gh0strat | d9e816874564dd4f0b9d75e2041763f99bbfe197ce626fd5cd7d9c2d86f167bc

Analysis

max time kernel
19s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 12:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d9e816874564dd4f0b9d75e2041763f99bbfe197ce626fd5cd7d9c2d86f167bc.exe
Size

3.0MB
MD5

5cafb737f1daf9217e0ca94abd543ff8
SHA1

25342d22ffb9659814f6d20548322c107ef0c972
SHA256

d9e816874564dd4f0b9d75e2041763f99bbfe197ce626fd5cd7d9c2d86f167bc
SHA512

1b3e014859fbb83d3de2b8abde5714ee5a51683a36e4e3c10c5813c9a88bed8a97e41f7088eba0267a5394138992527e4ea7a0b3f56dd823079ae45a9ee208d6
SSDEEP

49152:zce7Idjnv3xj0OELL2Ek0cEmef2LdCq/jPaUzbW:4GIdjv3xjz6L2V0cEm2qjPFW

Score

10^/10

gh0strat rat vmprotect

Malware Config

Signatures

Gh0st RAT payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/936-55-0x0000000000400000-0x0000000000731000-memory.dmp	family_gh0strat
behavioral1/memory/936-56-0x0000000000400000-0x0000000000731000-memory.dmp	family_gh0strat
behavioral1/memory/936-58-0x0000000000400000-0x0000000000731000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral1/memory/936-55-0x0000000000400000-0x0000000000731000-memory.dmp	vmprotect
behavioral1/memory/936-56-0x0000000000400000-0x0000000000731000-memory.dmp	vmprotect
behavioral1/memory/936-58-0x0000000000400000-0x0000000000731000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

d9e816874564dd4f0b9d75e2041763f99bbfe197ce626fd5cd7d9c2d86f167bc.exe

pid process

936 d9e816874564dd4f0b9d75e2041763f99bbfe197ce626fd5cd7d9c2d86f167bc.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2004 936 WerFault.exe d9e816874564dd4f0b9d75e2041763f99bbfe197ce626fd5cd7d9c2d86f167bc.exe

pid	pid_target	process	target process
2004	936	WerFault.exe	d9e816874564dd4f0b9d75e2041763f99bbfe197ce626fd5cd7d9c2d86f167bc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

d9e816874564dd4f0b9d75e2041763f99bbfe197ce626fd5cd7d9c2d86f167bc.exe

pid	process
936	d9e816874564dd4f0b9d75e2041763f99bbfe197ce626fd5cd7d9c2d86f167bc.exe
936	d9e816874564dd4f0b9d75e2041763f99bbfe197ce626fd5cd7d9c2d86f167bc.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

d9e816874564dd4f0b9d75e2041763f99bbfe197ce626fd5cd7d9c2d86f167bc.exe

description	pid	process	target process
PID 936 wrote to memory of 2004	936	d9e816874564dd4f0b9d75e2041763f99bbfe197ce626fd5cd7d9c2d86f167bc.exe	WerFault.exe
PID 936 wrote to memory of 2004	936	d9e816874564dd4f0b9d75e2041763f99bbfe197ce626fd5cd7d9c2d86f167bc.exe	WerFault.exe
PID 936 wrote to memory of 2004	936	d9e816874564dd4f0b9d75e2041763f99bbfe197ce626fd5cd7d9c2d86f167bc.exe	WerFault.exe
PID 936 wrote to memory of 2004	936	d9e816874564dd4f0b9d75e2041763f99bbfe197ce626fd5cd7d9c2d86f167bc.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\d9e816874564dd4f0b9d75e2041763f99bbfe197ce626fd5cd7d9c2d86f167bc.exe
"C:\Users\Admin\AppData\Local\Temp\d9e816874564dd4f0b9d75e2041763f99bbfe197ce626fd5cd7d9c2d86f167bc.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 936 -s 280
2⤵
- Program crash
PID:2004

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/936-54-0x0000000076941000-0x0000000076943000-memory.dmp

Filesize
8KB

Download
memory/936-55-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/936-56-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/936-58-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/2004-57-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads