gh0strat | abd3f6293ad0f65a867e6a393588c05823981e0e334c3989bad41680ea358ca3

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 04:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

abd3f6293ad0f65a867e6a393588c05823981e0e334c3989bad41680ea358ca3.exe
Size

149KB
MD5

bb45bd864b2d593e0d45e0709295ce74
SHA1

b36a1acaeb1a36eb0378b91b9e65a17bb0c012dc
SHA256

abd3f6293ad0f65a867e6a393588c05823981e0e334c3989bad41680ea358ca3
SHA512

58f669693f76567df2b4038cd5dbfd16d1b1c709b0c02697520df20685ff6687219915d4319197182ac70b8b1b3668a00dd5ba60224065dc014c1905396ee33e
SSDEEP

3072:9+RuHTNIv9cLXt1ZhT4M4uShr67iyVgxlqKWkQiqPNVgyqX2:kR0TN0qZD+qiq9bJPNyj

Score

10^/10

gh0strat rat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1376-132-0x0000000010000000-0x0000000010019000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Executes dropped EXE 1 IoCs

Processes:

wkpycpx.pif

pid process

4180 wkpycpx.pif

pid	process
4180	wkpycpx.pif

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

abd3f6293ad0f65a867e6a393588c05823981e0e334c3989bad41680ea358ca3.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	abd3f6293ad0f65a867e6a393588c05823981e0e334c3989bad41680ea358ca3.exe

Drops file in Windows directory 2 IoCs

Processes:

abd3f6293ad0f65a867e6a393588c05823981e0e334c3989bad41680ea358ca3.exe

description	ioc	process
File created	C:\Windows\wkpycpx.pif	abd3f6293ad0f65a867e6a393588c05823981e0e334c3989bad41680ea358ca3.exe
File opened for modification	C:\Windows\wkpycpx.pif	abd3f6293ad0f65a867e6a393588c05823981e0e334c3989bad41680ea358ca3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

Processes:

abd3f6293ad0f65a867e6a393588c05823981e0e334c3989bad41680ea358ca3.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	abd3f6293ad0f65a867e6a393588c05823981e0e334c3989bad41680ea358ca3.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

abd3f6293ad0f65a867e6a393588c05823981e0e334c3989bad41680ea358ca3.exewkpycpx.pif

pid	process
1376	abd3f6293ad0f65a867e6a393588c05823981e0e334c3989bad41680ea358ca3.exe
1376	abd3f6293ad0f65a867e6a393588c05823981e0e334c3989bad41680ea358ca3.exe
4180	wkpycpx.pif
4180	wkpycpx.pif

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

abd3f6293ad0f65a867e6a393588c05823981e0e334c3989bad41680ea358ca3.exe

description	pid	process	target process
PID 1376 wrote to memory of 616	1376	abd3f6293ad0f65a867e6a393588c05823981e0e334c3989bad41680ea358ca3.exe	WScript.exe
PID 1376 wrote to memory of 616	1376	abd3f6293ad0f65a867e6a393588c05823981e0e334c3989bad41680ea358ca3.exe	WScript.exe
PID 1376 wrote to memory of 616	1376	abd3f6293ad0f65a867e6a393588c05823981e0e334c3989bad41680ea358ca3.exe	WScript.exe

C:\Users\Admin\AppData\Local\Temp\abd3f6293ad0f65a867e6a393588c05823981e0e334c3989bad41680ea358ca3.exe
"C:\Users\Admin\AppData\Local\Temp\abd3f6293ad0f65a867e6a393588c05823981e0e334c3989bad41680ea358ca3.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1376

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\9552.vbs"
2⤵
PID:616

C:\Windows\wkpycpx.pif
C:\Windows\wkpycpx.pif
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4180

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\9552.vbs
Filesize
500B

MD5
a2788bbba3c35ba6d9a6938d7803c14c

SHA1
5a606194880685d83758ec196f7259c151a84f77

SHA256
edec0ef8206258ceb8a0c05dc26b964bb439ba2c8ccdeae7aa5aad82bc5c3ad9

SHA512
77ab55d246410503c7848c642ab13aa7f0756a4d1bfbaa2a778fc2919ab6ac49af0228637bc7a308ec64f923d13c7ef03d999601fe644c953bee576c589fad01

Download Submit
C:\Windows\wkpycpx.pif
Filesize
149KB

MD5
bb45bd864b2d593e0d45e0709295ce74

SHA1
b36a1acaeb1a36eb0378b91b9e65a17bb0c012dc

SHA256
abd3f6293ad0f65a867e6a393588c05823981e0e334c3989bad41680ea358ca3

SHA512
58f669693f76567df2b4038cd5dbfd16d1b1c709b0c02697520df20685ff6687219915d4319197182ac70b8b1b3668a00dd5ba60224065dc014c1905396ee33e

Download Submit
C:\Windows\wkpycpx.pif
Filesize
149KB

MD5
bb45bd864b2d593e0d45e0709295ce74

SHA1
b36a1acaeb1a36eb0378b91b9e65a17bb0c012dc

SHA256
abd3f6293ad0f65a867e6a393588c05823981e0e334c3989bad41680ea358ca3

SHA512
58f669693f76567df2b4038cd5dbfd16d1b1c709b0c02697520df20685ff6687219915d4319197182ac70b8b1b3668a00dd5ba60224065dc014c1905396ee33e

Download Submit
memory/616-145-0x0000000000000000-mapping.dmp

Download
memory/1376-132-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download