gh0strat | beb30955982281f5e0d08c2f9291441dfbe91eb69289fafb97517b5bd694e674

Analysis

max time kernel
218s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 22:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

beb30955982281f5e0d08c2f9291441dfbe91eb69289fafb97517b5bd694e674.exe
Size

150KB
MD5

3c572a8ae14c61812ba2441616d35ee0
SHA1

40a9bc3539a59c8bdf93c67fecdbbd72ffc88a11
SHA256

beb30955982281f5e0d08c2f9291441dfbe91eb69289fafb97517b5bd694e674
SHA512

bac3b8efc9fff502e6181575a8a3d27cb0c2b223df82a07754b2879f67ee3590dfef833694be80e215918e4bff38ecf834ce60fe0ba1d7312756d3f5355b252b
SSDEEP

3072:6ldlXTPtEgUJmh+aDY+puszTjGkZHKZApg0P77mag417WHFRlyAtd6A+:6RTPtEgTh+aDyszTKkZH1pg0P7rb7Wlq

Score

10^/10

gh0strat rat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/864-63-0x0000000000400000-0x0000000000430000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Executes dropped EXE 1 IoCs

pid	Process
864	D950.tmp

Loads dropped DLL 1 IoCs

pid	Process
1388	beb30955982281f5e0d08c2f9291441dfbe91eb69289fafb97517b5bd694e674.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\loader.dll	D950.tmp
File created	C:\Program Files\Common Files\lanmao.dll	D950.tmp

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\vbcfg.ini	D950.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 864	1388	beb30955982281f5e0d08c2f9291441dfbe91eb69289fafb97517b5bd694e674.exe	28
PID 1388 wrote to memory of 864	1388	beb30955982281f5e0d08c2f9291441dfbe91eb69289fafb97517b5bd694e674.exe	28
PID 1388 wrote to memory of 864	1388	beb30955982281f5e0d08c2f9291441dfbe91eb69289fafb97517b5bd694e674.exe	28
PID 1388 wrote to memory of 864	1388	beb30955982281f5e0d08c2f9291441dfbe91eb69289fafb97517b5bd694e674.exe	28
PID 1388 wrote to memory of 864	1388	beb30955982281f5e0d08c2f9291441dfbe91eb69289fafb97517b5bd694e674.exe	28
PID 1388 wrote to memory of 864	1388	beb30955982281f5e0d08c2f9291441dfbe91eb69289fafb97517b5bd694e674.exe	28
PID 1388 wrote to memory of 864	1388	beb30955982281f5e0d08c2f9291441dfbe91eb69289fafb97517b5bd694e674.exe	28

C:\Users\Admin\AppData\Local\Temp\beb30955982281f5e0d08c2f9291441dfbe91eb69289fafb97517b5bd694e674.exe
"C:\Users\Admin\AppData\Local\Temp\beb30955982281f5e0d08c2f9291441dfbe91eb69289fafb97517b5bd694e674.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Users\Admin\AppData\Roaming\D950.tmp
  C:\Users\Admin\AppData\Roaming\D950.tmp
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Drops file in Windows directory
  PID:864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\D950.tmp

Filesize
327.1MB

MD5
bd50f0492f1e6965967a19183ad59e0b

SHA1
f01826bb5c031216601c2e22638e083df78f6ae1

SHA256
b09928394ddad0ec7997ff02b9438a41c2ad284d4c6fa1321a6ceed2bf4035d7

SHA512
09e46311f75d9ba4f050b8190de1c19981cab4bb7f709eaa1bbc1a856e67e8628f41ea6cb344a9bf3b64915e9f20ce01c3c6e8b5c000851e0879591f5bac693a

Download Submit
C:\Users\Admin\AppData\Roaming\D950.tmp

Filesize
327.1MB

MD5
bd50f0492f1e6965967a19183ad59e0b

SHA1
f01826bb5c031216601c2e22638e083df78f6ae1

SHA256
b09928394ddad0ec7997ff02b9438a41c2ad284d4c6fa1321a6ceed2bf4035d7

SHA512
09e46311f75d9ba4f050b8190de1c19981cab4bb7f709eaa1bbc1a856e67e8628f41ea6cb344a9bf3b64915e9f20ce01c3c6e8b5c000851e0879591f5bac693a

Download Submit
\Users\Admin\AppData\Roaming\D950.tmp

Filesize
327.1MB

MD5
bd50f0492f1e6965967a19183ad59e0b

SHA1
f01826bb5c031216601c2e22638e083df78f6ae1

SHA256
b09928394ddad0ec7997ff02b9438a41c2ad284d4c6fa1321a6ceed2bf4035d7

SHA512
09e46311f75d9ba4f050b8190de1c19981cab4bb7f709eaa1bbc1a856e67e8628f41ea6cb344a9bf3b64915e9f20ce01c3c6e8b5c000851e0879591f5bac693a

Download Submit
memory/864-63-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1388-54-0x0000000075671000-0x0000000075673000-memory.dmp

Filesize
8KB

Download
memory/1388-55-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1388-56-0x0000000000020000-0x0000000000023000-memory.dmp

Filesize
12KB

Download
memory/1388-62-0x0000000000440000-0x0000000000470000-memory.dmp

Filesize
192KB

Download
memory/1388-64-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download