gh0strat | ccf989ed46b37a95539e639d7d48202498f8fe1401e11e6190d3e4a124e255e0

Analysis

max time kernel
358s
max time network
444s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2022 01:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ccf989ed46b37a95539e639d7d48202498f8fe1401e11e6190d3e4a124e255e0.exe
Size

168KB
MD5

6fab44045e90ca4673c331bfd84f0ee9
SHA1

b9c5991228e3870266d0a7a7741734ad4f026ce5
SHA256

ccf989ed46b37a95539e639d7d48202498f8fe1401e11e6190d3e4a124e255e0
SHA512

05c75c864730a387646123210aeb359845c01219981d1a69958f886d9931a8e240ae1c05e3f72175549e84204e8758b789bb1ff3575da58b73c326bc2e858024
SSDEEP

3072:a55WhN9npi8X7+0rbaemqKKgrkF0tIjnK0LHB8BwXc4+4uFXBfOJ4lQHwmj3ypdX:a55WzZX7+0rb1mq+lIj3LHmBwXcxfXFP

Score

10^/10

gh0strat rat

Malware Config

Signatures

Gh0st RAT payload 5 IoCs

resource	yara_rule
behavioral2/files/0x0006000000022e42-132.dat	family_gh0strat
behavioral2/files/0x0006000000022e42-133.dat	family_gh0strat
behavioral2/files/0x0006000000022e45-134.dat	family_gh0strat
behavioral2/files/0x0008000000022e1b-136.dat	family_gh0strat
behavioral2/files/0x0008000000022e1b-137.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Executes dropped EXE 2 IoCs

pid	Process
3040	xcbtye.exe
4972	hrl56.tmp

Loads dropped DLL 1 IoCs

pid	Process
3040	xcbtye.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\hra33.dll	xcbtye.exe
File created	C:\Windows\SysWOW64\xcbtye.exe	ccf989ed46b37a95539e639d7d48202498f8fe1401e11e6190d3e4a124e255e0.exe
File opened for modification	C:\Windows\SysWOW64\xcbtye.exe	ccf989ed46b37a95539e639d7d48202498f8fe1401e11e6190d3e4a124e255e0.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 4972	3040	xcbtye.exe	83
PID 3040 wrote to memory of 4972	3040	xcbtye.exe	83
PID 3040 wrote to memory of 4972	3040	xcbtye.exe	83

C:\Users\Admin\AppData\Local\Temp\ccf989ed46b37a95539e639d7d48202498f8fe1401e11e6190d3e4a124e255e0.exe
"C:\Users\Admin\AppData\Local\Temp\ccf989ed46b37a95539e639d7d48202498f8fe1401e11e6190d3e4a124e255e0.exe"
1⤵
- Drops file in System32 directory
PID:4168

C:\Windows\SysWOW64\xcbtye.exe
C:\Windows\SysWOW64\xcbtye.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\TEMP\hrl56.tmp
  C:\Windows\TEMP\hrl56.tmp
  2⤵
  - Executes dropped EXE
  PID:4972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hra33.dll

Filesize
176KB

MD5
16d420ad185c870e0ec5c248dcc09bbf

SHA1
817a79befc5f940f3dd82a75749488868929d612

SHA256
3bbb2c3cc011b81c5dc0e49e94a0d1250a8c6fe54efcd1a61d478a1552da2d49

SHA512
515509856a02ac468a0951fbc46724b50e7889f975242b34dd8bde56dc7a8f3d24e5a0df6a2ab3e47a82b642802f052651fbdaccc64fb399ddd20baa0136416e

Download Submit
C:\Windows\SysWOW64\xcbtye.exe

Filesize
168KB

MD5
6fab44045e90ca4673c331bfd84f0ee9

SHA1
b9c5991228e3870266d0a7a7741734ad4f026ce5

SHA256
ccf989ed46b37a95539e639d7d48202498f8fe1401e11e6190d3e4a124e255e0

SHA512
05c75c864730a387646123210aeb359845c01219981d1a69958f886d9931a8e240ae1c05e3f72175549e84204e8758b789bb1ff3575da58b73c326bc2e858024

Download Submit
C:\Windows\SysWOW64\xcbtye.exe

Filesize
168KB

MD5
6fab44045e90ca4673c331bfd84f0ee9

SHA1
b9c5991228e3870266d0a7a7741734ad4f026ce5

SHA256
ccf989ed46b37a95539e639d7d48202498f8fe1401e11e6190d3e4a124e255e0

SHA512
05c75c864730a387646123210aeb359845c01219981d1a69958f886d9931a8e240ae1c05e3f72175549e84204e8758b789bb1ff3575da58b73c326bc2e858024

Download Submit
C:\Windows\TEMP\hrl56.tmp

Filesize
168KB

MD5
6fab44045e90ca4673c331bfd84f0ee9

SHA1
b9c5991228e3870266d0a7a7741734ad4f026ce5

SHA256
ccf989ed46b37a95539e639d7d48202498f8fe1401e11e6190d3e4a124e255e0

SHA512
05c75c864730a387646123210aeb359845c01219981d1a69958f886d9931a8e240ae1c05e3f72175549e84204e8758b789bb1ff3575da58b73c326bc2e858024

Download Submit
C:\Windows\Temp\hrl56.tmp

Filesize
168KB

MD5
6fab44045e90ca4673c331bfd84f0ee9

SHA1
b9c5991228e3870266d0a7a7741734ad4f026ce5

SHA256
ccf989ed46b37a95539e639d7d48202498f8fe1401e11e6190d3e4a124e255e0

SHA512
05c75c864730a387646123210aeb359845c01219981d1a69958f886d9931a8e240ae1c05e3f72175549e84204e8758b789bb1ff3575da58b73c326bc2e858024

Download Submit