gh0strat | ac565d3e4e105e926d7fc3bc59c54dd21acd6624b4884a8e6a67ce35653054cb

Analysis

max time kernel
208s
max time network
234s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 13:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac565d3e4e105e926d7fc3bc59c54dd21acd6624b4884a8e6a67ce35653054cb.exe
Size

196KB
MD5

37eb8554bea35102f6d5c938a8bf081c
SHA1

34787f8dcb6aaf5b669545ffa9dfb718962361a9
SHA256

ac565d3e4e105e926d7fc3bc59c54dd21acd6624b4884a8e6a67ce35653054cb
SHA512

19e6763545d887466686e0bdfde3cba8284a9ea75adf474713e75d230d382f2fbca7468ad35294a3f48be0c1328adbdc6e00e41c2346aed7457f9905b7139590
SSDEEP

6144:6sIt6nW8QoBTyPRqyhYPbHcTBlhHrIndnkv0:39W8YJq8YPbHcT3z

Score

10^/10

gh0strat rat

Malware Config

Signatures

Gh0st RAT payload 7 IoCs

resource	yara_rule
behavioral2/files/0x0005000000022651-133.dat	family_gh0strat
behavioral2/files/0x0005000000022651-134.dat	family_gh0strat
behavioral2/files/0x0005000000022662-135.dat	family_gh0strat
behavioral2/files/0x0005000000022662-136.dat	family_gh0strat
behavioral2/files/0x0005000000022662-137.dat	family_gh0strat
behavioral2/files/0x0005000000022662-138.dat	family_gh0strat
behavioral2/files/0x0005000000022662-140.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Executes dropped EXE 1 IoCs

pid	Process
536	bkpqnseifq

Loads dropped DLL 4 IoCs

pid	Process
3196	svchost.exe
4128	svchost.exe
4768	svchost.exe
5000	svchost.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\upjejyibqn	svchost.exe
File created	C:\Windows\SysWOW64\ueqqsaynfj	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\umoutenpmb	svchost.exe
File created	C:\Windows\SysWOW64\utjxyafaas	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\uihphkdfcy	svchost.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	\??\c:\PROGRA~3\drm\%SESSI~1\mniss.cc3	svchost.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
1804	4128	WerFault.exe	85
1724	3196	WerFault.exe	84
4804	4768	WerFault.exe	94
3872	5000	WerFault.exe	101

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
536	bkpqnseifq
536	bkpqnseifq

Suspicious use of AdjustPrivilegeToken 52 IoCs

description	pid	Process
Token: SeRestorePrivilege	536	bkpqnseifq
Token: SeBackupPrivilege	536	bkpqnseifq
Token: SeBackupPrivilege	536	bkpqnseifq
Token: SeRestorePrivilege	536	bkpqnseifq
Token: SeRestorePrivilege	536	bkpqnseifq
Token: SeBackupPrivilege	536	bkpqnseifq
Token: SeBackupPrivilege	536	bkpqnseifq
Token: SeRestorePrivilege	536	bkpqnseifq
Token: SeBackupPrivilege	3196	svchost.exe
Token: SeRestorePrivilege	3196	svchost.exe
Token: SeBackupPrivilege	3196	svchost.exe
Token: SeBackupPrivilege	3196	svchost.exe
Token: SeSecurityPrivilege	3196	svchost.exe
Token: SeBackupPrivilege	4128	svchost.exe
Token: SeRestorePrivilege	4128	svchost.exe
Token: SeBackupPrivilege	4128	svchost.exe
Token: SeBackupPrivilege	4128	svchost.exe
Token: SeSecurityPrivilege	4128	svchost.exe
Token: SeSecurityPrivilege	3196	svchost.exe
Token: SeBackupPrivilege	3196	svchost.exe
Token: SeBackupPrivilege	3196	svchost.exe
Token: SeSecurityPrivilege	3196	svchost.exe
Token: SeSecurityPrivilege	4128	svchost.exe
Token: SeBackupPrivilege	4128	svchost.exe
Token: SeBackupPrivilege	4128	svchost.exe
Token: SeSecurityPrivilege	4128	svchost.exe
Token: SeBackupPrivilege	3196	svchost.exe
Token: SeBackupPrivilege	4128	svchost.exe
Token: SeBackupPrivilege	3196	svchost.exe
Token: SeSecurityPrivilege	3196	svchost.exe
Token: SeBackupPrivilege	4128	svchost.exe
Token: SeSecurityPrivilege	4128	svchost.exe
Token: SeBackupPrivilege	4128	svchost.exe
Token: SeRestorePrivilege	4128	svchost.exe
Token: SeBackupPrivilege	4768	svchost.exe
Token: SeRestorePrivilege	4768	svchost.exe
Token: SeBackupPrivilege	4768	svchost.exe
Token: SeBackupPrivilege	4768	svchost.exe
Token: SeSecurityPrivilege	4768	svchost.exe
Token: SeSecurityPrivilege	4768	svchost.exe
Token: SeBackupPrivilege	4768	svchost.exe
Token: SeBackupPrivilege	4768	svchost.exe
Token: SeSecurityPrivilege	4768	svchost.exe
Token: SeBackupPrivilege	5000	svchost.exe
Token: SeRestorePrivilege	5000	svchost.exe
Token: SeBackupPrivilege	5000	svchost.exe
Token: SeBackupPrivilege	5000	svchost.exe
Token: SeSecurityPrivilege	5000	svchost.exe
Token: SeSecurityPrivilege	5000	svchost.exe
Token: SeBackupPrivilege	5000	svchost.exe
Token: SeBackupPrivilege	5000	svchost.exe
Token: SeSecurityPrivilege	5000	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 536	224	ac565d3e4e105e926d7fc3bc59c54dd21acd6624b4884a8e6a67ce35653054cb.exe	83
PID 224 wrote to memory of 536	224	ac565d3e4e105e926d7fc3bc59c54dd21acd6624b4884a8e6a67ce35653054cb.exe	83
PID 224 wrote to memory of 536	224	ac565d3e4e105e926d7fc3bc59c54dd21acd6624b4884a8e6a67ce35653054cb.exe	83

C:\Users\Admin\AppData\Local\Temp\ac565d3e4e105e926d7fc3bc59c54dd21acd6624b4884a8e6a67ce35653054cb.exe
"C:\Users\Admin\AppData\Local\Temp\ac565d3e4e105e926d7fc3bc59c54dd21acd6624b4884a8e6a67ce35653054cb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:224
- \??\c:\users\admin\appdata\local\bkpqnseifq
  "C:\Users\Admin\AppData\Local\Temp\ac565d3e4e105e926d7fc3bc59c54dd21acd6624b4884a8e6a67ce35653054cb.exe" a -sc:\users\admin\appdata\local\temp\ac565d3e4e105e926d7fc3bc59c54dd21acd6624b4884a8e6a67ce35653054cb.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:536

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3196
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 976
  2⤵
  - Program crash
  PID:1724

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s ias
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4128
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4128 -s 1048
  2⤵
  - Program crash
  PID:1804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4128 -ip 4128
1⤵
PID:4276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3196 -ip 3196
1⤵
PID:3700

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s ias
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 1116
  2⤵
  - Program crash
  PID:4804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4768 -ip 4768
1⤵
PID:3492

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s ias
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:5000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 1120
  2⤵
  - Program crash
  PID:3872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5000 -ip 5000
1⤵
PID:2880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\DRM\%SESSIONNAME%\mniss.cc3

Filesize
21.1MB

MD5
619448e60ba8e4b2c08a9e8a4bd0a752

SHA1
b2add05ee6e294aef90846db0dec9fc59bf2fa77

SHA256
8a213a8285720fb0ea902471f89a0222faec3c30bb5300472af7c3a225b168e9

SHA512
52cbfe21f8bdacab1cd7c9e7c29cf58b5b0567322fa8e0727d3a6ce513c61154b85a62adff6ac8b5fba22c24cc94cc021a30a425763ac462b0f4975cac0633ed

Download Submit
C:\ProgramData\DRM\%SESSIONNAME%\mniss.cc3

Filesize
21.1MB

MD5
619448e60ba8e4b2c08a9e8a4bd0a752

SHA1
b2add05ee6e294aef90846db0dec9fc59bf2fa77

SHA256
8a213a8285720fb0ea902471f89a0222faec3c30bb5300472af7c3a225b168e9

SHA512
52cbfe21f8bdacab1cd7c9e7c29cf58b5b0567322fa8e0727d3a6ce513c61154b85a62adff6ac8b5fba22c24cc94cc021a30a425763ac462b0f4975cac0633ed

Download Submit
C:\ProgramData\DRM\%SESSIONNAME%\mniss.cc3

Filesize
21.1MB

MD5
619448e60ba8e4b2c08a9e8a4bd0a752

SHA1
b2add05ee6e294aef90846db0dec9fc59bf2fa77

SHA256
8a213a8285720fb0ea902471f89a0222faec3c30bb5300472af7c3a225b168e9

SHA512
52cbfe21f8bdacab1cd7c9e7c29cf58b5b0567322fa8e0727d3a6ce513c61154b85a62adff6ac8b5fba22c24cc94cc021a30a425763ac462b0f4975cac0633ed

Download Submit
C:\ProgramData\DRM\%SESSIONNAME%\mniss.cc3

Filesize
21.1MB

MD5
619448e60ba8e4b2c08a9e8a4bd0a752

SHA1
b2add05ee6e294aef90846db0dec9fc59bf2fa77

SHA256
8a213a8285720fb0ea902471f89a0222faec3c30bb5300472af7c3a225b168e9

SHA512
52cbfe21f8bdacab1cd7c9e7c29cf58b5b0567322fa8e0727d3a6ce513c61154b85a62adff6ac8b5fba22c24cc94cc021a30a425763ac462b0f4975cac0633ed

Download Submit
C:\Users\Admin\AppData\Local\bkpqnseifq

Filesize
20.7MB

MD5
cfd20ce3d87f08f328185d712aa4a642

SHA1
d14debd8e52dd19af4abd955daa0eececffa1444

SHA256
1e2d7414a7edb3b0e8513f64d2e1a1134c17ddb576b069915758efa512c4ef97

SHA512
1838d572f9fda04d72c2cde55e82e7b154d0b67f2d9a3d808a171e3ba4eb8ba3f9c361558f200c127c9aa80359e9a037a7ee746d086136287321b8a1a2793a23

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
205B

MD5
26f441fb391c7d56f24facf786028ed8

SHA1
f35e3f1faf1e844541e4f5fd0ec97e3d4c9474a9

SHA256
a5555ab35eb7f3080bc10b2e391b688e6b32b0e4e8442a1280dcad1fe4c58f1c

SHA512
bc76b3c7182d19ede8493eda3cf7fc5b53393d329e0ca773372bb3dc7b3b1178e738409e58b33c63188e4ff4c401692122c30afb89446b4f8185bb6967ff9f82

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
308B

MD5
46dfa355869923ea8c5e60c3c2797b84

SHA1
4a0195d2a503eed230659f2c1f88890810db9845

SHA256
8f24983eed4bec6c09df56f40668c8c7bc300400da8b2fe5a19624d84a8efed6

SHA512
df9d94531ef3471c64de03d2df8e5f3dab288e281e95b7753787524e09257612e358e97fc4e3e749f5b68343c52d9c5b87e748bd8b51ce8ec410126b5b9f1146

Download Submit
\??\c:\programdata\drm\%sessionname%\mniss.cc3

Filesize
21.1MB

MD5
619448e60ba8e4b2c08a9e8a4bd0a752

SHA1
b2add05ee6e294aef90846db0dec9fc59bf2fa77

SHA256
8a213a8285720fb0ea902471f89a0222faec3c30bb5300472af7c3a225b168e9

SHA512
52cbfe21f8bdacab1cd7c9e7c29cf58b5b0567322fa8e0727d3a6ce513c61154b85a62adff6ac8b5fba22c24cc94cc021a30a425763ac462b0f4975cac0633ed

Download Submit
\??\c:\users\admin\appdata\local\bkpqnseifq

Filesize
20.7MB

MD5
cfd20ce3d87f08f328185d712aa4a642

SHA1
d14debd8e52dd19af4abd955daa0eececffa1444

SHA256
1e2d7414a7edb3b0e8513f64d2e1a1134c17ddb576b069915758efa512c4ef97

SHA512
1838d572f9fda04d72c2cde55e82e7b154d0b67f2d9a3d808a171e3ba4eb8ba3f9c361558f200c127c9aa80359e9a037a7ee746d086136287321b8a1a2793a23

Download Submit
memory/536-132-0x0000000000000000-mapping.dmp

Download