gh0strat | d6a2db165f95e5fcae805d0fb2ffca85444fab396c3fadeaefc4421b459f4504

General

Target

d6a2db165f95e5fcae805d0fb2ffca85444fab396c3fadeaefc4421b459f4504.exe
Size

152KB
MD5

29df0df20067c5619bb71402989c9806
SHA1

e1a22cafc82f478bea576d609ef9f25141aa59e7
SHA256

d6a2db165f95e5fcae805d0fb2ffca85444fab396c3fadeaefc4421b459f4504
SHA512

4cda78987dab3668f0adb1d351102d35a0b3092db46aafcd113612cf96945e64a3bfeb1d92eed91e442d51eeb6567bdf81086461cf1fb9342b364d7101d3fe8a
SSDEEP

3072:LwF8T0PAmr9B4NgVjGt1rOikGML7oCmFZKnbmLLLU7:8FCqxB4Ng9GLjcoCmFJLXU7

Score

10^/10

Malware Config

Signatures

Gh0st RAT payload 7 IoCs

resource	yara_rule
behavioral1/files/0x0007000000005c50-57.dat	family_gh0strat
behavioral1/files/0x0007000000005c50-58.dat	family_gh0strat
behavioral1/files/0x0007000000005c50-59.dat	family_gh0strat
behavioral1/files/0x0007000000005c50-64.dat	family_gh0strat
behavioral1/files/0x0007000000005c50-65.dat	family_gh0strat
behavioral1/files/0x0007000000005c50-66.dat	family_gh0strat
behavioral1/files/0x0007000000005c50-67.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Blocklisted process makes network request 1 IoCs

flow	pid	Process
4	1408	rundll32.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\jkgaio21ujioac\Parameters\ServiceDll = "C:\\Windows\\system32\\mt6c5a9fm.dll"	d6a2db165f95e5fcae805d0fb2ffca85444fab396c3fadeaefc4421b459f4504.exe

Sets file execution options in registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\restrict.exe\Debugger = "services.exe"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ASDSvc.exe	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ASDSvc.exe\Debugger = "services.exe"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\restrict.exe	rundll32.exe

Deletes itself 1 IoCs

pid	Process
1632	cmd.exe

Loads dropped DLL 6 IoCs

pid	Process
1692	d6a2db165f95e5fcae805d0fb2ffca85444fab396c3fadeaefc4421b459f4504.exe
1260	svchost.exe
1408	rundll32.exe
1408	rundll32.exe
1408	rundll32.exe
1408	rundll32.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mt6c5a9fm.dll	d6a2db165f95e5fcae805d0fb2ffca85444fab396c3fadeaefc4421b459f4504.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 24 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	rundll32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D278EC1E-D948-43AE-A900-627358D724A7}\WpadNetworkName = "Network 3"	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-81-af-cf-c7-34\WpadDecisionReason = "1"	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-81-af-cf-c7-34\WpadDecision = "0"	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f007c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D278EC1E-D948-43AE-A900-627358D724A7}\WpadDecisionTime = a029cdeae003d901	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-81-af-cf-c7-34	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D278EC1E-D948-43AE-A900-627358D724A7}\WpadDecision = "0"	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-81-af-cf-c7-34\WpadDecisionTime = a029cdeae003d901	rundll32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D278EC1E-D948-43AE-A900-627358D724A7}	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D278EC1E-D948-43AE-A900-627358D724A7}\WpadDecisionReason = "1"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D278EC1E-D948-43AE-A900-627358D724A7}\ea-81-af-cf-c7-34	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	rundll32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	rundll32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1260	svchost.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1088	d6a2db165f95e5fcae805d0fb2ffca85444fab396c3fadeaefc4421b459f4504.exe
1088	d6a2db165f95e5fcae805d0fb2ffca85444fab396c3fadeaefc4421b459f4504.exe
1692	d6a2db165f95e5fcae805d0fb2ffca85444fab396c3fadeaefc4421b459f4504.exe
1692	d6a2db165f95e5fcae805d0fb2ffca85444fab396c3fadeaefc4421b459f4504.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 1692	1088	d6a2db165f95e5fcae805d0fb2ffca85444fab396c3fadeaefc4421b459f4504.exe	26
PID 1088 wrote to memory of 1692	1088	d6a2db165f95e5fcae805d0fb2ffca85444fab396c3fadeaefc4421b459f4504.exe	26
PID 1088 wrote to memory of 1692	1088	d6a2db165f95e5fcae805d0fb2ffca85444fab396c3fadeaefc4421b459f4504.exe	26
PID 1088 wrote to memory of 1692	1088	d6a2db165f95e5fcae805d0fb2ffca85444fab396c3fadeaefc4421b459f4504.exe	26
PID 1692 wrote to memory of 1632	1692	d6a2db165f95e5fcae805d0fb2ffca85444fab396c3fadeaefc4421b459f4504.exe	28
PID 1692 wrote to memory of 1632	1692	d6a2db165f95e5fcae805d0fb2ffca85444fab396c3fadeaefc4421b459f4504.exe	28
PID 1692 wrote to memory of 1632	1692	d6a2db165f95e5fcae805d0fb2ffca85444fab396c3fadeaefc4421b459f4504.exe	28
PID 1692 wrote to memory of 1632	1692	d6a2db165f95e5fcae805d0fb2ffca85444fab396c3fadeaefc4421b459f4504.exe	28
PID 1260 wrote to memory of 1408	1260	svchost.exe	30
PID 1260 wrote to memory of 1408	1260	svchost.exe	30
PID 1260 wrote to memory of 1408	1260	svchost.exe	30
PID 1260 wrote to memory of 1408	1260	svchost.exe	30
PID 1260 wrote to memory of 1408	1260	svchost.exe	30
PID 1260 wrote to memory of 1408	1260	svchost.exe	30
PID 1260 wrote to memory of 1408	1260	svchost.exe	30

C:\Users\Admin\AppData\Local\Temp\d6a2db165f95e5fcae805d0fb2ffca85444fab396c3fadeaefc4421b459f4504.exe
"C:\Users\Admin\AppData\Local\Temp\d6a2db165f95e5fcae805d0fb2ffca85444fab396c3fadeaefc4421b459f4504.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Users\Admin\AppData\Local\Temp\d6a2db165f95e5fcae805d0fb2ffca85444fab396c3fadeaefc4421b459f4504.exe
  "C:\Users\Admin\AppData\Local\Temp\d6a2db165f95e5fcae805d0fb2ffca85444fab396c3fadeaefc4421b459f4504.exe" TWO
  2⤵
  - Sets DLL path for service in the registry
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Temp\d6a2db165f95e5fcae805d0fb2ffca85444fab396c3fadeaefc4421b459f4504.exe" TWO
    3⤵
    - Deletes itself
    PID:1632

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "jkgaio21ujioac"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe c:\windows\system32\mt6c5a9fm.dll, slexp
  2⤵
  - Blocklisted process makes network request
  - Sets file execution options in registry
  - Loads dropped DLL
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:1408

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\mt6c5a9fm.dll

Filesize
134KB

MD5
6eccee6f47066d795c43fff4b8903e73

SHA1
a3e92d35729a55566c2779edfac734b4c6eb3d92

SHA256
3f6dc8b3bf7541e8ee8adac54fd2127b162bba753ad986c171ed47f119b0f915

SHA512
822b4fc11669de2a957fca658794f9bf759dec9e76a61c97fc51060d71fc18d48de4529facc5169734e9c8ef7b7822a97c86a044e1f4eecff98a893d3d58ae24

Download Submit
\Windows\SysWOW64\mt6c5a9fm.dll

Filesize
134KB

MD5
6eccee6f47066d795c43fff4b8903e73

SHA1
a3e92d35729a55566c2779edfac734b4c6eb3d92

SHA256
3f6dc8b3bf7541e8ee8adac54fd2127b162bba753ad986c171ed47f119b0f915

SHA512
822b4fc11669de2a957fca658794f9bf759dec9e76a61c97fc51060d71fc18d48de4529facc5169734e9c8ef7b7822a97c86a044e1f4eecff98a893d3d58ae24

Download Submit
\Windows\SysWOW64\mt6c5a9fm.dll

Filesize
134KB

MD5
6eccee6f47066d795c43fff4b8903e73

SHA1
a3e92d35729a55566c2779edfac734b4c6eb3d92

SHA256
3f6dc8b3bf7541e8ee8adac54fd2127b162bba753ad986c171ed47f119b0f915

SHA512
822b4fc11669de2a957fca658794f9bf759dec9e76a61c97fc51060d71fc18d48de4529facc5169734e9c8ef7b7822a97c86a044e1f4eecff98a893d3d58ae24

Download Submit
\Windows\SysWOW64\mt6c5a9fm.dll

Filesize
134KB

MD5
6eccee6f47066d795c43fff4b8903e73

SHA1
a3e92d35729a55566c2779edfac734b4c6eb3d92

SHA256
3f6dc8b3bf7541e8ee8adac54fd2127b162bba753ad986c171ed47f119b0f915

SHA512
822b4fc11669de2a957fca658794f9bf759dec9e76a61c97fc51060d71fc18d48de4529facc5169734e9c8ef7b7822a97c86a044e1f4eecff98a893d3d58ae24

Download Submit
\Windows\SysWOW64\mt6c5a9fm.dll

Filesize
134KB

MD5
6eccee6f47066d795c43fff4b8903e73

SHA1
a3e92d35729a55566c2779edfac734b4c6eb3d92

SHA256
3f6dc8b3bf7541e8ee8adac54fd2127b162bba753ad986c171ed47f119b0f915

SHA512
822b4fc11669de2a957fca658794f9bf759dec9e76a61c97fc51060d71fc18d48de4529facc5169734e9c8ef7b7822a97c86a044e1f4eecff98a893d3d58ae24

Download Submit
\Windows\SysWOW64\mt6c5a9fm.dll

Filesize
134KB

MD5
6eccee6f47066d795c43fff4b8903e73

SHA1
a3e92d35729a55566c2779edfac734b4c6eb3d92

SHA256
3f6dc8b3bf7541e8ee8adac54fd2127b162bba753ad986c171ed47f119b0f915

SHA512
822b4fc11669de2a957fca658794f9bf759dec9e76a61c97fc51060d71fc18d48de4529facc5169734e9c8ef7b7822a97c86a044e1f4eecff98a893d3d58ae24

Download Submit
\Windows\SysWOW64\mt6c5a9fm.dll

Filesize
134KB

MD5
6eccee6f47066d795c43fff4b8903e73

SHA1
a3e92d35729a55566c2779edfac734b4c6eb3d92

SHA256
3f6dc8b3bf7541e8ee8adac54fd2127b162bba753ad986c171ed47f119b0f915

SHA512
822b4fc11669de2a957fca658794f9bf759dec9e76a61c97fc51060d71fc18d48de4529facc5169734e9c8ef7b7822a97c86a044e1f4eecff98a893d3d58ae24

Download Submit
memory/1088-54-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads