gh0strat | 755bd75343367080981a20517ffd65a9ef95a3976ba3e7fc3bdef7849cd35f17

General

Target

755bd75343367080981a20517ffd65a9ef95a3976ba3e7fc3bdef7849cd35f17.exe
Size

209KB
MD5

901c4df73ca9717ccc75de7ca85c57ad
SHA1

8a2dc49c0fd8e03ecaeb6ddc17f57bcadce84d18
SHA256

755bd75343367080981a20517ffd65a9ef95a3976ba3e7fc3bdef7849cd35f17
SHA512

5822e34db1e04188d0c7b1f758aa5a18ec5bf567fa38cd13b15cfbb5cbe262ce6f935515ffdda0899b4ec36c6fada66ebdc7d6323d339c1130d27e06e9a6ad82
SSDEEP

6144:sTBk6WUjcaJ8mMRCE3aNWKee/vxpcrgNAy1q:cy6jjc88XRCE3aNWwbcraA7

Score

10^/10

gh0strat bootkit persistence rat

Malware Config

Signatures

Gh0st RAT payload 2 IoCs

Processes:

resource	yara_rule
\??\c:\windows\SysWOW64\ntfastuserswitchingcompatibility.dll	family_gh0strat
\Windows\SysWOW64\ntfastuserswitchingcompatibility.dll	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

755bd75343367080981a20517ffd65a9ef95a3976ba3e7fc3bdef7849cd35f17.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\fastuserswitchingcompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\ntfastuserswitchingcompatibility.dll"	755bd75343367080981a20517ffd65a9ef95a3976ba3e7fc3bdef7849cd35f17.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

1600 svchost.exe
Loads dropped DLL 1 IoCs

Processes:

svchost.exe

pid process

1600 svchost.exe
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

svchost.exe

description ioc process

File opened for modification \??\PhysicalDrive0 svchost.exe

pid	process
1600	svchost.exe

pid	process
1600	svchost.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	svchost.exe

Drops file in System32 directory 2 IoCs

Processes:

755bd75343367080981a20517ffd65a9ef95a3976ba3e7fc3bdef7849cd35f17.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\d2f5ca0e.del	755bd75343367080981a20517ffd65a9ef95a3976ba3e7fc3bdef7849cd35f17.exe
File opened for modification	C:\Windows\SysWOW64\ntfastuserswitchingcompatibility.dll	755bd75343367080981a20517ffd65a9ef95a3976ba3e7fc3bdef7849cd35f17.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Modifies data under HKEY_USERS 6 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum\Version = "7"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	svchost.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

svchost.exe

description	pid	process
Token: SeBackupPrivilege	1600	svchost.exe
Token: SeSecurityPrivilege	1600	svchost.exe
Token: SeSecurityPrivilege	1600	svchost.exe
Token: SeBackupPrivilege	1600	svchost.exe
Token: SeSecurityPrivilege	1600	svchost.exe
Token: SeBackupPrivilege	1600	svchost.exe
Token: SeSecurityPrivilege	1600	svchost.exe

C:\Users\Admin\AppData\Local\Temp\755bd75343367080981a20517ffd65a9ef95a3976ba3e7fc3bdef7849cd35f17.exe
"C:\Users\Admin\AppData\Local\Temp\755bd75343367080981a20517ffd65a9ef95a3976ba3e7fc3bdef7849cd35f17.exe"
1⤵
- Sets DLL path for service in the registry
- Drops file in System32 directory
PID:2008

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Deletes itself
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1600

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Bootkit

1

T1067

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\ntfastuserswitchingcompatibility.dll
Filesize
153KB

MD5
dba8d4dab044ae358f069125a260a3bb

SHA1
5cbea12528d494643e0154d040c6fa581056625b

SHA256
196d52c660415938f2bae37b968145225b17d6d5b9e27117cdca65c71c255c41

SHA512
aa5c8a4bcd01b473572a1c40fcf56dd3c8d3573c9963aa8df2a127a93da9e4144700ec7667b1e9f4a24a3102c980167f992646308293d9024e8087bedaa92756

Download Submit
\Windows\SysWOW64\ntfastuserswitchingcompatibility.dll
Filesize
153KB

MD5
dba8d4dab044ae358f069125a260a3bb

SHA1
5cbea12528d494643e0154d040c6fa581056625b

SHA256
196d52c660415938f2bae37b968145225b17d6d5b9e27117cdca65c71c255c41

SHA512
aa5c8a4bcd01b473572a1c40fcf56dd3c8d3573c9963aa8df2a127a93da9e4144700ec7667b1e9f4a24a3102c980167f992646308293d9024e8087bedaa92756

Download Submit
memory/1600-56-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads