gh0strat | cb2e5d88032f1a8b32f7f7050335580e0af9d6d18b83fc709ee9ebaf22f3c45a

Analysis

max time kernel
130s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 07:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cb2e5d88032f1a8b32f7f7050335580e0af9d6d18b83fc709ee9ebaf22f3c45a.exe
Size

97KB
MD5

113b5c541bc1b23f3a34f88b546b4deb
SHA1

bc79538a2d97781a8a6cfa62ce1ff58d23bdbe09
SHA256

cb2e5d88032f1a8b32f7f7050335580e0af9d6d18b83fc709ee9ebaf22f3c45a
SHA512

51ae733cbc6ee0975dee75652117ffc0bc4f2ac4d558aec79e55db92756b631aca7f05f0a10af856ad602cb5664b1acf28cc3bb3432c36da5140679ea317d43b
SSDEEP

1536:90FusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prK2mVEhS:9GS4jHS8q/3nTzePCwNUh4E9hor

Score

10^/10

gh0strat rat

Malware Config

Signatures

Gh0st RAT payload 5 IoCs

resource	yara_rule
behavioral2/files/0x000900000001dab1-138.dat	family_gh0strat
behavioral2/files/0x000900000001dab1-139.dat	family_gh0strat
behavioral2/memory/2380-140-0x0000000000400000-0x000000000044E2DC-memory.dmp	family_gh0strat
behavioral2/files/0x000900000001dab1-141.dat	family_gh0strat
behavioral2/files/0x000900000001dab1-143.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Executes dropped EXE 1 IoCs

pid	Process
2380	erkxhkwcig

Loads dropped DLL 3 IoCs

pid	Process
4532	svchost.exe
4592	svchost.exe
4060	svchost.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{E3047C90-A620-41FA-98BA-E89930A13EB1}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{498BFD36-C37C-4ABB-87BE-1D6FB569A6C6}.catalogItem	svchost.exe
File created	C:\Windows\SysWOW64\ppgaqdqhst	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\pgyrfsdvgv	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\pgpweckoth	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4056	4532	WerFault.exe	84
3236	4592	WerFault.exe	90
2948	4060	WerFault.exe	93

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2380	erkxhkwcig
2380	erkxhkwcig

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeRestorePrivilege	2380	erkxhkwcig
Token: SeBackupPrivilege	2380	erkxhkwcig
Token: SeBackupPrivilege	2380	erkxhkwcig
Token: SeRestorePrivilege	2380	erkxhkwcig
Token: SeBackupPrivilege	4532	svchost.exe
Token: SeRestorePrivilege	4532	svchost.exe
Token: SeBackupPrivilege	4532	svchost.exe
Token: SeBackupPrivilege	4532	svchost.exe
Token: SeSecurityPrivilege	4532	svchost.exe
Token: SeSecurityPrivilege	4532	svchost.exe
Token: SeBackupPrivilege	4532	svchost.exe
Token: SeBackupPrivilege	4532	svchost.exe
Token: SeSecurityPrivilege	4532	svchost.exe
Token: SeBackupPrivilege	4532	svchost.exe
Token: SeBackupPrivilege	4532	svchost.exe
Token: SeSecurityPrivilege	4532	svchost.exe
Token: SeBackupPrivilege	4532	svchost.exe
Token: SeRestorePrivilege	4532	svchost.exe
Token: SeBackupPrivilege	4592	svchost.exe
Token: SeRestorePrivilege	4592	svchost.exe
Token: SeBackupPrivilege	4592	svchost.exe
Token: SeBackupPrivilege	4592	svchost.exe
Token: SeSecurityPrivilege	4592	svchost.exe
Token: SeSecurityPrivilege	4592	svchost.exe
Token: SeBackupPrivilege	4592	svchost.exe
Token: SeBackupPrivilege	4592	svchost.exe
Token: SeSecurityPrivilege	4592	svchost.exe
Token: SeBackupPrivilege	4592	svchost.exe
Token: SeBackupPrivilege	4592	svchost.exe
Token: SeSecurityPrivilege	4592	svchost.exe
Token: SeBackupPrivilege	4592	svchost.exe
Token: SeRestorePrivilege	4592	svchost.exe
Token: SeBackupPrivilege	4060	svchost.exe
Token: SeRestorePrivilege	4060	svchost.exe
Token: SeBackupPrivilege	4060	svchost.exe
Token: SeBackupPrivilege	4060	svchost.exe
Token: SeSecurityPrivilege	4060	svchost.exe
Token: SeSecurityPrivilege	4060	svchost.exe
Token: SeBackupPrivilege	4060	svchost.exe
Token: SeBackupPrivilege	4060	svchost.exe
Token: SeSecurityPrivilege	4060	svchost.exe
Token: SeBackupPrivilege	4060	svchost.exe
Token: SeBackupPrivilege	4060	svchost.exe
Token: SeSecurityPrivilege	4060	svchost.exe
Token: SeBackupPrivilege	4060	svchost.exe
Token: SeRestorePrivilege	4060	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2380	2228	cb2e5d88032f1a8b32f7f7050335580e0af9d6d18b83fc709ee9ebaf22f3c45a.exe	75
PID 2228 wrote to memory of 2380	2228	cb2e5d88032f1a8b32f7f7050335580e0af9d6d18b83fc709ee9ebaf22f3c45a.exe	75
PID 2228 wrote to memory of 2380	2228	cb2e5d88032f1a8b32f7f7050335580e0af9d6d18b83fc709ee9ebaf22f3c45a.exe	75

C:\Users\Admin\AppData\Local\Temp\cb2e5d88032f1a8b32f7f7050335580e0af9d6d18b83fc709ee9ebaf22f3c45a.exe
"C:\Users\Admin\AppData\Local\Temp\cb2e5d88032f1a8b32f7f7050335580e0af9d6d18b83fc709ee9ebaf22f3c45a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2228
- \??\c:\users\admin\appdata\local\erkxhkwcig
  "C:\Users\Admin\AppData\Local\Temp\cb2e5d88032f1a8b32f7f7050335580e0af9d6d18b83fc709ee9ebaf22f3c45a.exe" a -sc:\users\admin\appdata\local\temp\cb2e5d88032f1a8b32f7f7050335580e0af9d6d18b83fc709ee9ebaf22f3c45a.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2380

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:400

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4532
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 788
  2⤵
  - Program crash
  PID:4056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4532 -ip 4532
1⤵
PID:460

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4592
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4592 -s 940
  2⤵
  - Program crash
  PID:3236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4592 -ip 4592
1⤵
PID:3088

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 896
  2⤵
  - Program crash
  PID:2948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4060 -ip 4060
1⤵
PID:1480

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Storm\update\%SESSIONNAME%\pqkcy.cc3

Filesize
22.1MB

MD5
8184d3eec9f9e092495ef658ae581820

SHA1
4105fcefd64e9af94438e374981c20f8ba1a2c12

SHA256
e916ae595dfa44a63dba37775c2040d76e4fe973958c7f6f0bdebc7d7860d1e2

SHA512
258bf8eacee20fe65bd1a902a2b5dc68eb1e7891bea3d7251f6f15de2c8aaac879414fad710fdcc242eb47715174c09a93e91d03f282d856975370ea87194830

Download Submit
C:\ProgramData\Storm\update\%SESSIONNAME%\pqkcy.cc3

Filesize
22.1MB

MD5
8184d3eec9f9e092495ef658ae581820

SHA1
4105fcefd64e9af94438e374981c20f8ba1a2c12

SHA256
e916ae595dfa44a63dba37775c2040d76e4fe973958c7f6f0bdebc7d7860d1e2

SHA512
258bf8eacee20fe65bd1a902a2b5dc68eb1e7891bea3d7251f6f15de2c8aaac879414fad710fdcc242eb47715174c09a93e91d03f282d856975370ea87194830

Download Submit
C:\ProgramData\Storm\update\%SESSIONNAME%\pqkcy.cc3

Filesize
22.1MB

MD5
8184d3eec9f9e092495ef658ae581820

SHA1
4105fcefd64e9af94438e374981c20f8ba1a2c12

SHA256
e916ae595dfa44a63dba37775c2040d76e4fe973958c7f6f0bdebc7d7860d1e2

SHA512
258bf8eacee20fe65bd1a902a2b5dc68eb1e7891bea3d7251f6f15de2c8aaac879414fad710fdcc242eb47715174c09a93e91d03f282d856975370ea87194830

Download Submit
C:\Users\Admin\AppData\Local\erkxhkwcig

Filesize
22.2MB

MD5
5f21e35b5576154c7c388f90ce469d77

SHA1
c31803be6b9f0d95663efd4ab842917b47ea829c

SHA256
52fe454db734e3b213042aee204eedb98246ff9c80597c4ac4c5783effdb3f51

SHA512
48900c0474301f448239f8e817c0823f009882ce86c0439576bf845caf3f65bd62acc50376ec70f701c77fe76b6f8c24237093854d6068dd03b192e55e58dc07

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
202B

MD5
259ff0d4a6bfe3c0f530370908c398b2

SHA1
9a24e6bca29d0e84d9e680ffbd34132509a8971d

SHA256
8a5705e1397b252470a972e5511d87d7c4c352ff5a42df11b3462dca19e03deb

SHA512
0bb5c0f7352ea3be0aa2fe4014c9ac6705850f25ca184c5278e04f254d825ba462e9be59b5f0e0244ea01f99dfeaee3b66c6cf3496dbe069388e002aebf048f4

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
303B

MD5
999c027fb1c97412bdf68b82f131642e

SHA1
493391c9796cd56fc22b5d693e0a75123a039e1b

SHA256
be406b439d13ee1523f0d8e97f0d9df1e26e186215c6f9bb2d566b6bf20dbc36

SHA512
46b1d79e87d9146f6656c0ade3b0c9a3fbf332d369aad99b51440c797750b782ca64d2f0b4fe8481c9305e17f947180ba86ce363b677be313f5d313808c59dbd

Download Submit
\??\c:\programdata\application data\storm\update\%sessionname%\pqkcy.cc3

Filesize
22.1MB

MD5
8184d3eec9f9e092495ef658ae581820

SHA1
4105fcefd64e9af94438e374981c20f8ba1a2c12

SHA256
e916ae595dfa44a63dba37775c2040d76e4fe973958c7f6f0bdebc7d7860d1e2

SHA512
258bf8eacee20fe65bd1a902a2b5dc68eb1e7891bea3d7251f6f15de2c8aaac879414fad710fdcc242eb47715174c09a93e91d03f282d856975370ea87194830

Download Submit
\??\c:\users\admin\appdata\local\erkxhkwcig

Filesize
22.2MB

MD5
5f21e35b5576154c7c388f90ce469d77

SHA1
c31803be6b9f0d95663efd4ab842917b47ea829c

SHA256
52fe454db734e3b213042aee204eedb98246ff9c80597c4ac4c5783effdb3f51

SHA512
48900c0474301f448239f8e817c0823f009882ce86c0439576bf845caf3f65bd62acc50376ec70f701c77fe76b6f8c24237093854d6068dd03b192e55e58dc07

Download Submit
memory/2228-132-0x0000000000400000-0x000000000044E2DC-memory.dmp

Filesize
312KB

Download
memory/2228-135-0x0000000000400000-0x000000000044E2DC-memory.dmp

Filesize
312KB

Download
memory/2380-140-0x0000000000400000-0x000000000044E2DC-memory.dmp

Filesize
312KB

Download
memory/2380-137-0x0000000000400000-0x000000000044E2DC-memory.dmp

Filesize
312KB

Download