gh0strat | 10eda700692685734da85bb625fddacd4ba6dbd955777072c1a5a5630f395a51

General

Target

10eda700692685734da85bb625fddacd4ba6dbd955777072c1a5a5630f395a51.exe
Size

109KB
MD5

2c21f027e67a788505346a48f679ec52
SHA1

3e5a0a24124046298f44abdedd17cac2103fb560
SHA256

10eda700692685734da85bb625fddacd4ba6dbd955777072c1a5a5630f395a51
SHA512

25762bd3907cc9920f68fb070f4ff591757e12c80382a96fb8cd146c9f77abca5dc363836eae60764670be3bc1369e5dbbc84f33fdb68f3b77c9055ee60fdca8
SSDEEP

3072:ymWZaTM/0Ys2KrtqZQtgxHHHiHHKHHHaBHHHHHH+Ug2NXBuF/c8Mf:ye2KrtqZQtgxHHHiHHKHHHqHHHHHH+Uh

Score

10^/10

gh0strat rat upx

Malware Config

Signatures

Gh0st RAT payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1168-55-0x0000000000400000-0x000000000043B000-memory.dmp	family_gh0strat
behavioral1/memory/636-58-0x0000000000400000-0x000000000043B000-memory.dmp	family_gh0strat
behavioral1/memory/1168-61-0x0000000000400000-0x000000000043B000-memory.dmp	family_gh0strat
behavioral1/memory/636-64-0x0000000000400000-0x000000000043B000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Executes dropped EXE 1 IoCs

Processes:

Terms.exe

pid process

636 Terms.exe

pid	process
636	Terms.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1168-55-0x0000000000400000-0x000000000043B000-memory.dmp	upx
C:\Windows\Terms.exe	upx
behavioral1/memory/636-58-0x0000000000400000-0x000000000043B000-memory.dmp	upx
C:\Windows\Terms.exe	upx
behavioral1/memory/1168-61-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/memory/636-64-0x0000000000400000-0x000000000043B000-memory.dmp	upx

Deletes itself 1 IoCs

Processes:

WScript.exe

pid process

1884 WScript.exe

pid	process
1884	WScript.exe

Drops file in Windows directory 2 IoCs

Processes:

10eda700692685734da85bb625fddacd4ba6dbd955777072c1a5a5630f395a51.exe

description	ioc	process
File created	C:\Windows\Terms.exe	10eda700692685734da85bb625fddacd4ba6dbd955777072c1a5a5630f395a51.exe
File opened for modification	C:\Windows\Terms.exe	10eda700692685734da85bb625fddacd4ba6dbd955777072c1a5a5630f395a51.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

10eda700692685734da85bb625fddacd4ba6dbd955777072c1a5a5630f395a51.exeTerms.exe

pid	process
1168	10eda700692685734da85bb625fddacd4ba6dbd955777072c1a5a5630f395a51.exe
636	Terms.exe
1168	10eda700692685734da85bb625fddacd4ba6dbd955777072c1a5a5630f395a51.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Terms.exe

description pid process

Token: SeDebugPrivilege 636 Terms.exe

description	pid	process
Token: SeDebugPrivilege	636	Terms.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

10eda700692685734da85bb625fddacd4ba6dbd955777072c1a5a5630f395a51.exe

description	pid	process	target process
PID 1168 wrote to memory of 1884	1168	10eda700692685734da85bb625fddacd4ba6dbd955777072c1a5a5630f395a51.exe	WScript.exe
PID 1168 wrote to memory of 1884	1168	10eda700692685734da85bb625fddacd4ba6dbd955777072c1a5a5630f395a51.exe	WScript.exe
PID 1168 wrote to memory of 1884	1168	10eda700692685734da85bb625fddacd4ba6dbd955777072c1a5a5630f395a51.exe	WScript.exe
PID 1168 wrote to memory of 1884	1168	10eda700692685734da85bb625fddacd4ba6dbd955777072c1a5a5630f395a51.exe	WScript.exe

C:\Users\Admin\AppData\Local\Temp\10eda700692685734da85bb625fddacd4ba6dbd955777072c1a5a5630f395a51.exe
"C:\Users\Admin\AppData\Local\Temp\10eda700692685734da85bb625fddacd4ba6dbd955777072c1a5a5630f395a51.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1168

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\8732.vbs"
2⤵
- Deletes itself
PID:1884

C:\Windows\Terms.exe
C:\Windows\Terms.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:636

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\8732.vbs
Filesize
500B

MD5
6b8cf6e1e77e803e8ae08c64533b7a93

SHA1
e299a316c61b41918f3eacf97239c29fc86fec8a

SHA256
8153d7054d66ca67fe2ae836c3ba7eba4b6d9a2e7cb67365d90f3a05c6898f45

SHA512
a0f874c88c9af4a8520cb1929992cfb6ed142178805bd2ae937443e3f5ba36df2b647a36253b3eb03709860edc20ce9a5551da725b474b5fb91c30f96eb2c694

Download Submit
C:\Windows\Terms.exe
Filesize
109KB

MD5
2c21f027e67a788505346a48f679ec52

SHA1
3e5a0a24124046298f44abdedd17cac2103fb560

SHA256
10eda700692685734da85bb625fddacd4ba6dbd955777072c1a5a5630f395a51

SHA512
25762bd3907cc9920f68fb070f4ff591757e12c80382a96fb8cd146c9f77abca5dc363836eae60764670be3bc1369e5dbbc84f33fdb68f3b77c9055ee60fdca8

Download Submit
C:\Windows\Terms.exe
Filesize
109KB

MD5
2c21f027e67a788505346a48f679ec52

SHA1
3e5a0a24124046298f44abdedd17cac2103fb560

SHA256
10eda700692685734da85bb625fddacd4ba6dbd955777072c1a5a5630f395a51

SHA512
25762bd3907cc9920f68fb070f4ff591757e12c80382a96fb8cd146c9f77abca5dc363836eae60764670be3bc1369e5dbbc84f33fdb68f3b77c9055ee60fdca8

Download Submit
memory/636-58-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/636-64-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1168-54-0x0000000075441000-0x0000000075443000-memory.dmp

Filesize
8KB

Download
memory/1168-55-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1168-61-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1884-60-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads