gh0strat | 53c4b7327c5bb505017383a3bdf580208bf503c537f1618435b4f6f1b0362212

Analysis

max time kernel
150s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 13:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

53c4b7327c5bb505017383a3bdf580208bf503c537f1618435b4f6f1b0362212.exe
Size

238KB
MD5

0a4af18509e97c59a365434368da74f4
SHA1

d88c9247953bada73bff1f7c6c10b5dd8c53fcd4
SHA256

53c4b7327c5bb505017383a3bdf580208bf503c537f1618435b4f6f1b0362212
SHA512

bd8e58f728ff45b4f57954f119050fcfedbdfdc9457c93ca3ca75977590f705554a1bfab42512b0641b84d614309b7f3974dfe7850ea5bf771c17262f1f90da5
SSDEEP

3072:s0V0g2XAc5eVcB9RdrRmY/+zzfgGWjpitlmlRVeJWSpU+EXXVTfQ8ulV:s1eVcB33miSz4B6lKVeJWHlXW8ul

Score

10^/10

gh0strat persistence rat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/files/0x000500000000b2d2-56.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Adds policy Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Yitmskmiq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	53c4b7327c5bb505017383a3bdf580208bf503c537f1618435b4f6f1b0362212.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Mefmbn Wsqdwfrp Bls = "C:\\Windows\\Yitmskmiq.exe"	53c4b7327c5bb505017383a3bdf580208bf503c537f1618435b4f6f1b0362212.exe

Executes dropped EXE 1 IoCs

pid	Process
1188	Yitmskmiq.exe

Deletes itself 1 IoCs

pid	Process
1780	cmd.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Yitmskmiq.exe	53c4b7327c5bb505017383a3bdf580208bf503c537f1618435b4f6f1b0362212.exe
File opened for modification	C:\Windows\Yitmskmiq.exe	53c4b7327c5bb505017383a3bdf580208bf503c537f1618435b4f6f1b0362212.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1416	53c4b7327c5bb505017383a3bdf580208bf503c537f1618435b4f6f1b0362212.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 1188	1416	53c4b7327c5bb505017383a3bdf580208bf503c537f1618435b4f6f1b0362212.exe	27
PID 1416 wrote to memory of 1188	1416	53c4b7327c5bb505017383a3bdf580208bf503c537f1618435b4f6f1b0362212.exe	27
PID 1416 wrote to memory of 1188	1416	53c4b7327c5bb505017383a3bdf580208bf503c537f1618435b4f6f1b0362212.exe	27
PID 1416 wrote to memory of 1188	1416	53c4b7327c5bb505017383a3bdf580208bf503c537f1618435b4f6f1b0362212.exe	27
PID 1416 wrote to memory of 1780	1416	53c4b7327c5bb505017383a3bdf580208bf503c537f1618435b4f6f1b0362212.exe	28
PID 1416 wrote to memory of 1780	1416	53c4b7327c5bb505017383a3bdf580208bf503c537f1618435b4f6f1b0362212.exe	28
PID 1416 wrote to memory of 1780	1416	53c4b7327c5bb505017383a3bdf580208bf503c537f1618435b4f6f1b0362212.exe	28
PID 1416 wrote to memory of 1780	1416	53c4b7327c5bb505017383a3bdf580208bf503c537f1618435b4f6f1b0362212.exe	28

C:\Users\Admin\AppData\Local\Temp\53c4b7327c5bb505017383a3bdf580208bf503c537f1618435b4f6f1b0362212.exe
"C:\Users\Admin\AppData\Local\Temp\53c4b7327c5bb505017383a3bdf580208bf503c537f1618435b4f6f1b0362212.exe"
1⤵
- Adds policy Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\Yitmskmiq.exe
  "C:\Windows\Yitmskmiq.exe"
  2⤵
  - Adds policy Run key to start application
  - Executes dropped EXE
  PID:1188
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\53C4B7~1.EXE > nul
  2⤵
  - Deletes itself
  PID:1780

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Yitmskmiq.exe

Filesize
238KB

MD5
0a4af18509e97c59a365434368da74f4

SHA1
d88c9247953bada73bff1f7c6c10b5dd8c53fcd4

SHA256
53c4b7327c5bb505017383a3bdf580208bf503c537f1618435b4f6f1b0362212

SHA512
bd8e58f728ff45b4f57954f119050fcfedbdfdc9457c93ca3ca75977590f705554a1bfab42512b0641b84d614309b7f3974dfe7850ea5bf771c17262f1f90da5

Download Submit
memory/1416-54-0x0000000074DC1000-0x0000000074DC3000-memory.dmp

Filesize
8KB

Download