gh0strat | 83f9878a9b2bbda7e88f88df63947efd9c55afe50abfff7a28f4c7df4aafe114

Analysis

max time kernel
170s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 11:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

83f9878a9b2bbda7e88f88df63947efd9c55afe50abfff7a28f4c7df4aafe114.exe
Size

88KB
MD5

d62bccacda615cbaacb022d1f37ce567
SHA1

e50dd823962b5219afe54866bfb0e7ba19824a68
SHA256

83f9878a9b2bbda7e88f88df63947efd9c55afe50abfff7a28f4c7df4aafe114
SHA512

76768fc44ce4a0ff37af8587ce2dc0f07953c371878c739ab4271a047a69a9ef64b9f1ee5f9991c753b7ca1873414dfd4f5d47a2f06202e9637d319d76b1fb90
SSDEEP

1536:mAhTyTTFQNC13U4rtnDb4tmJAuxJbCEryyfw6hqgrAjl+OP+ftTI00MRmhe:LhT2137DYmJAuxx9wPgrYl+OP+y00MRZ

Score

10^/10

gh0strat rat

Malware Config

Signatures

Gh0st RAT payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0009000000022e13-133.dat	family_gh0strat
behavioral2/files/0x0009000000022e13-134.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Executes dropped EXE 1 IoCs

pid	Process
4284	ghost-7666.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	83f9878a9b2bbda7e88f88df63947efd9c55afe50abfff7a28f4c7df4aafe114.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 4284	4748	83f9878a9b2bbda7e88f88df63947efd9c55afe50abfff7a28f4c7df4aafe114.exe	80
PID 4748 wrote to memory of 4284	4748	83f9878a9b2bbda7e88f88df63947efd9c55afe50abfff7a28f4c7df4aafe114.exe	80
PID 4748 wrote to memory of 4284	4748	83f9878a9b2bbda7e88f88df63947efd9c55afe50abfff7a28f4c7df4aafe114.exe	80

C:\Users\Admin\AppData\Local\Temp\83f9878a9b2bbda7e88f88df63947efd9c55afe50abfff7a28f4c7df4aafe114.exe
"C:\Users\Admin\AppData\Local\Temp\83f9878a9b2bbda7e88f88df63947efd9c55afe50abfff7a28f4c7df4aafe114.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4748
- C:\ghost-7666.exe
  "C:\ghost-7666.exe"
  2⤵
  - Executes dropped EXE
  PID:4284

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ghost-7666.exe

Filesize
106KB

MD5
f341f88c091e2dd581193eeeb5b3e0cb

SHA1
287f0dbfcff08b43804f83fc9a05fd94ebe590c0

SHA256
b3909e8f88e6a7971d8593b54a1cc174088f5abc63c80b12cfd82cb38de2fa9a

SHA512
7e10ba5e5fce92232c775d94441d782b86a638b099894bf74238fc50e4e296803d2d53d5da48eef4debc3d7d737778f3d7b5f9ece53956917788a2c2ca953479

Download Submit
C:\ghost-7666.exe

Filesize
106KB

MD5
f341f88c091e2dd581193eeeb5b3e0cb

SHA1
287f0dbfcff08b43804f83fc9a05fd94ebe590c0

SHA256
b3909e8f88e6a7971d8593b54a1cc174088f5abc63c80b12cfd82cb38de2fa9a

SHA512
7e10ba5e5fce92232c775d94441d782b86a638b099894bf74238fc50e4e296803d2d53d5da48eef4debc3d7d737778f3d7b5f9ece53956917788a2c2ca953479

Download Submit