gh0strat | ee521786c8522b0957365a8bc49676c8460f3669cd2af125456068b952108609

Analysis

max time kernel
152s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 09:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ee521786c8522b0957365a8bc49676c8460f3669cd2af125456068b952108609.exe
Size

137KB
MD5

807ce67e6bbea706b06c34bb3278d0ff
SHA1

23f56b37931c6fec0829e780757a699541947b42
SHA256

ee521786c8522b0957365a8bc49676c8460f3669cd2af125456068b952108609
SHA512

70816483bb7ad3cb400c88ba9f57e9fd14e1ec15d328bd28d913cdc427018963cafaa2a7bac3d873985573f94a32d6ab4131c1f69e558ea8db2a43f4fb667a3d
SSDEEP

1536:cbrVhDp2tl/h74LQJHqFgzbfb2EZx9DjBCAs+BrqkPdv50JptEtcFRmcfCW1:cJ2tP74LHmNZx9jBZn1v+JT7mcfC

Score

10^/10

gh0strat rat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1112-55-0x0000000010000000-0x0000000010019000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Executes dropped EXE 1 IoCs

Processes:

iwuiiqm.pif

pid process

536 iwuiiqm.pif
Deletes itself 1 IoCs

Processes:

WScript.exe

pid process

1076 WScript.exe

pid	process
536	iwuiiqm.pif

pid	process
1076	WScript.exe

Drops file in Windows directory 2 IoCs

Processes:

ee521786c8522b0957365a8bc49676c8460f3669cd2af125456068b952108609.exe

description	ioc	process
File opened for modification	C:\Windows\iwuiiqm.pif	ee521786c8522b0957365a8bc49676c8460f3669cd2af125456068b952108609.exe
File created	C:\Windows\iwuiiqm.pif	ee521786c8522b0957365a8bc49676c8460f3669cd2af125456068b952108609.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

ee521786c8522b0957365a8bc49676c8460f3669cd2af125456068b952108609.exeiwuiiqm.pif

pid process

1112 ee521786c8522b0957365a8bc49676c8460f3669cd2af125456068b952108609.exe
536 iwuiiqm.pif

pid	process
1112	ee521786c8522b0957365a8bc49676c8460f3669cd2af125456068b952108609.exe
536	iwuiiqm.pif

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ee521786c8522b0957365a8bc49676c8460f3669cd2af125456068b952108609.exe

description	pid	process	target process
PID 1112 wrote to memory of 1076	1112	ee521786c8522b0957365a8bc49676c8460f3669cd2af125456068b952108609.exe	WScript.exe
PID 1112 wrote to memory of 1076	1112	ee521786c8522b0957365a8bc49676c8460f3669cd2af125456068b952108609.exe	WScript.exe
PID 1112 wrote to memory of 1076	1112	ee521786c8522b0957365a8bc49676c8460f3669cd2af125456068b952108609.exe	WScript.exe
PID 1112 wrote to memory of 1076	1112	ee521786c8522b0957365a8bc49676c8460f3669cd2af125456068b952108609.exe	WScript.exe

C:\Users\Admin\AppData\Local\Temp\ee521786c8522b0957365a8bc49676c8460f3669cd2af125456068b952108609.exe
"C:\Users\Admin\AppData\Local\Temp\ee521786c8522b0957365a8bc49676c8460f3669cd2af125456068b952108609.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1112

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\2888.vbs"
2⤵
- Deletes itself
PID:1076

C:\Windows\iwuiiqm.pif
C:\Windows\iwuiiqm.pif
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:536

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\2888.vbs
Filesize
500B

MD5
a78dcd424aac778c8dec1c9713ec7daa

SHA1
5d07cef67a44ce60b35cc18df261e12873419786

SHA256
7ae2cde67f7719e0b11df8dcab4d569d1bb8f3f9afca4b3ca772b90584e32468

SHA512
99eebf518b3502484abc697c44290972ca2f3aa065a1acfc6ac65eda19de127e054151ccc688cb9e230cc13a62c69e5dd96635821f2b14fc10aee4a37ffde22b

Download Submit
C:\Windows\iwuiiqm.pif
Filesize
137KB

MD5
807ce67e6bbea706b06c34bb3278d0ff

SHA1
23f56b37931c6fec0829e780757a699541947b42

SHA256
ee521786c8522b0957365a8bc49676c8460f3669cd2af125456068b952108609

SHA512
70816483bb7ad3cb400c88ba9f57e9fd14e1ec15d328bd28d913cdc427018963cafaa2a7bac3d873985573f94a32d6ab4131c1f69e558ea8db2a43f4fb667a3d

Download Submit
C:\Windows\iwuiiqm.pif
Filesize
137KB

MD5
807ce67e6bbea706b06c34bb3278d0ff

SHA1
23f56b37931c6fec0829e780757a699541947b42

SHA256
ee521786c8522b0957365a8bc49676c8460f3669cd2af125456068b952108609

SHA512
70816483bb7ad3cb400c88ba9f57e9fd14e1ec15d328bd28d913cdc427018963cafaa2a7bac3d873985573f94a32d6ab4131c1f69e558ea8db2a43f4fb667a3d

Download Submit
memory/1076-66-0x0000000000000000-mapping.dmp

Download
memory/1112-54-0x0000000074D61000-0x0000000074D63000-memory.dmp

Filesize
8KB

Download
memory/1112-55-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download