gh0strat | d533791983d8f51eff0567cf66b471e9e69bd9b5096a84287260bd21ace9f474

General

Target

d533791983d8f51eff0567cf66b471e9e69bd9b5096a84287260bd21ace9f474.exe
Size

156KB
MD5

3b167ad87eae016771c79d323622c84a
SHA1

6d882793461f4692bed40a902b75b302bd090106
SHA256

d533791983d8f51eff0567cf66b471e9e69bd9b5096a84287260bd21ace9f474
SHA512

833a8ae0e8a19a7c2ad06c71beea0c9e9dbbe0a5da2732b1c8515749eb7879c4880689596cb6f73fe78000c3a1d29421586fc148a464a655dd8d080a276224a9
SSDEEP

3072:PO+JlkeHRQFxJZWg/Dnq0iurbi6ZYYWYR5UtJ+c+aia:XlkeHR4ZVDPxVFWq5Ur+c+9a

Score

10^/10

gh0strat persistence rat

Malware Config

Signatures

Gh0st RAT payload 4 IoCs

Processes:

resource	yara_rule
C:\Windows\SysWOW64\mte575aa3m.dll	family_gh0strat
\??\c:\windows\SysWOW64\mte575aa3m.dll	family_gh0strat
C:\Windows\SysWOW64\mte575aa3m.dll	family_gh0strat
C:\Windows\SysWOW64\mte575aa3m.dll	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Blocklisted process makes network request 5 IoCs

Processes:

rundll32.exe

flow pid process

42 2444 rundll32.exe
67 2444 rundll32.exe
76 2444 rundll32.exe
84 2444 rundll32.exe
92 2444 rundll32.exe

flow	pid	process
42	2444	rundll32.exe
67	2444	rundll32.exe
76	2444	rundll32.exe
84	2444	rundll32.exe
92	2444	rundll32.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

d533791983d8f51eff0567cf66b471e9e69bd9b5096a84287260bd21ace9f474.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\rihjkdf3kjkdf3\Parameters\ServiceDll = "C:\\Windows\\system32\\mte575aa3m.dll"	d533791983d8f51eff0567cf66b471e9e69bd9b5096a84287260bd21ace9f474.exe

Sets file execution options in registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\restrict.exe	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\restrict.exe\Debugger = "services.exe"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ASDSvc.exe	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ASDSvc.exe\Debugger = "services.exe"	rundll32.exe

Loads dropped DLL 3 IoCs

Processes:

d533791983d8f51eff0567cf66b471e9e69bd9b5096a84287260bd21ace9f474.exesvchost.exerundll32.exe

pid process

2180 d533791983d8f51eff0567cf66b471e9e69bd9b5096a84287260bd21ace9f474.exe
2832 svchost.exe
2444 rundll32.exe
Drops file in System32 directory 1 IoCs

Processes:

d533791983d8f51eff0567cf66b471e9e69bd9b5096a84287260bd21ace9f474.exe

description ioc process

File created C:\Windows\SysWOW64\mte575aa3m.dll d533791983d8f51eff0567cf66b471e9e69bd9b5096a84287260bd21ace9f474.exe

description	ioc	process
File created	C:\Windows\SysWOW64\mte575aa3m.dll	d533791983d8f51eff0567cf66b471e9e69bd9b5096a84287260bd21ace9f474.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

rundll32.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeDebugPrivilege 2832 svchost.exe

description	pid	process
Token: SeDebugPrivilege	2832	svchost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

d533791983d8f51eff0567cf66b471e9e69bd9b5096a84287260bd21ace9f474.exe

pid	process
2180	d533791983d8f51eff0567cf66b471e9e69bd9b5096a84287260bd21ace9f474.exe
2180	d533791983d8f51eff0567cf66b471e9e69bd9b5096a84287260bd21ace9f474.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

d533791983d8f51eff0567cf66b471e9e69bd9b5096a84287260bd21ace9f474.exesvchost.exe

description	pid	process	target process
PID 2180 wrote to memory of 3448	2180	d533791983d8f51eff0567cf66b471e9e69bd9b5096a84287260bd21ace9f474.exe	cmd.exe
PID 2180 wrote to memory of 3448	2180	d533791983d8f51eff0567cf66b471e9e69bd9b5096a84287260bd21ace9f474.exe	cmd.exe
PID 2180 wrote to memory of 3448	2180	d533791983d8f51eff0567cf66b471e9e69bd9b5096a84287260bd21ace9f474.exe	cmd.exe
PID 2832 wrote to memory of 2444	2832	svchost.exe	rundll32.exe
PID 2832 wrote to memory of 2444	2832	svchost.exe	rundll32.exe
PID 2832 wrote to memory of 2444	2832	svchost.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\d533791983d8f51eff0567cf66b471e9e69bd9b5096a84287260bd21ace9f474.exe
"C:\Users\Admin\AppData\Local\Temp\d533791983d8f51eff0567cf66b471e9e69bd9b5096a84287260bd21ace9f474.exe"
1⤵
- Sets DLL path for service in the registry
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180

C:\Windows\SysWOW64\cmd.exe
cmd /c del "C:\Users\Admin\AppData\Local\Temp\d533791983d8f51eff0567cf66b471e9e69bd9b5096a84287260bd21ace9f474.exe"
2⤵
PID:3448

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "rihjkdf3kjkdf3"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2832

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe c:\windows\system32\mte575aa3m.dll, slexp
2⤵
- Blocklisted process makes network request
- Sets file execution options in registry
- Loads dropped DLL
- Modifies data under HKEY_USERS
PID:2444

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\mte575aa3m.dll
Filesize
137KB

MD5
41310eb3d0015982157b547ad801864c

SHA1
5132f679fc59e7f82a8d77d19073c1dd73f6772d

SHA256
1ddf3693e1e4086d9899fd96e42027759ac467536d63f928e319fc37423c7a25

SHA512
97099d805a11e9360980a44cffb7eb94b49ce5ee9f6b55a5197e53b8e1ee82333158512c8182bbd0053d4b837c8f848c49d88364bdb6bc9136d7dff39c87e46d

Download Submit
C:\Windows\SysWOW64\mte575aa3m.dll
Filesize
137KB

MD5
41310eb3d0015982157b547ad801864c

SHA1
5132f679fc59e7f82a8d77d19073c1dd73f6772d

SHA256
1ddf3693e1e4086d9899fd96e42027759ac467536d63f928e319fc37423c7a25

SHA512
97099d805a11e9360980a44cffb7eb94b49ce5ee9f6b55a5197e53b8e1ee82333158512c8182bbd0053d4b837c8f848c49d88364bdb6bc9136d7dff39c87e46d

Download Submit
C:\Windows\SysWOW64\mte575aa3m.dll
Filesize
137KB

MD5
41310eb3d0015982157b547ad801864c

SHA1
5132f679fc59e7f82a8d77d19073c1dd73f6772d

SHA256
1ddf3693e1e4086d9899fd96e42027759ac467536d63f928e319fc37423c7a25

SHA512
97099d805a11e9360980a44cffb7eb94b49ce5ee9f6b55a5197e53b8e1ee82333158512c8182bbd0053d4b837c8f848c49d88364bdb6bc9136d7dff39c87e46d

Download Submit
\??\c:\windows\SysWOW64\mte575aa3m.dll
Filesize
137KB

MD5
41310eb3d0015982157b547ad801864c

SHA1
5132f679fc59e7f82a8d77d19073c1dd73f6772d

SHA256
1ddf3693e1e4086d9899fd96e42027759ac467536d63f928e319fc37423c7a25

SHA512
97099d805a11e9360980a44cffb7eb94b49ce5ee9f6b55a5197e53b8e1ee82333158512c8182bbd0053d4b837c8f848c49d88364bdb6bc9136d7dff39c87e46d

Download Submit
memory/2444-136-0x0000000000000000-mapping.dmp

Download
memory/3448-135-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads