gh0strat | 6ffbeda084ceb9146dfd73026246826f30ea0487a0c7c923c306593c886ce421

Analysis

max time kernel
277s
max time network
298s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 15:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6ffbeda084ceb9146dfd73026246826f30ea0487a0c7c923c306593c886ce421.exe
Size

128KB
MD5

d3f2deb04cd061ecf8d7d44595054e9f
SHA1

b98f2ad1f7ddac57d0fdb825e9ec07df19aff834
SHA256

6ffbeda084ceb9146dfd73026246826f30ea0487a0c7c923c306593c886ce421
SHA512

e7cf446ba1d393b06005fc79f03763041820a372d9bb12dfdccb15fb1112b7bdde8503728794ff320a541aa29b32bcfcc023ce89f98c23dae4f70afed41d50cc
SSDEEP

3072:3Xq28jHvzJT1DQXNpvgPC4WaoCeOC4W9rD5zaQ6SZLmqh:3X18TvvQqCvlOC4WvzaIsK

Score

10^/10

gh0strat persistence rat

Malware Config

Signatures

Gh0st RAT payload 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3056-132-0x0000000000400000-0x0000000000421000-memory.dmp	family_gh0strat
\??\c:\documents and settings\local user\360safe.dll	family_gh0strat
C:\Users\Local User\360safe.dll	family_gh0strat
behavioral2/memory/4976-135-0x0000000010000000-0x000000001001B000-memory.dmp	family_gh0strat
behavioral2/memory/4976-136-0x0000000010000000-0x000000001001B000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

6ffbeda084ceb9146dfd73026246826f30ea0487a0c7c923c306593c886ce421.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Documents and Settings\\Local User\\360safe.dll"	6ffbeda084ceb9146dfd73026246826f30ea0487a0c7c923c306593c886ce421.exe

Loads dropped DLL 1 IoCs

Processes:

SVCHOST.EXE

pid process

4976 SVCHOST.EXE

pid	process
4976	SVCHOST.EXE

C:\Users\Admin\AppData\Local\Temp\6ffbeda084ceb9146dfd73026246826f30ea0487a0c7c923c306593c886ce421.exe
"C:\Users\Admin\AppData\Local\Temp\6ffbeda084ceb9146dfd73026246826f30ea0487a0c7c923c306593c886ce421.exe"
1⤵
- Sets DLL path for service in the registry
PID:3056

C:\Windows\SysWOW64\SVCHOST.EXE
C:\Windows\SysWOW64\SVCHOST.EXE -K NETSVCS -s FastUserSwitchingCompatibility
1⤵
- Loads dropped DLL
PID:4976

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Local User\360safe.dll

Filesize
100KB

MD5
31cf10afe4b52f152987d1521a9c5e54

SHA1
c18183b39ec5faa8c2fc00e5ba33d64918cba240

SHA256
f3e2b6417b9e9128b25c63ec39ce0881618d715334eab6ece52d6b17b57e51ce

SHA512
e3325387984511bb62a963f5057b82434ad1e69c5ceb9717ece9b360ff5efc6873bb5eaaa51d69e4e3e16f09db81ceccc6f76b53ca9feacfcc826f0792060f2f

Download Submit
\??\c:\documents and settings\local user\360safe.dll

Filesize
100KB

MD5
31cf10afe4b52f152987d1521a9c5e54

SHA1
c18183b39ec5faa8c2fc00e5ba33d64918cba240

SHA256
f3e2b6417b9e9128b25c63ec39ce0881618d715334eab6ece52d6b17b57e51ce

SHA512
e3325387984511bb62a963f5057b82434ad1e69c5ceb9717ece9b360ff5efc6873bb5eaaa51d69e4e3e16f09db81ceccc6f76b53ca9feacfcc826f0792060f2f

Download Submit
memory/3056-132-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4976-135-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download
memory/4976-136-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download