gh0strat | 0c992159806d43ab7406849a70d228665e8a8ca25ab84b7ab12c785677010895

Analysis

max time kernel
112s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 18:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c992159806d43ab7406849a70d228665e8a8ca25ab84b7ab12c785677010895.exe
Size

365KB
MD5

ecd1033b6dec39b80d30ee0858fa14f4
SHA1

e906d7e53395756822b22a43aafabe6f14fd944c
SHA256

0c992159806d43ab7406849a70d228665e8a8ca25ab84b7ab12c785677010895
SHA512

98653263f9329f0961078d4ea03339a8f009c6c6fe7bffaa49019aa4d67f1d87d3378705cb71a5ce6289bfbcb139035af221cda4f07f09658201635d658c9e7b
SSDEEP

6144:K6k96wgvRHCzOYtqlGyzcsX3KA0LQIQRdP7CNQ/VxWxUcajESNLceH1t0TQ7zJ1U:f63gNCpOdn/uYTCNuxW3ajnNKUzxV8

Score

10^/10

gh0strat persistence rat

Malware Config

Signatures

Gh0st RAT payload 3 IoCs

resource	yara_rule
behavioral2/memory/5040-138-0x0000000010000000-0x0000000010121000-memory.dmp	family_gh0strat
behavioral2/memory/5040-139-0x0000000010000000-0x0000000010121000-memory.dmp	family_gh0strat
behavioral2/memory/5040-141-0x0000000010000000-0x0000000010121000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0003000000022e27-133.dat	acprotect
behavioral2/files/0x0003000000022e27-132.dat	acprotect

Loads dropped DLL 2 IoCs

pid	Process
5040	0c992159806d43ab7406849a70d228665e8a8ca25ab84b7ab12c785677010895.exe
5040	0c992159806d43ab7406849a70d228665e8a8ca25ab84b7ab12c785677010895.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	0c992159806d43ab7406849a70d228665e8a8ca25ab84b7ab12c785677010895.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XXXXXX7EFE368F = "C:\\Windows\\XXXXXX7EFE368F\\svchsot.exe"	0c992159806d43ab7406849a70d228665e8a8ca25ab84b7ab12c785677010895.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Default	0c992159806d43ab7406849a70d228665e8a8ca25ab84b7ab12c785677010895.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5040	0c992159806d43ab7406849a70d228665e8a8ca25ab84b7ab12c785677010895.exe
5040	0c992159806d43ab7406849a70d228665e8a8ca25ab84b7ab12c785677010895.exe
5040	0c992159806d43ab7406849a70d228665e8a8ca25ab84b7ab12c785677010895.exe
5040	0c992159806d43ab7406849a70d228665e8a8ca25ab84b7ab12c785677010895.exe
5040	0c992159806d43ab7406849a70d228665e8a8ca25ab84b7ab12c785677010895.exe
5040	0c992159806d43ab7406849a70d228665e8a8ca25ab84b7ab12c785677010895.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5040	0c992159806d43ab7406849a70d228665e8a8ca25ab84b7ab12c785677010895.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5040	0c992159806d43ab7406849a70d228665e8a8ca25ab84b7ab12c785677010895.exe

C:\Users\Admin\AppData\Local\Temp\0c992159806d43ab7406849a70d228665e8a8ca25ab84b7ab12c785677010895.exe
"C:\Users\Admin\AppData\Local\Temp\0c992159806d43ab7406849a70d228665e8a8ca25ab84b7ab12c785677010895.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:5040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gwiDD45.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\gwiDD45.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
memory/5040-135-0x0000000000890000-0x0000000000903000-memory.dmp

Filesize
460KB

Download
memory/5040-134-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/5040-136-0x0000000010000000-0x0000000010121000-memory.dmp

Filesize
1.1MB

Download
memory/5040-138-0x0000000010000000-0x0000000010121000-memory.dmp

Filesize
1.1MB

Download
memory/5040-139-0x0000000010000000-0x0000000010121000-memory.dmp

Filesize
1.1MB

Download
memory/5040-141-0x0000000010000000-0x0000000010121000-memory.dmp

Filesize
1.1MB

Download
memory/5040-142-0x0000000000890000-0x0000000000903000-memory.dmp

Filesize
460KB

Download