gh0strat | d4a7cc4fcc630b1bbb4ecc13a60fb07402844cdeba24c76794e8b76bc84e858b

Analysis

max time kernel
128s
max time network
184s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 22:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d4a7cc4fcc630b1bbb4ecc13a60fb07402844cdeba24c76794e8b76bc84e858b.exe
Size

264KB
MD5

f6e0bb067bd37db70723c6a85bb88f00
SHA1

957589f6cde224a480ba6b8b9f0b89e86b6c58cc
SHA256

d4a7cc4fcc630b1bbb4ecc13a60fb07402844cdeba24c76794e8b76bc84e858b
SHA512

03253eb8c1189c443b92893e76e6619e18aadb08239fbee13ada8df942eda01f191be280cb325f41666d9549c1d53144f9ff3349e9763922ad6ddf24e288baa0
SSDEEP

6144:GZbXGgeRu/HYMDUkR3GKvf8QLBBzAM+GuN8QpKPW:GZjGgeRu1DUIlLbzL+jkW

Score

10^/10

gh0strat bootkit persistence rat

Malware Config

Signatures

Gh0st RAT payload 11 IoCs

resource	yara_rule
behavioral1/memory/1452-55-0x0000000000400000-0x0000000000479000-memory.dmp	family_gh0strat
behavioral1/files/0x00090000000133ec-64.dat	family_gh0strat
behavioral1/files/0x00090000000133ec-69.dat	family_gh0strat
behavioral1/files/0x00090000000133ec-68.dat	family_gh0strat
behavioral1/files/0x00090000000133ec-67.dat	family_gh0strat
behavioral1/files/0x00090000000133ec-66.dat	family_gh0strat
behavioral1/memory/2000-80-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral1/memory/1452-87-0x0000000000400000-0x0000000000479000-memory.dmp	family_gh0strat
behavioral1/memory/2000-81-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral1/memory/2000-79-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral1/memory/2000-78-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Executes dropped EXE 2 IoCs

pid	Process
2000	qiuqi0.exe
1068	qiuqi0.exe

Deletes itself 1 IoCs

pid	Process
1120	cmd.exe

Loads dropped DLL 11 IoCs

pid	Process
1452	d4a7cc4fcc630b1bbb4ecc13a60fb07402844cdeba24c76794e8b76bc84e858b.exe
2000	qiuqi0.exe
2000	qiuqi0.exe
1452	d4a7cc4fcc630b1bbb4ecc13a60fb07402844cdeba24c76794e8b76bc84e858b.exe
2000	qiuqi0.exe
2000	qiuqi0.exe
2000	qiuqi0.exe
2000	qiuqi0.exe
1068	qiuqi0.exe
1068	qiuqi0.exe
1068	qiuqi0.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	qiuqi0.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\qiuqi0.dll	d4a7cc4fcc630b1bbb4ecc13a60fb07402844cdeba24c76794e8b76bc84e858b.exe
File created	C:\Program Files\Common Files\qiuqi0.exe	d4a7cc4fcc630b1bbb4ecc13a60fb07402844cdeba24c76794e8b76bc84e858b.exe
File opened for modification	C:\Program Files\Common Files\qiuqi0.exe	d4a7cc4fcc630b1bbb4ecc13a60fb07402844cdeba24c76794e8b76bc84e858b.exe
File created	C:\Program Files\Common Files\qiuqi0.bat	d4a7cc4fcc630b1bbb4ecc13a60fb07402844cdeba24c76794e8b76bc84e858b.exe
File created	C:\Program Files\Common Files\maoma0.dll	d4a7cc4fcc630b1bbb4ecc13a60fb07402844cdeba24c76794e8b76bc84e858b.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	qiuqi0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	qiuqi0.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	qiuqi0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{603D3801-BD81-11d0-A3A5-00C04FD706EC}	qiuqi0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{603D3801-BD81-11d0-A3A5-00C04FD706EC}\InProcServer32	qiuqi0.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2000	qiuqi0.exe
2000	qiuqi0.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 2000	1452	d4a7cc4fcc630b1bbb4ecc13a60fb07402844cdeba24c76794e8b76bc84e858b.exe	28
PID 1452 wrote to memory of 2000	1452	d4a7cc4fcc630b1bbb4ecc13a60fb07402844cdeba24c76794e8b76bc84e858b.exe	28
PID 1452 wrote to memory of 2000	1452	d4a7cc4fcc630b1bbb4ecc13a60fb07402844cdeba24c76794e8b76bc84e858b.exe	28
PID 1452 wrote to memory of 2000	1452	d4a7cc4fcc630b1bbb4ecc13a60fb07402844cdeba24c76794e8b76bc84e858b.exe	28
PID 1452 wrote to memory of 2000	1452	d4a7cc4fcc630b1bbb4ecc13a60fb07402844cdeba24c76794e8b76bc84e858b.exe	28
PID 1452 wrote to memory of 2000	1452	d4a7cc4fcc630b1bbb4ecc13a60fb07402844cdeba24c76794e8b76bc84e858b.exe	28
PID 1452 wrote to memory of 2000	1452	d4a7cc4fcc630b1bbb4ecc13a60fb07402844cdeba24c76794e8b76bc84e858b.exe	28
PID 1452 wrote to memory of 1068	1452	d4a7cc4fcc630b1bbb4ecc13a60fb07402844cdeba24c76794e8b76bc84e858b.exe	29
PID 1452 wrote to memory of 1068	1452	d4a7cc4fcc630b1bbb4ecc13a60fb07402844cdeba24c76794e8b76bc84e858b.exe	29
PID 1452 wrote to memory of 1068	1452	d4a7cc4fcc630b1bbb4ecc13a60fb07402844cdeba24c76794e8b76bc84e858b.exe	29
PID 1452 wrote to memory of 1068	1452	d4a7cc4fcc630b1bbb4ecc13a60fb07402844cdeba24c76794e8b76bc84e858b.exe	29
PID 1452 wrote to memory of 1068	1452	d4a7cc4fcc630b1bbb4ecc13a60fb07402844cdeba24c76794e8b76bc84e858b.exe	29
PID 1452 wrote to memory of 1068	1452	d4a7cc4fcc630b1bbb4ecc13a60fb07402844cdeba24c76794e8b76bc84e858b.exe	29
PID 1452 wrote to memory of 1068	1452	d4a7cc4fcc630b1bbb4ecc13a60fb07402844cdeba24c76794e8b76bc84e858b.exe	29
PID 1068 wrote to memory of 1724	1068	qiuqi0.exe	30
PID 1068 wrote to memory of 1724	1068	qiuqi0.exe	30
PID 1068 wrote to memory of 1724	1068	qiuqi0.exe	30
PID 1068 wrote to memory of 1724	1068	qiuqi0.exe	30
PID 1068 wrote to memory of 1724	1068	qiuqi0.exe	30
PID 1068 wrote to memory of 1724	1068	qiuqi0.exe	30
PID 1068 wrote to memory of 1724	1068	qiuqi0.exe	30
PID 1452 wrote to memory of 1120	1452	d4a7cc4fcc630b1bbb4ecc13a60fb07402844cdeba24c76794e8b76bc84e858b.exe	31
PID 1452 wrote to memory of 1120	1452	d4a7cc4fcc630b1bbb4ecc13a60fb07402844cdeba24c76794e8b76bc84e858b.exe	31
PID 1452 wrote to memory of 1120	1452	d4a7cc4fcc630b1bbb4ecc13a60fb07402844cdeba24c76794e8b76bc84e858b.exe	31
PID 1452 wrote to memory of 1120	1452	d4a7cc4fcc630b1bbb4ecc13a60fb07402844cdeba24c76794e8b76bc84e858b.exe	31
PID 1452 wrote to memory of 1120	1452	d4a7cc4fcc630b1bbb4ecc13a60fb07402844cdeba24c76794e8b76bc84e858b.exe	31
PID 1452 wrote to memory of 1120	1452	d4a7cc4fcc630b1bbb4ecc13a60fb07402844cdeba24c76794e8b76bc84e858b.exe	31
PID 1452 wrote to memory of 1120	1452	d4a7cc4fcc630b1bbb4ecc13a60fb07402844cdeba24c76794e8b76bc84e858b.exe	31

C:\Users\Admin\AppData\Local\Temp\d4a7cc4fcc630b1bbb4ecc13a60fb07402844cdeba24c76794e8b76bc84e858b.exe
"C:\Users\Admin\AppData\Local\Temp\d4a7cc4fcc630b1bbb4ecc13a60fb07402844cdeba24c76794e8b76bc84e858b.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Program Files\Common Files\qiuqi0.exe
  "C:\Program Files\Common Files\qiuqi0.exe" "C:\Program Files\Common Files\maoma0.dll" ServiceMain
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:2000
- C:\Documents and Settings\qiuqi0.exe
  "C:\Documents and Settings\qiuqi0.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1068
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c del C:\DOCUME~1\qiuqi0.exe
    3⤵
    PID:1724
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del C:\Users\Admin\AppData\Local\Temp\D4A7CC~1.EXE
  2⤵
  - Deletes itself
  PID:1120

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Documents and Settings\qiuqi0.exe

Filesize
24.0MB

MD5
6db439517742ebdbbce40ab5b6e90a8b

SHA1
b65ea1547ffbe55aa52cd773a07ddae3af6e8c7c

SHA256
a14950c4328d4a29294d1a33204c2deb8c140bb792764d452076fe45f241829d

SHA512
ebec72483034ee4df260c60d4ec8f7349e85821dd3dd161c784d966c23e239dd8429ae221d419c54e9feb0cafdbd983ce14e6aef07fc26a39a95d83089b5e5f5

Download Submit
C:\Program Files\Common Files\maoma0.dll

Filesize
24.1MB

MD5
c83bffc4d2f1d1705c4a34b460679465

SHA1
edae402771d3d2d5abffa34f48b6f7053df5f3e9

SHA256
c55c4c674305d54252ff76bf4ebddcfc322bb9e8160210ff02ae16b54a8f25f0

SHA512
125e66c890a89810a06e93e9c59c4d67fadfbcbdf0867940f24cbe1ed2300a5e692fbefd21db773c7ad5c11ca812b6468a03ce318a7b197b043d788a84818a11

Download Submit
C:\Program Files\Common Files\qiuqi0.exe

Filesize
43KB

MD5
51138beea3e2c21ec44d0932c71762a8

SHA1
8939cf35447b22dd2c6e6f443446acc1bf986d58

SHA256
5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

SHA512
794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

Download Submit
C:\Program Files\Common Files\qiuqi0.exe

Filesize
43KB

MD5
51138beea3e2c21ec44d0932c71762a8

SHA1
8939cf35447b22dd2c6e6f443446acc1bf986d58

SHA256
5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

SHA512
794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

Download Submit
C:\Users\qiuqi0.exe

Filesize
24.0MB

MD5
6db439517742ebdbbce40ab5b6e90a8b

SHA1
b65ea1547ffbe55aa52cd773a07ddae3af6e8c7c

SHA256
a14950c4328d4a29294d1a33204c2deb8c140bb792764d452076fe45f241829d

SHA512
ebec72483034ee4df260c60d4ec8f7349e85821dd3dd161c784d966c23e239dd8429ae221d419c54e9feb0cafdbd983ce14e6aef07fc26a39a95d83089b5e5f5

Download Submit
\Program Files\Common Files\maoma0.dll

Filesize
24.1MB

MD5
c83bffc4d2f1d1705c4a34b460679465

SHA1
edae402771d3d2d5abffa34f48b6f7053df5f3e9

SHA256
c55c4c674305d54252ff76bf4ebddcfc322bb9e8160210ff02ae16b54a8f25f0

SHA512
125e66c890a89810a06e93e9c59c4d67fadfbcbdf0867940f24cbe1ed2300a5e692fbefd21db773c7ad5c11ca812b6468a03ce318a7b197b043d788a84818a11

Download Submit
\Program Files\Common Files\maoma0.dll

Filesize
24.1MB

MD5
c83bffc4d2f1d1705c4a34b460679465

SHA1
edae402771d3d2d5abffa34f48b6f7053df5f3e9

SHA256
c55c4c674305d54252ff76bf4ebddcfc322bb9e8160210ff02ae16b54a8f25f0

SHA512
125e66c890a89810a06e93e9c59c4d67fadfbcbdf0867940f24cbe1ed2300a5e692fbefd21db773c7ad5c11ca812b6468a03ce318a7b197b043d788a84818a11

Download Submit
\Program Files\Common Files\maoma0.dll

Filesize
24.1MB

MD5
c83bffc4d2f1d1705c4a34b460679465

SHA1
edae402771d3d2d5abffa34f48b6f7053df5f3e9

SHA256
c55c4c674305d54252ff76bf4ebddcfc322bb9e8160210ff02ae16b54a8f25f0

SHA512
125e66c890a89810a06e93e9c59c4d67fadfbcbdf0867940f24cbe1ed2300a5e692fbefd21db773c7ad5c11ca812b6468a03ce318a7b197b043d788a84818a11

Download Submit
\Program Files\Common Files\maoma0.dll

Filesize
24.1MB

MD5
c83bffc4d2f1d1705c4a34b460679465

SHA1
edae402771d3d2d5abffa34f48b6f7053df5f3e9

SHA256
c55c4c674305d54252ff76bf4ebddcfc322bb9e8160210ff02ae16b54a8f25f0

SHA512
125e66c890a89810a06e93e9c59c4d67fadfbcbdf0867940f24cbe1ed2300a5e692fbefd21db773c7ad5c11ca812b6468a03ce318a7b197b043d788a84818a11

Download Submit
\Program Files\Common Files\qiuqi0.exe

Filesize
43KB

MD5
51138beea3e2c21ec44d0932c71762a8

SHA1
8939cf35447b22dd2c6e6f443446acc1bf986d58

SHA256
5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

SHA512
794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

Download Submit
\Program Files\Common Files\qiuqi0.exe

Filesize
43KB

MD5
51138beea3e2c21ec44d0932c71762a8

SHA1
8939cf35447b22dd2c6e6f443446acc1bf986d58

SHA256
5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

SHA512
794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

Download Submit
\Program Files\Common Files\qiuqi0.exe

Filesize
43KB

MD5
51138beea3e2c21ec44d0932c71762a8

SHA1
8939cf35447b22dd2c6e6f443446acc1bf986d58

SHA256
5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

SHA512
794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

Download Submit
\Users\qiuqi0.exe

Filesize
24.0MB

MD5
6db439517742ebdbbce40ab5b6e90a8b

SHA1
b65ea1547ffbe55aa52cd773a07ddae3af6e8c7c

SHA256
a14950c4328d4a29294d1a33204c2deb8c140bb792764d452076fe45f241829d

SHA512
ebec72483034ee4df260c60d4ec8f7349e85821dd3dd161c784d966c23e239dd8429ae221d419c54e9feb0cafdbd983ce14e6aef07fc26a39a95d83089b5e5f5

Download Submit
\Users\qiuqi0.exe

Filesize
24.0MB

MD5
6db439517742ebdbbce40ab5b6e90a8b

SHA1
b65ea1547ffbe55aa52cd773a07ddae3af6e8c7c

SHA256
a14950c4328d4a29294d1a33204c2deb8c140bb792764d452076fe45f241829d

SHA512
ebec72483034ee4df260c60d4ec8f7349e85821dd3dd161c784d966c23e239dd8429ae221d419c54e9feb0cafdbd983ce14e6aef07fc26a39a95d83089b5e5f5

Download Submit
\Users\qiuqi0.exe

Filesize
24.0MB

MD5
6db439517742ebdbbce40ab5b6e90a8b

SHA1
b65ea1547ffbe55aa52cd773a07ddae3af6e8c7c

SHA256
a14950c4328d4a29294d1a33204c2deb8c140bb792764d452076fe45f241829d

SHA512
ebec72483034ee4df260c60d4ec8f7349e85821dd3dd161c784d966c23e239dd8429ae221d419c54e9feb0cafdbd983ce14e6aef07fc26a39a95d83089b5e5f5

Download Submit
\Users\qiuqi0.exe

Filesize
24.0MB

MD5
6db439517742ebdbbce40ab5b6e90a8b

SHA1
b65ea1547ffbe55aa52cd773a07ddae3af6e8c7c

SHA256
a14950c4328d4a29294d1a33204c2deb8c140bb792764d452076fe45f241829d

SHA512
ebec72483034ee4df260c60d4ec8f7349e85821dd3dd161c784d966c23e239dd8429ae221d419c54e9feb0cafdbd983ce14e6aef07fc26a39a95d83089b5e5f5

Download Submit
memory/1068-70-0x0000000000000000-mapping.dmp

Download
memory/1068-84-0x0000000000020000-0x0000000000026000-memory.dmp

Filesize
24KB

Download
memory/1068-85-0x0000000000020000-0x0000000000026000-memory.dmp

Filesize
24KB

Download
memory/1068-83-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1120-86-0x0000000000000000-mapping.dmp

Download
memory/1452-87-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1452-73-0x00000000003A0000-0x00000000003A6000-memory.dmp

Filesize
24KB

Download
memory/1452-55-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1452-54-0x0000000076941000-0x0000000076943000-memory.dmp

Filesize
8KB

Download
memory/1452-56-0x0000000000240000-0x00000000002B9000-memory.dmp

Filesize
484KB

Download
memory/1724-82-0x0000000000000000-mapping.dmp

Download
memory/2000-80-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/2000-81-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/2000-79-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/2000-58-0x0000000000000000-mapping.dmp

Download
memory/2000-78-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download