gh0strat | f839434adf175d2a555e2adf1c46c5d34a444e35d78b9ec2008e7d82e4976013

Analysis

max time kernel
187s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 04:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f839434adf175d2a555e2adf1c46c5d34a444e35d78b9ec2008e7d82e4976013.exe
Size

73KB
MD5

22c41b7f6097a2ebd7d98b51ed8eb476
SHA1

696651a10bb922e4ff3cda08879a9789e79f2fb1
SHA256

f839434adf175d2a555e2adf1c46c5d34a444e35d78b9ec2008e7d82e4976013
SHA512

05ceca6abd4928f0dfdb189dcc33df171afb248bfa02be4299862608ea9b279c38c70bdec68a2c5ea593c3a66c4bb443e7198a7313ce1cfe8bfcefde289ecadb
SSDEEP

1536:pZm8hEnrtUqKpriZVLnocQ67frP8Q18sQn7jt7D:28hEnRUZrMLnoT6LrP828sQn7jt7D

Score

10^/10

gh0strat persistence rat

Malware Config

Signatures

Gh0st RAT payload 3 IoCs

resource	yara_rule
behavioral2/files/0x0008000000022e5b-132.dat	family_gh0strat
behavioral2/files/0x0008000000022e5b-133.dat	family_gh0strat
behavioral2/files/0x0008000000022e5b-135.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Blocklisted process makes network request 1 IoCs

flow	pid	Process
15	4760	rundll32.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.Net CLR\Parameters\ServiceDll = "C:\\Windows\\system32\\AirCmd.dll"	f839434adf175d2a555e2adf1c46c5d34a444e35d78b9ec2008e7d82e4976013.exe

Loads dropped DLL 2 IoCs

pid	Process
3816	svchost.exe
4760	rundll32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\AirCmd.dll	f839434adf175d2a555e2adf1c46c5d34a444e35d78b9ec2008e7d82e4976013.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3816	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3816 wrote to memory of 4760	3816	svchost.exe	80
PID 3816 wrote to memory of 4760	3816	svchost.exe	80
PID 3816 wrote to memory of 4760	3816	svchost.exe	80

C:\Users\Admin\AppData\Local\Temp\f839434adf175d2a555e2adf1c46c5d34a444e35d78b9ec2008e7d82e4976013.exe
"C:\Users\Admin\AppData\Local\Temp\f839434adf175d2a555e2adf1c46c5d34a444e35d78b9ec2008e7d82e4976013.exe"
1⤵
- Sets DLL path for service in the registry
- Drops file in System32 directory
PID:5064

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe c:\windows\system32\aircmd.dll, kongqiwin7 .Net CLR
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:4760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\AirCmd.dll

Filesize
65KB

MD5
2609e8dae402d982e7a6f0664416e48b

SHA1
49c4315ab9fdcea15338a51e0b3f91b13f6a3cc8

SHA256
f226782d43c11cd708d9132e2bba9aff51889d719f771f71dc028cb1193dadbb

SHA512
1d45f92b26fe89ad8288dc60e018c0551c2d3ce4f225ddd8ccb6064e5c12ca0674c64382daa3b4aa8af84147dd47acb6e0fe358ff578c4a80cc8adeb9a306422

Download Submit
C:\Windows\SysWOW64\AirCmd.dll

Filesize
65KB

MD5
2609e8dae402d982e7a6f0664416e48b

SHA1
49c4315ab9fdcea15338a51e0b3f91b13f6a3cc8

SHA256
f226782d43c11cd708d9132e2bba9aff51889d719f771f71dc028cb1193dadbb

SHA512
1d45f92b26fe89ad8288dc60e018c0551c2d3ce4f225ddd8ccb6064e5c12ca0674c64382daa3b4aa8af84147dd47acb6e0fe358ff578c4a80cc8adeb9a306422

Download Submit
\??\c:\windows\SysWOW64\aircmd.dll

Filesize
65KB

MD5
2609e8dae402d982e7a6f0664416e48b

SHA1
49c4315ab9fdcea15338a51e0b3f91b13f6a3cc8

SHA256
f226782d43c11cd708d9132e2bba9aff51889d719f771f71dc028cb1193dadbb

SHA512
1d45f92b26fe89ad8288dc60e018c0551c2d3ce4f225ddd8ccb6064e5c12ca0674c64382daa3b4aa8af84147dd47acb6e0fe358ff578c4a80cc8adeb9a306422

Download Submit