gh0strat | acba7be5d97ab5945782666e4b9379775b483d67fd6451b6dabac3ddf6a9e02a

General

Target

acba7be5d97ab5945782666e4b9379775b483d67fd6451b6dabac3ddf6a9e02a.exe
Size

152KB
MD5

553704745f569ee423914de4067db62a
SHA1

c5cc3b31d96851ca2402cce1aa0da5764af2d1a3
SHA256

acba7be5d97ab5945782666e4b9379775b483d67fd6451b6dabac3ddf6a9e02a
SHA512

e5146f98621c8c2ff84468c650e2d07bcc57a171e1bd99e28381ae2e0af23e6080cbde91455be1fb233a3c833d3e7a33944c40717ce2bf54aea8dc4302118a3a
SSDEEP

3072:LwF8T0PAmr9B4NgVjGt1rOikGML7oCmFZKnbmLLLUZ:8FCqxB4Ng9GLjcoCmFJLXUZ

Score

10^/10

gh0strat persistence rat

Malware Config

Signatures

Gh0st RAT payload 4 IoCs

Processes:

resource	yara_rule
C:\Windows\SysWOW64\mte56edd0m.dll	family_gh0strat
\??\c:\windows\SysWOW64\mte56edd0m.dll	family_gh0strat
C:\Windows\SysWOW64\mte56edd0m.dll	family_gh0strat
C:\Windows\SysWOW64\mte56edd0m.dll	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Blocklisted process makes network request 5 IoCs

Processes:

rundll32.exe

flow pid process

6 8 rundll32.exe
38 8 rundll32.exe
42 8 rundll32.exe
44 8 rundll32.exe
46 8 rundll32.exe

flow	pid	process
6	8	rundll32.exe
38	8	rundll32.exe
42	8	rundll32.exe
44	8	rundll32.exe
46	8	rundll32.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

acba7be5d97ab5945782666e4b9379775b483d67fd6451b6dabac3ddf6a9e02a.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\hiuoak27hbzkla\Parameters\ServiceDll = "C:\\Windows\\system32\\mte56edd0m.dll"	acba7be5d97ab5945782666e4b9379775b483d67fd6451b6dabac3ddf6a9e02a.exe

Sets file execution options in registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\restrict.exe	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\restrict.exe\Debugger = "services.exe"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ASDSvc.exe	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ASDSvc.exe\Debugger = "services.exe"	rundll32.exe

Loads dropped DLL 3 IoCs

Processes:

acba7be5d97ab5945782666e4b9379775b483d67fd6451b6dabac3ddf6a9e02a.exesvchost.exerundll32.exe

pid process

3028 acba7be5d97ab5945782666e4b9379775b483d67fd6451b6dabac3ddf6a9e02a.exe
2056 svchost.exe
8 rundll32.exe
Drops file in System32 directory 1 IoCs

Processes:

acba7be5d97ab5945782666e4b9379775b483d67fd6451b6dabac3ddf6a9e02a.exe

description ioc process

File created C:\Windows\SysWOW64\mte56edd0m.dll acba7be5d97ab5945782666e4b9379775b483d67fd6451b6dabac3ddf6a9e02a.exe

description	ioc	process
File created	C:\Windows\SysWOW64\mte56edd0m.dll	acba7be5d97ab5945782666e4b9379775b483d67fd6451b6dabac3ddf6a9e02a.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

rundll32.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeDebugPrivilege 2056 svchost.exe

description	pid	process
Token: SeDebugPrivilege	2056	svchost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

acba7be5d97ab5945782666e4b9379775b483d67fd6451b6dabac3ddf6a9e02a.exe

pid	process
3028	acba7be5d97ab5945782666e4b9379775b483d67fd6451b6dabac3ddf6a9e02a.exe
3028	acba7be5d97ab5945782666e4b9379775b483d67fd6451b6dabac3ddf6a9e02a.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

acba7be5d97ab5945782666e4b9379775b483d67fd6451b6dabac3ddf6a9e02a.exesvchost.exe

description	pid	process	target process
PID 3028 wrote to memory of 3184	3028	acba7be5d97ab5945782666e4b9379775b483d67fd6451b6dabac3ddf6a9e02a.exe	cmd.exe
PID 3028 wrote to memory of 3184	3028	acba7be5d97ab5945782666e4b9379775b483d67fd6451b6dabac3ddf6a9e02a.exe	cmd.exe
PID 3028 wrote to memory of 3184	3028	acba7be5d97ab5945782666e4b9379775b483d67fd6451b6dabac3ddf6a9e02a.exe	cmd.exe
PID 2056 wrote to memory of 8	2056	svchost.exe	rundll32.exe
PID 2056 wrote to memory of 8	2056	svchost.exe	rundll32.exe
PID 2056 wrote to memory of 8	2056	svchost.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\acba7be5d97ab5945782666e4b9379775b483d67fd6451b6dabac3ddf6a9e02a.exe
"C:\Users\Admin\AppData\Local\Temp\acba7be5d97ab5945782666e4b9379775b483d67fd6451b6dabac3ddf6a9e02a.exe"
1⤵
- Sets DLL path for service in the registry
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028

C:\Windows\SysWOW64\cmd.exe
cmd /c del "C:\Users\Admin\AppData\Local\Temp\acba7be5d97ab5945782666e4b9379775b483d67fd6451b6dabac3ddf6a9e02a.exe"
2⤵
PID:3184

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "hiuoak27hbzkla"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2056

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe c:\windows\system32\mte56edd0m.dll, slexp
2⤵
- Blocklisted process makes network request
- Sets file execution options in registry
- Loads dropped DLL
- Modifies data under HKEY_USERS
PID:8

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\mte56edd0m.dll
Filesize
134KB

MD5
0b935e31b86356120d0f5dc83acda5d4

SHA1
e6de4855dff47032b3c4001faf4be42895e1d079

SHA256
f20beefbc2cad2e8c3826b5201e4451c5384d39fbb107d854cf4cfe22a170b37

SHA512
037bdebee74a02cde79c977d399a8ece588c525934b837e2b3c644203b6bdfd90197a00ff5326d86b1d416ff29dcdac933e0e0259bbae712e9c1265ea87eadb0

Download Submit
C:\Windows\SysWOW64\mte56edd0m.dll
Filesize
134KB

MD5
0b935e31b86356120d0f5dc83acda5d4

SHA1
e6de4855dff47032b3c4001faf4be42895e1d079

SHA256
f20beefbc2cad2e8c3826b5201e4451c5384d39fbb107d854cf4cfe22a170b37

SHA512
037bdebee74a02cde79c977d399a8ece588c525934b837e2b3c644203b6bdfd90197a00ff5326d86b1d416ff29dcdac933e0e0259bbae712e9c1265ea87eadb0

Download Submit
C:\Windows\SysWOW64\mte56edd0m.dll
Filesize
134KB

MD5
0b935e31b86356120d0f5dc83acda5d4

SHA1
e6de4855dff47032b3c4001faf4be42895e1d079

SHA256
f20beefbc2cad2e8c3826b5201e4451c5384d39fbb107d854cf4cfe22a170b37

SHA512
037bdebee74a02cde79c977d399a8ece588c525934b837e2b3c644203b6bdfd90197a00ff5326d86b1d416ff29dcdac933e0e0259bbae712e9c1265ea87eadb0

Download Submit
\??\c:\windows\SysWOW64\mte56edd0m.dll
Filesize
134KB

MD5
0b935e31b86356120d0f5dc83acda5d4

SHA1
e6de4855dff47032b3c4001faf4be42895e1d079

SHA256
f20beefbc2cad2e8c3826b5201e4451c5384d39fbb107d854cf4cfe22a170b37

SHA512
037bdebee74a02cde79c977d399a8ece588c525934b837e2b3c644203b6bdfd90197a00ff5326d86b1d416ff29dcdac933e0e0259bbae712e9c1265ea87eadb0

Download Submit
memory/8-136-0x0000000000000000-mapping.dmp

Download
memory/3184-135-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads