gh0strat | 30dfd313c020be473fe956a13032d612602fb428374c4d4f386a9a458dedfc0f

Analysis

max time kernel
29s
max time network
50s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 03:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

30dfd313c020be473fe956a13032d612602fb428374c4d4f386a9a458dedfc0f.exe
Size

59KB
MD5

076cde8af011baa420d881cf2d3569f1
SHA1

1fb1b8ea603ff3019797f2b9156256459bc024cf
SHA256

30dfd313c020be473fe956a13032d612602fb428374c4d4f386a9a458dedfc0f
SHA512

cf33a094b9197e08cd7b34e06015157aae435f650d7023d227bc957eace08543683605579ef69f51929917fef59246a8f9e5162c8876fc9ca727d92f2eb7f60a
SSDEEP

768:bEWczxOh4EjDxxTHUa8mR70k3guVKvDrbzRegCKDe9qm+xPq8YWK:bELz04C1xdRYlXRsn+xC8lK

Score

10^/10

gh0strat rat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/files/0x0009000000013300-55.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Executes dropped EXE 1 IoCs

pid	Process
2000	server.exe

Deletes itself 1 IoCs

pid	Process
1224	WScript.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Mkwuwk\server.exe	30dfd313c020be473fe956a13032d612602fb428374c4d4f386a9a458dedfc0f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Mkwuwk\server.exe	30dfd313c020be473fe956a13032d612602fb428374c4d4f386a9a458dedfc0f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1896	30dfd313c020be473fe956a13032d612602fb428374c4d4f386a9a458dedfc0f.exe
2000	server.exe
1896	30dfd313c020be473fe956a13032d612602fb428374c4d4f386a9a458dedfc0f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2000	server.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 1224	1896	30dfd313c020be473fe956a13032d612602fb428374c4d4f386a9a458dedfc0f.exe	29
PID 1896 wrote to memory of 1224	1896	30dfd313c020be473fe956a13032d612602fb428374c4d4f386a9a458dedfc0f.exe	29
PID 1896 wrote to memory of 1224	1896	30dfd313c020be473fe956a13032d612602fb428374c4d4f386a9a458dedfc0f.exe	29
PID 1896 wrote to memory of 1224	1896	30dfd313c020be473fe956a13032d612602fb428374c4d4f386a9a458dedfc0f.exe	29

C:\Users\Admin\AppData\Local\Temp\30dfd313c020be473fe956a13032d612602fb428374c4d4f386a9a458dedfc0f.exe
"C:\Users\Admin\AppData\Local\Temp\30dfd313c020be473fe956a13032d612602fb428374c4d4f386a9a458dedfc0f.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\6528.vbs"
  2⤵
  - Deletes itself
  PID:1224

C:\Program Files (x86)\Microsoft Mkwuwk\server.exe
"C:\Program Files (x86)\Microsoft Mkwuwk\server.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2000

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\6528.vbs

Filesize
500B

MD5
77299f3790e205de5f68b8264e1b9b8c

SHA1
c5f12681c357ae516de6305fe59803f1b70f7547

SHA256
d6c801475eec6e4a691ee78e0a9d3beb4d738444b79c3654a15ef65d82fbd668

SHA512
01164be96b3360f9c1a272d7ae61c72ac74f3142e0a2db1e8ed9db51ef892bfc2e3fc13737c3595271411be42fb8796f0a0624362ad338f2e1457e5c3e49586a

Download Submit
C:\Program Files (x86)\Microsoft Mkwuwk\server.exe

Filesize
59KB

MD5
076cde8af011baa420d881cf2d3569f1

SHA1
1fb1b8ea603ff3019797f2b9156256459bc024cf

SHA256
30dfd313c020be473fe956a13032d612602fb428374c4d4f386a9a458dedfc0f

SHA512
cf33a094b9197e08cd7b34e06015157aae435f650d7023d227bc957eace08543683605579ef69f51929917fef59246a8f9e5162c8876fc9ca727d92f2eb7f60a

Download Submit
memory/1896-54-0x00000000763F1000-0x00000000763F3000-memory.dmp

Filesize
8KB

Download