gh0strat | c9aa1f210b950b6f80307e2ae721aad064f268867918e5349ef8eb445291bcf5

Analysis

max time kernel
151s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 13:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c9aa1f210b950b6f80307e2ae721aad064f268867918e5349ef8eb445291bcf5.exe
Size

47KB
MD5

3da64e8399ac8cecda1a640205b46d64
SHA1

377f125b7611e1faded71161917d6bf4e3d74159
SHA256

c9aa1f210b950b6f80307e2ae721aad064f268867918e5349ef8eb445291bcf5
SHA512

a75aa3dac5b805689a402749bc6542145adc339c701cd7570745ba398fd5ce06ed7bd750b95aa763f1e2bfff404872695fbb19e8dac95a37cf3a21385018267e
SSDEEP

768:ADrYMB++TPVxPqwUrNLi0Tixor7TFKWRrJY+tvXeS2OowIuGGxKX0h42nhcW:ADLB+mVxMrY0Tix24WZJYavXeSewrQCd

Score

10^/10

gh0strat persistence rat upx

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1428-59-0x0000000010000000-0x000000001001A000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

c9aa1f210b950b6f80307e2ae721aad064f268867918e5349ef8eb445291bcf5.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\nt0drv\Parameters\ServiceDll = "C:\\Windows\\System32\\\\Rundll64.dll"	c9aa1f210b950b6f80307e2ae721aad064f268867918e5349ef8eb445291bcf5.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\??\c:\windows\SysWOW64\rundll64.dll	upx
\Windows\SysWOW64\Rundll64.dll	upx
behavioral1/memory/1428-59-0x0000000010000000-0x000000001001A000-memory.dmp	upx

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

1428 svchost.exe
Loads dropped DLL 1 IoCs

Processes:

svchost.exe

pid process

1428 svchost.exe
Drops file in System32 directory 1 IoCs

Processes:

c9aa1f210b950b6f80307e2ae721aad064f268867918e5349ef8eb445291bcf5.exe

description ioc process

File created C:\Windows\SysWOW64\Rundll64.dll c9aa1f210b950b6f80307e2ae721aad064f268867918e5349ef8eb445291bcf5.exe

pid	process
1428	svchost.exe

pid	process
1428	svchost.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Rundll64.dll	c9aa1f210b950b6f80307e2ae721aad064f268867918e5349ef8eb445291bcf5.exe

C:\Users\Admin\AppData\Local\Temp\c9aa1f210b950b6f80307e2ae721aad064f268867918e5349ef8eb445291bcf5.exe
"C:\Users\Admin\AppData\Local\Temp\c9aa1f210b950b6f80307e2ae721aad064f268867918e5349ef8eb445291bcf5.exe"
1⤵
- Sets DLL path for service in the registry
- Drops file in System32 directory
PID:1752

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Deletes itself
- Loads dropped DLL
PID:1428

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\rundll64.dll

Filesize
34KB

MD5
7816e672ea553340ba9fe9fd51e5b94d

SHA1
c3d71f8108ae81e6bb200b6fa19ec7548e69b9a9

SHA256
b359f658581eb4b036fc0cb2b3dd96bb46b5c2873183cef69207723b0a692c7e

SHA512
ef61ae487df4f25bffa7f4d03fc97c6bed7229b830c3292dbac62176282896969d3485bdfd108ec831cb4b3c46253cde6a8d6af3d44b8cbc7cf785a69f88e8e2

Download Submit
\Windows\SysWOW64\Rundll64.dll

Filesize
34KB

MD5
7816e672ea553340ba9fe9fd51e5b94d

SHA1
c3d71f8108ae81e6bb200b6fa19ec7548e69b9a9

SHA256
b359f658581eb4b036fc0cb2b3dd96bb46b5c2873183cef69207723b0a692c7e

SHA512
ef61ae487df4f25bffa7f4d03fc97c6bed7229b830c3292dbac62176282896969d3485bdfd108ec831cb4b3c46253cde6a8d6af3d44b8cbc7cf785a69f88e8e2

Download Submit
memory/1428-59-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download
memory/1752-54-0x0000000000400000-0x000000000041E27A-memory.dmp

Filesize
120KB

Download
memory/1752-56-0x0000000000400000-0x000000000041E27A-memory.dmp

Filesize
120KB

Download
memory/1752-57-0x0000000000300000-0x0000000000312000-memory.dmp

Filesize
72KB

Download