gh0strat | a2acf5af32449d14e33b3fcb74b3792a699b3c70edb3f84055157070889422da

Analysis

max time kernel
150s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 09:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a2acf5af32449d14e33b3fcb74b3792a699b3c70edb3f84055157070889422da.exe
Size

53KB
MD5

63486e0d37842afa5338c5701316ac77
SHA1

7cfd930ad25285670603433ea0ba4d08f9d888a8
SHA256

a2acf5af32449d14e33b3fcb74b3792a699b3c70edb3f84055157070889422da
SHA512

ad12e782d1f4d62568e7c83124a115af770760efcc14df46e9c712d2176e07b8f545fbd30997ac256133fa5fe2183d11c4a5609831c2ea28acaaf1322cafb78b
SSDEEP

768:O5fOJfRLdj3GO9a4Vei/Qzm0GYE7Gnmhw/HjSL+oVQ3A71WGuT/XzTR1yQEVGxCF:O5afRxiGa4hlvy8Ws+oQw74Gw/X3GU

Score

10^/10

gh0strat persistence rat upx

Malware Config

Signatures

Gh0st RAT payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/828-55-0x0000000000400000-0x0000000000421000-memory.dmp	family_gh0strat
\??\c:\windows\SysWOW64\mstsc.admin.8.dll	family_gh0strat
\Windows\SysWOW64\mstsc.admin.8.dll	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

a2acf5af32449d14e33b3fcb74b3792a699b3c70edb3f84055157070889422da.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Microsoft Safe Sever 1.0\Parameters\ServiceDll = "C:\\Windows\\system32\\mstsc.admin.8.dll"	a2acf5af32449d14e33b3fcb74b3792a699b3c70edb3f84055157070889422da.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/828-55-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

976 svchost.exe
Loads dropped DLL 1 IoCs

Processes:

svchost.exe

pid process

976 svchost.exe
Drops file in System32 directory 1 IoCs

Processes:

a2acf5af32449d14e33b3fcb74b3792a699b3c70edb3f84055157070889422da.exe

description ioc process

File created C:\Windows\SysWOW64\mstsc.admin.8.dll a2acf5af32449d14e33b3fcb74b3792a699b3c70edb3f84055157070889422da.exe

pid	process
976	svchost.exe

pid	process
976	svchost.exe

description	ioc	process
File created	C:\Windows\SysWOW64\mstsc.admin.8.dll	a2acf5af32449d14e33b3fcb74b3792a699b3c70edb3f84055157070889422da.exe

C:\Users\Admin\AppData\Local\Temp\a2acf5af32449d14e33b3fcb74b3792a699b3c70edb3f84055157070889422da.exe
"C:\Users\Admin\AppData\Local\Temp\a2acf5af32449d14e33b3fcb74b3792a699b3c70edb3f84055157070889422da.exe"
1⤵
- Sets DLL path for service in the registry
- Drops file in System32 directory
PID:828

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Deletes itself
- Loads dropped DLL
PID:976

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\mstsc.admin.8.dll
Filesize
104KB

MD5
083dbb6e684ad6451b09f12d737cffbc

SHA1
a588399511f4933db23494e75b79881b1600e348

SHA256
66123f91ca658ecdb758a97834035838b117feee740b14f00ba1d84664cab80a

SHA512
635019aeee56768e074eef3db0eb201f5be7bea648cc4bceb89eb52e4c060e6eb0fb7ecbc10d599916a389e0ddc39548d2ea161d0ec7f5f55f6ba328fb18b8d7

Download Submit
\Windows\SysWOW64\mstsc.admin.8.dll
Filesize
104KB

MD5
083dbb6e684ad6451b09f12d737cffbc

SHA1
a588399511f4933db23494e75b79881b1600e348

SHA256
66123f91ca658ecdb758a97834035838b117feee740b14f00ba1d84664cab80a

SHA512
635019aeee56768e074eef3db0eb201f5be7bea648cc4bceb89eb52e4c060e6eb0fb7ecbc10d599916a389e0ddc39548d2ea161d0ec7f5f55f6ba328fb18b8d7

Download Submit
memory/828-55-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/976-57-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

Filesize
8KB

Download