\Admin\AppData\Local\Temp\7081790_lang.dll

Filesize
114KB

MD5
c73df762965b58faadcb0db875ffe662

SHA1
82e72b60dec32ba6f8636485d58be11610d9b140

SHA256
00673e9b0d5a5a8920363b847a42d4e0e9e9fa9deddfaf0aa9117b9b92968cbc

SHA512
78e0ccce88b3673d825544cf764e576551d946ea4955f6003ac5fee26d819511fb2d1341469f81525823c7627ceb97970823f47521d08cf261cf9abb268557fc

Download Submit
memory/1596-54-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download
memory/1596-57-0x0000000000B10000-0x0000000000CAB000-memory.dmp

Filesize
1.6MB

Download
memory/1596-58-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads