gh0strat | 10eda700692685734da85bb625fddacd4ba6dbd955777072c1a5a5630f395a51

General

Target

10eda700692685734da85bb625fddacd4ba6dbd955777072c1a5a5630f395a51.exe
Size

109KB
MD5

2c21f027e67a788505346a48f679ec52
SHA1

3e5a0a24124046298f44abdedd17cac2103fb560
SHA256

10eda700692685734da85bb625fddacd4ba6dbd955777072c1a5a5630f395a51
SHA512

25762bd3907cc9920f68fb070f4ff591757e12c80382a96fb8cd146c9f77abca5dc363836eae60764670be3bc1369e5dbbc84f33fdb68f3b77c9055ee60fdca8
SSDEEP

3072:ymWZaTM/0Ys2KrtqZQtgxHHHiHHKHHHaBHHHHHH+Ug2NXBuF/c8Mf:ye2KrtqZQtgxHHHiHHKHHHqHHHHHH+Uh

Score

10^/10

gh0strat rat upx

Malware Config

Signatures

Gh0st RAT payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5060-132-0x0000000000400000-0x000000000043B000-memory.dmp	family_gh0strat
behavioral2/memory/3564-135-0x0000000000400000-0x000000000043B000-memory.dmp	family_gh0strat
behavioral2/memory/5060-136-0x0000000000400000-0x000000000043B000-memory.dmp	family_gh0strat
behavioral2/memory/3564-139-0x0000000000400000-0x000000000043B000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Executes dropped EXE 1 IoCs

Processes:

Terms.exe

pid process

3564 Terms.exe

pid	process
3564	Terms.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/5060-132-0x0000000000400000-0x000000000043B000-memory.dmp	upx
C:\Windows\Terms.exe	upx
C:\Windows\Terms.exe	upx
behavioral2/memory/3564-135-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/5060-136-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/3564-139-0x0000000000400000-0x000000000043B000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

10eda700692685734da85bb625fddacd4ba6dbd955777072c1a5a5630f395a51.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	10eda700692685734da85bb625fddacd4ba6dbd955777072c1a5a5630f395a51.exe

Drops file in Windows directory 2 IoCs

Processes:

10eda700692685734da85bb625fddacd4ba6dbd955777072c1a5a5630f395a51.exe

description	ioc	process
File created	C:\Windows\Terms.exe	10eda700692685734da85bb625fddacd4ba6dbd955777072c1a5a5630f395a51.exe
File opened for modification	C:\Windows\Terms.exe	10eda700692685734da85bb625fddacd4ba6dbd955777072c1a5a5630f395a51.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

Processes:

10eda700692685734da85bb625fddacd4ba6dbd955777072c1a5a5630f395a51.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	10eda700692685734da85bb625fddacd4ba6dbd955777072c1a5a5630f395a51.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

10eda700692685734da85bb625fddacd4ba6dbd955777072c1a5a5630f395a51.exeTerms.exe

pid	process
5060	10eda700692685734da85bb625fddacd4ba6dbd955777072c1a5a5630f395a51.exe
5060	10eda700692685734da85bb625fddacd4ba6dbd955777072c1a5a5630f395a51.exe
3564	Terms.exe
3564	Terms.exe
5060	10eda700692685734da85bb625fddacd4ba6dbd955777072c1a5a5630f395a51.exe
5060	10eda700692685734da85bb625fddacd4ba6dbd955777072c1a5a5630f395a51.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Terms.exe

description pid process

Token: SeDebugPrivilege 3564 Terms.exe

description	pid	process
Token: SeDebugPrivilege	3564	Terms.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

10eda700692685734da85bb625fddacd4ba6dbd955777072c1a5a5630f395a51.exe

description	pid	process	target process
PID 5060 wrote to memory of 636	5060	10eda700692685734da85bb625fddacd4ba6dbd955777072c1a5a5630f395a51.exe	WScript.exe
PID 5060 wrote to memory of 636	5060	10eda700692685734da85bb625fddacd4ba6dbd955777072c1a5a5630f395a51.exe	WScript.exe
PID 5060 wrote to memory of 636	5060	10eda700692685734da85bb625fddacd4ba6dbd955777072c1a5a5630f395a51.exe	WScript.exe

C:\Users\Admin\AppData\Local\Temp\10eda700692685734da85bb625fddacd4ba6dbd955777072c1a5a5630f395a51.exe
"C:\Users\Admin\AppData\Local\Temp\10eda700692685734da85bb625fddacd4ba6dbd955777072c1a5a5630f395a51.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5060

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\644.vbs"
2⤵
PID:636

C:\Windows\Terms.exe
C:\Windows\Terms.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3564

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\644.vbs

Filesize
500B

MD5
6b8cf6e1e77e803e8ae08c64533b7a93

SHA1
e299a316c61b41918f3eacf97239c29fc86fec8a

SHA256
8153d7054d66ca67fe2ae836c3ba7eba4b6d9a2e7cb67365d90f3a05c6898f45

SHA512
a0f874c88c9af4a8520cb1929992cfb6ed142178805bd2ae937443e3f5ba36df2b647a36253b3eb03709860edc20ce9a5551da725b474b5fb91c30f96eb2c694

Download Submit
C:\Windows\Terms.exe

Filesize
109KB

MD5
2c21f027e67a788505346a48f679ec52

SHA1
3e5a0a24124046298f44abdedd17cac2103fb560

SHA256
10eda700692685734da85bb625fddacd4ba6dbd955777072c1a5a5630f395a51

SHA512
25762bd3907cc9920f68fb070f4ff591757e12c80382a96fb8cd146c9f77abca5dc363836eae60764670be3bc1369e5dbbc84f33fdb68f3b77c9055ee60fdca8

Download Submit
C:\Windows\Terms.exe

Filesize
109KB

MD5
2c21f027e67a788505346a48f679ec52

SHA1
3e5a0a24124046298f44abdedd17cac2103fb560

SHA256
10eda700692685734da85bb625fddacd4ba6dbd955777072c1a5a5630f395a51

SHA512
25762bd3907cc9920f68fb070f4ff591757e12c80382a96fb8cd146c9f77abca5dc363836eae60764670be3bc1369e5dbbc84f33fdb68f3b77c9055ee60fdca8

Download Submit
memory/636-137-0x0000000000000000-mapping.dmp

Download
memory/3564-135-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3564-139-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/5060-132-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/5060-136-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads