gh0strat | 34b63019852ccf1381b11b24034cef4ba842c93ecd10b2d69c0fbaaed57ae89f

General

Target

34b63019852ccf1381b11b24034cef4ba842c93ecd10b2d69c0fbaaed57ae89f.exe
Size

152KB
MD5

5cf6ef1e3cdd65b37f31c9822ed3753e
SHA1

21eb377b21d9e3fb8c521c454a5367e971063fa2
SHA256

34b63019852ccf1381b11b24034cef4ba842c93ecd10b2d69c0fbaaed57ae89f
SHA512

c1facaf8ebab8b3b38a6c54189297c22ba9e9891b58362e7e9349dc36e6d64b7fc59a91c1a033ebe08e8a687ab2c66090173de1cecaf79a853357a598e0ee719
SSDEEP

3072:LwF8T0PAmr9B4NgVjGt1rOikGML7oCmFZKnbmLLLUP:8FCqxB4Ng9GLjcoCmFJLXUP

Score

10^/10

gh0strat persistence rat

Malware Config

Signatures

Gh0st RAT payload 7 IoCs

Processes:

resource	yara_rule
\Windows\SysWOW64\mt6ced3dm.dll	family_gh0strat
\??\c:\windows\SysWOW64\mt6ced3dm.dll	family_gh0strat
\Windows\SysWOW64\mt6ced3dm.dll	family_gh0strat
\Windows\SysWOW64\mt6ced3dm.dll	family_gh0strat
\Windows\SysWOW64\mt6ced3dm.dll	family_gh0strat
\Windows\SysWOW64\mt6ced3dm.dll	family_gh0strat
\Windows\SysWOW64\mt6ced3dm.dll	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

5 1516 rundll32.exe

flow	pid	process
5	1516	rundll32.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

34b63019852ccf1381b11b24034cef4ba842c93ecd10b2d69c0fbaaed57ae89f.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\jkgsaia22kjznl\Parameters\ServiceDll = "C:\\Windows\\system32\\mt6ced3dm.dll"	34b63019852ccf1381b11b24034cef4ba842c93ecd10b2d69c0fbaaed57ae89f.exe

Sets file execution options in registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ASDSvc.exe\Debugger = "services.exe"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\restrict.exe	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\restrict.exe\Debugger = "services.exe"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ASDSvc.exe	rundll32.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

828 cmd.exe

pid	process
828	cmd.exe

Loads dropped DLL 6 IoCs

Processes:

34b63019852ccf1381b11b24034cef4ba842c93ecd10b2d69c0fbaaed57ae89f.exesvchost.exerundll32.exe

pid	process
320	34b63019852ccf1381b11b24034cef4ba842c93ecd10b2d69c0fbaaed57ae89f.exe
572	svchost.exe
1516	rundll32.exe
1516	rundll32.exe
1516	rundll32.exe
1516	rundll32.exe

Drops file in System32 directory 2 IoCs

Processes:

34b63019852ccf1381b11b24034cef4ba842c93ecd10b2d69c0fbaaed57ae89f.exerundll32.exe

description	ioc	process
File created	C:\Windows\SysWOW64\mt6ced3dm.dll	34b63019852ccf1381b11b24034cef4ba842c93ecd10b2d69c0fbaaed57ae89f.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 24 IoCs

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CF075F74-D1AB-4B15-B3EA-91B398A11DF5}\WpadNetworkName = "Network 2"	rundll32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CF075F74-D1AB-4B15-B3EA-91B398A11DF5}\06-83-56-8d-13-6a	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CF075F74-D1AB-4B15-B3EA-91B398A11DF5}\WpadDecision = "0"	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CF075F74-D1AB-4B15-B3EA-91B398A11DF5}\WpadDecisionReason = "1"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-83-56-8d-13-6a	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-83-56-8d-13-6a\WpadDecisionTime = 70de8ef6e303d901	rundll32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f003c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CF075F74-D1AB-4B15-B3EA-91B398A11DF5}	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CF075F74-D1AB-4B15-B3EA-91B398A11DF5}\WpadDecisionTime = 70de8ef6e303d901	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-83-56-8d-13-6a\WpadDecisionReason = "1"	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-83-56-8d-13-6a\WpadDecision = "0"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	rundll32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeDebugPrivilege 572 svchost.exe

description	pid	process
Token: SeDebugPrivilege	572	svchost.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

34b63019852ccf1381b11b24034cef4ba842c93ecd10b2d69c0fbaaed57ae89f.exe34b63019852ccf1381b11b24034cef4ba842c93ecd10b2d69c0fbaaed57ae89f.exe

pid	process
1140	34b63019852ccf1381b11b24034cef4ba842c93ecd10b2d69c0fbaaed57ae89f.exe
1140	34b63019852ccf1381b11b24034cef4ba842c93ecd10b2d69c0fbaaed57ae89f.exe
320	34b63019852ccf1381b11b24034cef4ba842c93ecd10b2d69c0fbaaed57ae89f.exe
320	34b63019852ccf1381b11b24034cef4ba842c93ecd10b2d69c0fbaaed57ae89f.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

34b63019852ccf1381b11b24034cef4ba842c93ecd10b2d69c0fbaaed57ae89f.exe34b63019852ccf1381b11b24034cef4ba842c93ecd10b2d69c0fbaaed57ae89f.exesvchost.exe

description	pid	process	target process
PID 1140 wrote to memory of 320	1140	34b63019852ccf1381b11b24034cef4ba842c93ecd10b2d69c0fbaaed57ae89f.exe	34b63019852ccf1381b11b24034cef4ba842c93ecd10b2d69c0fbaaed57ae89f.exe
PID 1140 wrote to memory of 320	1140	34b63019852ccf1381b11b24034cef4ba842c93ecd10b2d69c0fbaaed57ae89f.exe	34b63019852ccf1381b11b24034cef4ba842c93ecd10b2d69c0fbaaed57ae89f.exe
PID 1140 wrote to memory of 320	1140	34b63019852ccf1381b11b24034cef4ba842c93ecd10b2d69c0fbaaed57ae89f.exe	34b63019852ccf1381b11b24034cef4ba842c93ecd10b2d69c0fbaaed57ae89f.exe
PID 1140 wrote to memory of 320	1140	34b63019852ccf1381b11b24034cef4ba842c93ecd10b2d69c0fbaaed57ae89f.exe	34b63019852ccf1381b11b24034cef4ba842c93ecd10b2d69c0fbaaed57ae89f.exe
PID 320 wrote to memory of 828	320	34b63019852ccf1381b11b24034cef4ba842c93ecd10b2d69c0fbaaed57ae89f.exe	cmd.exe
PID 320 wrote to memory of 828	320	34b63019852ccf1381b11b24034cef4ba842c93ecd10b2d69c0fbaaed57ae89f.exe	cmd.exe
PID 320 wrote to memory of 828	320	34b63019852ccf1381b11b24034cef4ba842c93ecd10b2d69c0fbaaed57ae89f.exe	cmd.exe
PID 320 wrote to memory of 828	320	34b63019852ccf1381b11b24034cef4ba842c93ecd10b2d69c0fbaaed57ae89f.exe	cmd.exe
PID 572 wrote to memory of 1516	572	svchost.exe	rundll32.exe
PID 572 wrote to memory of 1516	572	svchost.exe	rundll32.exe
PID 572 wrote to memory of 1516	572	svchost.exe	rundll32.exe
PID 572 wrote to memory of 1516	572	svchost.exe	rundll32.exe
PID 572 wrote to memory of 1516	572	svchost.exe	rundll32.exe
PID 572 wrote to memory of 1516	572	svchost.exe	rundll32.exe
PID 572 wrote to memory of 1516	572	svchost.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\34b63019852ccf1381b11b24034cef4ba842c93ecd10b2d69c0fbaaed57ae89f.exe
"C:\Users\Admin\AppData\Local\Temp\34b63019852ccf1381b11b24034cef4ba842c93ecd10b2d69c0fbaaed57ae89f.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1140

C:\Users\Admin\AppData\Local\Temp\34b63019852ccf1381b11b24034cef4ba842c93ecd10b2d69c0fbaaed57ae89f.exe
"C:\Users\Admin\AppData\Local\Temp\34b63019852ccf1381b11b24034cef4ba842c93ecd10b2d69c0fbaaed57ae89f.exe" TWO
2⤵
- Sets DLL path for service in the registry
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:320

C:\Windows\SysWOW64\cmd.exe
cmd /c del "C:\Users\Admin\AppData\Local\Temp\34b63019852ccf1381b11b24034cef4ba842c93ecd10b2d69c0fbaaed57ae89f.exe" TWO
3⤵
- Deletes itself
PID:828

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "jkgsaia22kjznl"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:572

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe c:\windows\system32\mt6ced3dm.dll, slexp
2⤵
- Blocklisted process makes network request
- Sets file execution options in registry
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1516

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\mt6ced3dm.dll

Filesize
134KB

MD5
ab420e65df285fe0ae0579dd93223dc6

SHA1
8709614eca06c722dc51f90d9bf993bf0c532b2c

SHA256
42d763d33e677910ad8fff393684296ac86106abe6478675ea8a29ab79e61103

SHA512
3b7bd58cb8a93f3d5ce47ffd3b9a42bdee06251707f2a80e5cbe07adb957589f24ab2741b4fbc6ff39184881acf4397e36e6053959f80a53b1451afa5c7b2666

Download Submit
\Windows\SysWOW64\mt6ced3dm.dll

Filesize
134KB

MD5
ab420e65df285fe0ae0579dd93223dc6

SHA1
8709614eca06c722dc51f90d9bf993bf0c532b2c

SHA256
42d763d33e677910ad8fff393684296ac86106abe6478675ea8a29ab79e61103

SHA512
3b7bd58cb8a93f3d5ce47ffd3b9a42bdee06251707f2a80e5cbe07adb957589f24ab2741b4fbc6ff39184881acf4397e36e6053959f80a53b1451afa5c7b2666

Download Submit
\Windows\SysWOW64\mt6ced3dm.dll

Filesize
134KB

MD5
ab420e65df285fe0ae0579dd93223dc6

SHA1
8709614eca06c722dc51f90d9bf993bf0c532b2c

SHA256
42d763d33e677910ad8fff393684296ac86106abe6478675ea8a29ab79e61103

SHA512
3b7bd58cb8a93f3d5ce47ffd3b9a42bdee06251707f2a80e5cbe07adb957589f24ab2741b4fbc6ff39184881acf4397e36e6053959f80a53b1451afa5c7b2666

Download Submit
\Windows\SysWOW64\mt6ced3dm.dll

Filesize
134KB

MD5
ab420e65df285fe0ae0579dd93223dc6

SHA1
8709614eca06c722dc51f90d9bf993bf0c532b2c

SHA256
42d763d33e677910ad8fff393684296ac86106abe6478675ea8a29ab79e61103

SHA512
3b7bd58cb8a93f3d5ce47ffd3b9a42bdee06251707f2a80e5cbe07adb957589f24ab2741b4fbc6ff39184881acf4397e36e6053959f80a53b1451afa5c7b2666

Download Submit
\Windows\SysWOW64\mt6ced3dm.dll

Filesize
134KB

MD5
ab420e65df285fe0ae0579dd93223dc6

SHA1
8709614eca06c722dc51f90d9bf993bf0c532b2c

SHA256
42d763d33e677910ad8fff393684296ac86106abe6478675ea8a29ab79e61103

SHA512
3b7bd58cb8a93f3d5ce47ffd3b9a42bdee06251707f2a80e5cbe07adb957589f24ab2741b4fbc6ff39184881acf4397e36e6053959f80a53b1451afa5c7b2666

Download Submit
\Windows\SysWOW64\mt6ced3dm.dll

Filesize
134KB

MD5
ab420e65df285fe0ae0579dd93223dc6

SHA1
8709614eca06c722dc51f90d9bf993bf0c532b2c

SHA256
42d763d33e677910ad8fff393684296ac86106abe6478675ea8a29ab79e61103

SHA512
3b7bd58cb8a93f3d5ce47ffd3b9a42bdee06251707f2a80e5cbe07adb957589f24ab2741b4fbc6ff39184881acf4397e36e6053959f80a53b1451afa5c7b2666

Download Submit
\Windows\SysWOW64\mt6ced3dm.dll

Filesize
134KB

MD5
ab420e65df285fe0ae0579dd93223dc6

SHA1
8709614eca06c722dc51f90d9bf993bf0c532b2c

SHA256
42d763d33e677910ad8fff393684296ac86106abe6478675ea8a29ab79e61103

SHA512
3b7bd58cb8a93f3d5ce47ffd3b9a42bdee06251707f2a80e5cbe07adb957589f24ab2741b4fbc6ff39184881acf4397e36e6053959f80a53b1451afa5c7b2666

Download Submit
memory/320-55-0x0000000000000000-mapping.dmp

Download
memory/828-61-0x0000000000000000-mapping.dmp

Download
memory/1140-54-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/1516-62-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads