gh0strat | 0c36d1425d56c6429df3b4a31490f0e246ff17cf38b2196180c293a916dfb536

Analysis

max time kernel
173s
max time network
217s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 09:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c36d1425d56c6429df3b4a31490f0e246ff17cf38b2196180c293a916dfb536.exe
Size

96KB
MD5

209bad0e623e0ef809563c851005f298
SHA1

498c4ec29c64c62c7eeb4c8a5b82df795d6a5909
SHA256

0c36d1425d56c6429df3b4a31490f0e246ff17cf38b2196180c293a916dfb536
SHA512

86bfb1905a6859431b88213ae6099f526cfedc362ae65c1c679ccffeceffbd8cbb6ede8fa7bbef18b0a6d2c041871260abf00e2316e182f675344cbabd1d1c22
SSDEEP

1536:CMFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prRmw2tRs/yn:CeS4jHS8q/3nTzePCwNUh4E9Rmw2Qyn

Score

10^/10

gh0strat rat

Malware Config

Signatures

Gh0st RAT payload 6 IoCs

resource	yara_rule
behavioral2/files/0x000400000000072b-138.dat	family_gh0strat
behavioral2/files/0x000400000000072b-139.dat	family_gh0strat
behavioral2/files/0x000400000000072b-140.dat	family_gh0strat
behavioral2/memory/2728-141-0x0000000000400000-0x000000000044E34C-memory.dmp	family_gh0strat
behavioral2/files/0x000400000000072b-143.dat	family_gh0strat
behavioral2/files/0x000400000000072b-145.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Executes dropped EXE 1 IoCs

pid	Process
2728	dedcisjxuu

Loads dropped DLL 4 IoCs

pid	Process
1512	svchost.exe
4124	svchost.exe
3652	svchost.exe
3428	svchost.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sketdgmtij	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\sbwlrvyivl	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\ssrmljoqvf	svchost.exe
File created	C:\Windows\SysWOW64\sbggtmqoia	svchost.exe
File created	C:\Windows\SysWOW64\sanqqfgbjw	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
4148	1512	WerFault.exe	80
2360	4124	WerFault.exe	81
4820	3652	WerFault.exe	87
2100	3428	WerFault.exe	90

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2728	dedcisjxuu
2728	dedcisjxuu

Suspicious use of AdjustPrivilegeToken 58 IoCs

description	pid	Process
Token: SeRestorePrivilege	2728	dedcisjxuu
Token: SeBackupPrivilege	2728	dedcisjxuu
Token: SeBackupPrivilege	2728	dedcisjxuu
Token: SeRestorePrivilege	2728	dedcisjxuu
Token: SeRestorePrivilege	2728	dedcisjxuu
Token: SeBackupPrivilege	2728	dedcisjxuu
Token: SeBackupPrivilege	2728	dedcisjxuu
Token: SeRestorePrivilege	2728	dedcisjxuu
Token: SeBackupPrivilege	1512	svchost.exe
Token: SeRestorePrivilege	1512	svchost.exe
Token: SeBackupPrivilege	1512	svchost.exe
Token: SeBackupPrivilege	1512	svchost.exe
Token: SeSecurityPrivilege	1512	svchost.exe
Token: SeSecurityPrivilege	1512	svchost.exe
Token: SeBackupPrivilege	1512	svchost.exe
Token: SeBackupPrivilege	1512	svchost.exe
Token: SeSecurityPrivilege	1512	svchost.exe
Token: SeBackupPrivilege	1512	svchost.exe
Token: SeBackupPrivilege	1512	svchost.exe
Token: SeSecurityPrivilege	1512	svchost.exe
Token: SeBackupPrivilege	1512	svchost.exe
Token: SeRestorePrivilege	1512	svchost.exe
Token: SeBackupPrivilege	1512	svchost.exe
Token: SeRestorePrivilege	1512	svchost.exe
Token: SeBackupPrivilege	1512	svchost.exe
Token: SeRestorePrivilege	1512	svchost.exe
Token: SeBackupPrivilege	1512	svchost.exe
Token: SeRestorePrivilege	1512	svchost.exe
Token: SeBackupPrivilege	4124	svchost.exe
Token: SeRestorePrivilege	4124	svchost.exe
Token: SeBackupPrivilege	4124	svchost.exe
Token: SeBackupPrivilege	4124	svchost.exe
Token: SeSecurityPrivilege	4124	svchost.exe
Token: SeSecurityPrivilege	4124	svchost.exe
Token: SeBackupPrivilege	4124	svchost.exe
Token: SeBackupPrivilege	4124	svchost.exe
Token: SeSecurityPrivilege	4124	svchost.exe
Token: SeBackupPrivilege	4124	svchost.exe
Token: SeBackupPrivilege	4124	svchost.exe
Token: SeSecurityPrivilege	4124	svchost.exe
Token: SeBackupPrivilege	4124	svchost.exe
Token: SeRestorePrivilege	4124	svchost.exe
Token: SeBackupPrivilege	3652	svchost.exe
Token: SeRestorePrivilege	3652	svchost.exe
Token: SeBackupPrivilege	3652	svchost.exe
Token: SeBackupPrivilege	3652	svchost.exe
Token: SeSecurityPrivilege	3652	svchost.exe
Token: SeSecurityPrivilege	3652	svchost.exe
Token: SeBackupPrivilege	3652	svchost.exe
Token: SeBackupPrivilege	3652	svchost.exe
Token: SeSecurityPrivilege	3652	svchost.exe
Token: SeBackupPrivilege	3652	svchost.exe
Token: SeBackupPrivilege	3652	svchost.exe
Token: SeSecurityPrivilege	3652	svchost.exe
Token: SeBackupPrivilege	3652	svchost.exe
Token: SeRestorePrivilege	3652	svchost.exe
Token: SeBackupPrivilege	3428	svchost.exe
Token: SeRestorePrivilege	3428	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 2728	1904	0c36d1425d56c6429df3b4a31490f0e246ff17cf38b2196180c293a916dfb536.exe	79
PID 1904 wrote to memory of 2728	1904	0c36d1425d56c6429df3b4a31490f0e246ff17cf38b2196180c293a916dfb536.exe	79
PID 1904 wrote to memory of 2728	1904	0c36d1425d56c6429df3b4a31490f0e246ff17cf38b2196180c293a916dfb536.exe	79

C:\Users\Admin\AppData\Local\Temp\0c36d1425d56c6429df3b4a31490f0e246ff17cf38b2196180c293a916dfb536.exe
"C:\Users\Admin\AppData\Local\Temp\0c36d1425d56c6429df3b4a31490f0e246ff17cf38b2196180c293a916dfb536.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1904
- \??\c:\users\admin\appdata\local\dedcisjxuu
  "C:\Users\Admin\AppData\Local\Temp\0c36d1425d56c6429df3b4a31490f0e246ff17cf38b2196180c293a916dfb536.exe" a -sc:\users\admin\appdata\local\temp\0c36d1425d56c6429df3b4a31490f0e246ff17cf38b2196180c293a916dfb536.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2728

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 864
  2⤵
  - Program crash
  PID:4148

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s ias
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4124
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 824
  2⤵
  - Program crash
  PID:2360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1512 -ip 1512
1⤵
PID:3628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4124 -ip 4124
1⤵
PID:2004

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s ias
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3652
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3652 -s 1116
  2⤵
  - Program crash
  PID:4820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3652 -ip 3652
1⤵
PID:4132

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s ias
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3428
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3428 -s 1096
  2⤵
  - Program crash
  PID:2100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3428 -ip 3428
1⤵
PID:4644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Storm\update\%SESSIONNAME%\omsuy.cc3

Filesize
22.0MB

MD5
84dd440efa8109fca360720a0cd15d50

SHA1
cff4b212c5533fdc4864ff1c95d18b80a0dc356a

SHA256
5e6675916a2aff24d0314db07d73f70585701d24e15afa22bba5a064ee8b4172

SHA512
d60eef5e57ff6ecf6cfb57485b6e39e9d5ed1f3f1f4967012405d572e8a7d8528d972592cc86d2e85cf62e50ac20c40024960618b42b5b575956f3d6e989ed43

Download Submit
C:\ProgramData\Storm\update\%SESSIONNAME%\omsuy.cc3

Filesize
22.0MB

MD5
84dd440efa8109fca360720a0cd15d50

SHA1
cff4b212c5533fdc4864ff1c95d18b80a0dc356a

SHA256
5e6675916a2aff24d0314db07d73f70585701d24e15afa22bba5a064ee8b4172

SHA512
d60eef5e57ff6ecf6cfb57485b6e39e9d5ed1f3f1f4967012405d572e8a7d8528d972592cc86d2e85cf62e50ac20c40024960618b42b5b575956f3d6e989ed43

Download Submit
C:\ProgramData\Storm\update\%SESSIONNAME%\omsuy.cc3

Filesize
22.0MB

MD5
84dd440efa8109fca360720a0cd15d50

SHA1
cff4b212c5533fdc4864ff1c95d18b80a0dc356a

SHA256
5e6675916a2aff24d0314db07d73f70585701d24e15afa22bba5a064ee8b4172

SHA512
d60eef5e57ff6ecf6cfb57485b6e39e9d5ed1f3f1f4967012405d572e8a7d8528d972592cc86d2e85cf62e50ac20c40024960618b42b5b575956f3d6e989ed43

Download Submit
C:\ProgramData\Storm\update\%SESSIONNAME%\omsuy.cc3

Filesize
22.0MB

MD5
84dd440efa8109fca360720a0cd15d50

SHA1
cff4b212c5533fdc4864ff1c95d18b80a0dc356a

SHA256
5e6675916a2aff24d0314db07d73f70585701d24e15afa22bba5a064ee8b4172

SHA512
d60eef5e57ff6ecf6cfb57485b6e39e9d5ed1f3f1f4967012405d572e8a7d8528d972592cc86d2e85cf62e50ac20c40024960618b42b5b575956f3d6e989ed43

Download Submit
C:\Users\Admin\AppData\Local\dedcisjxuu

Filesize
23.7MB

MD5
b129ade0abb927989b5f7fdb238a9a67

SHA1
084a8c7db21629d592ff388611e3b76685e47565

SHA256
a55d1941072ad136d9b68ceea1f359904587f77e976c1f530b831f7c5ec96c01

SHA512
10e416e409a96c4c77094c1dcd9786ca4aeac6e65532092eb5210fa3a135e86da3f325e9747edac63af26ebb586e10951e70d7128e21a011867d5668ec054a61

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
204B

MD5
d328a9f273d6780312ea3da045ecaa01

SHA1
8b96029d982cb38442482c841529fa4283206991

SHA256
d435536b7473f6ab5ebbcf06aee01bb332e182bf34b692891fabfbeb9621b0b8

SHA512
28e31504bbf4f2722ae70d803e0877e7fa2cafe82f13cb801a57dd235d8555b67d2ec37ed7af4f9fa956570a7931134918f6d33fac832b2904540550a8179974

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
306B

MD5
792c4ec398d2bab07ac0a075562bc64e

SHA1
3d9f36cab555d41413d639269365aef3557dc9d5

SHA256
91d38e1982e7ff9eb1532c3f0a7aa0aa25c04770af093420f5db5ca92afc8e42

SHA512
b15cc86189c1b1f721ac9c1cdbb7808abea6414a3938f17ffce8d9bc8e3faa96bc0fb6c1489d9394109cd2b878d53828c5b911b492551ecfc612e7be90e7fcd6

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
408B

MD5
c045319db3c32c04417c77975d9f2939

SHA1
8f13e7e9820590796d3f7bc92850d373186f972a

SHA256
f53dcfae435cc2562f514fa18e2faab7393b9ce855405b03e810b4f0df0dfde6

SHA512
92c655c0695ee77498dc6595be60279390aea578cc3bc9fc297f434e80b41ec41ff89fa20ab0911ef19a4799fcd2f5d5a8d333e9b625c66110c9f31bd241cc75

Download Submit
\??\c:\programdata\application data\storm\update\%sessionname%\omsuy.cc3

Filesize
22.0MB

MD5
84dd440efa8109fca360720a0cd15d50

SHA1
cff4b212c5533fdc4864ff1c95d18b80a0dc356a

SHA256
5e6675916a2aff24d0314db07d73f70585701d24e15afa22bba5a064ee8b4172

SHA512
d60eef5e57ff6ecf6cfb57485b6e39e9d5ed1f3f1f4967012405d572e8a7d8528d972592cc86d2e85cf62e50ac20c40024960618b42b5b575956f3d6e989ed43

Download Submit
\??\c:\users\admin\appdata\local\dedcisjxuu

Filesize
23.7MB

MD5
b129ade0abb927989b5f7fdb238a9a67

SHA1
084a8c7db21629d592ff388611e3b76685e47565

SHA256
a55d1941072ad136d9b68ceea1f359904587f77e976c1f530b831f7c5ec96c01

SHA512
10e416e409a96c4c77094c1dcd9786ca4aeac6e65532092eb5210fa3a135e86da3f325e9747edac63af26ebb586e10951e70d7128e21a011867d5668ec054a61

Download Submit
memory/1904-132-0x0000000000400000-0x000000000044E34C-memory.dmp

Filesize
312KB

Download
memory/2728-141-0x0000000000400000-0x000000000044E34C-memory.dmp

Filesize
312KB

Download
memory/2728-137-0x0000000000400000-0x000000000044E34C-memory.dmp

Filesize
312KB

Download
memory/2728-136-0x0000000000400000-0x000000000044E34C-memory.dmp

Filesize
312KB

Download