gh0strat | 046fe48a30c5bc1f216a050956223187164af9eac0d88858fa94e74f6ef8b57f

Analysis

max time kernel
151s
max time network
78s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 13:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

046fe48a30c5bc1f216a050956223187164af9eac0d88858fa94e74f6ef8b57f.exe
Size

63KB
MD5

f5513a736df6e28b746b6d4259779427
SHA1

768b7c01b66a1e6078eb2c0d0a14361c42bdbd3a
SHA256

046fe48a30c5bc1f216a050956223187164af9eac0d88858fa94e74f6ef8b57f
SHA512

946c91ee673b86fdc8d88a1d69305a57b8c27fe324df453c68951e9b32e6a45cdfc21eefcc33f33c836249ef77788b26811f41e6a4330c3261e3e4b4288fbb7b
SSDEEP

1536:p9H8QXFa87stKeGxS7q6dODuScslP26f3zNAvTU:LHtU7zWS7qXZluu3BAQ

Score

10^/10

gh0strat persistence rat

Malware Config

Signatures

Gh0st RAT payload 5 IoCs

resource	yara_rule
behavioral1/memory/1640-54-0x0000000000400000-0x0000000000433B73-memory.dmp	family_gh0strat
behavioral1/memory/1640-55-0x0000000000400000-0x0000000000433B73-memory.dmp	family_gh0strat
behavioral1/files/0x000b000000012315-57.dat	family_gh0strat
behavioral1/files/0x000b000000012315-56.dat	family_gh0strat
behavioral1/memory/1320-59-0x0000000010000000-0x000000001001F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\360svc\Parameters\ServiceDll = "C:\\Documents and Settings\\Local User\\ntuser.dll"	046fe48a30c5bc1f216a050956223187164af9eac0d88858fa94e74f6ef8b57f.exe

Deletes itself 1 IoCs

pid	Process
1320	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
1320	svchost.exe

C:\Users\Admin\AppData\Local\Temp\046fe48a30c5bc1f216a050956223187164af9eac0d88858fa94e74f6ef8b57f.exe
"C:\Users\Admin\AppData\Local\Temp\046fe48a30c5bc1f216a050956223187164af9eac0d88858fa94e74f6ef8b57f.exe"
1⤵
- Sets DLL path for service in the registry
PID:1640

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Deletes itself
- Loads dropped DLL
PID:1320

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\documents and settings\local user\ntuser.dll

Filesize
98KB

MD5
f4275e0290e6bd8b0257a6fdc3cf1a5f

SHA1
cb89f81c30e42e9ffe7246a571744a3a68846acd

SHA256
5baa5c8d632acc8c0d9b9b1ee9aae55a33ac1b02eb2ec94ea05acacdc7942305

SHA512
7a2e0fee1f2b8e88855c0a7c0a5357fb828b7e7395677d419c3551427b19e96dfd6d3b4adbd2d2a7fd0864acd211b8a048f361bbddd84be30f6323ed069b5f2f

Download Submit
\Users\Local User\ntuser.dll

Filesize
98KB

MD5
f4275e0290e6bd8b0257a6fdc3cf1a5f

SHA1
cb89f81c30e42e9ffe7246a571744a3a68846acd

SHA256
5baa5c8d632acc8c0d9b9b1ee9aae55a33ac1b02eb2ec94ea05acacdc7942305

SHA512
7a2e0fee1f2b8e88855c0a7c0a5357fb828b7e7395677d419c3551427b19e96dfd6d3b4adbd2d2a7fd0864acd211b8a048f361bbddd84be30f6323ed069b5f2f

Download Submit
memory/1320-58-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download
memory/1320-59-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download
memory/1640-54-0x0000000000400000-0x0000000000433B73-memory.dmp

Filesize
206KB

Download
memory/1640-55-0x0000000000400000-0x0000000000433B73-memory.dmp

Filesize
206KB

Download