gh0strat | c660ace33bc9a82ff6b0f600b7cede4b533c72721ab31758b1775eb6757662e9

Analysis

max time kernel
148s
max time network
136s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 00:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c660ace33bc9a82ff6b0f600b7cede4b533c72721ab31758b1775eb6757662e9.exe
Size

1.6MB
MD5

47265030482ff347272cdf09aef25e8d
SHA1

2ae7ac78dc11f0374389f1f15031a1a1a4d30b70
SHA256

c660ace33bc9a82ff6b0f600b7cede4b533c72721ab31758b1775eb6757662e9
SHA512

35c09678bde4841c3bc0432229c6b84bd4ca39c963290cfcc7d25bb6b10002346e0dc798c684bf9d3ab95b4e286f5366430758733ee2f33eb8610e9773e78b0e
SSDEEP

24576:U61I7CpxnYP1uyFQ3OfzYSu2+PVAJeA4Qsi84XVKCuVSs1DKNbGvFic2Y+O:D+7vdNwERuDrZQsN4YpSKWG9ic2Yl

Score

10^/10

gh0strat rat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/1720-73-0x0000000000400000-0x0000000000432800-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Executes dropped EXE 3 IoCs

pid	Process
1464	¾¢Îè6.9Í¨ÓÃ°æ£¨Ö§³ÖË½·þ£©.exe
1720	server.exe
1668	dedcisjxuu

Loads dropped DLL 5 IoCs

pid	Process
1552	c660ace33bc9a82ff6b0f600b7cede4b533c72721ab31758b1775eb6757662e9.exe
1552	c660ace33bc9a82ff6b0f600b7cede4b533c72721ab31758b1775eb6757662e9.exe
1552	c660ace33bc9a82ff6b0f600b7cede4b533c72721ab31758b1775eb6757662e9.exe
1552	c660ace33bc9a82ff6b0f600b7cede4b533c72721ab31758b1775eb6757662e9.exe
1720	server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377173350"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A5AA0871-7618-11ED-BDDC-626677DD231B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000577a4e8c989fa34ca15aacf76e598b8e00000000020000000000106600000001000020000000bfff82df9dd300b134acf46d58989265bfb895b3059b5e9fb97b8a1eba068a37000000000e80000000020000200000006459a0df7a18b1f48a647f5cf7a81192286cdf3b30753b8e485f1bfd2e35abd2900000007f92e8b261726abc93b64d0a0c0abcc5795a9c8fb706b50b92e47f165dd93f149d0ee2e7867101a8b30f01398224fb9e3ee69334484e799bef4e8e61121ae97b9dac3818cc45917bb13d0a5358890d360701228d01a02d0767630329b9fd3ce6133629cff80d7e2bc0d85b24971d676dd560785c7ef566880eaea5121f8a644e51aba0918371f9f515faa419ad94211b400000002e2fa800214311b238bac35fea210e3b80f7abff65da821395ecdbf0553fb96a047ef3b2ba43f3362c513765400213f50ef6000d5422755971ad63d2675e5abd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60e70f85250ad901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000577a4e8c989fa34ca15aacf76e598b8e00000000020000000000106600000001000020000000314c5ead4f0909bae249246f3f9d28d150ad8cfcdc3b043f68938d32ec8317f4000000000e80000000020000200000007a079c8b770b3abe62efac0094b980f7330940f5a94ea0a2700f4c2f3b594f5c200000002675fde47eac1dceae793ef5f353f9f1c215cfa89a26638fa068d4259e05a12140000000e01cb15747110427ce1189fcc566affd9ae00db706e432d30ee15a1b497d836f97289a3b1611eb42384dd13bf82fc6eff1261891d78a84cdf9e006cc843732b0	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1720	server.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	1720	server.exe
Token: SeBackupPrivilege	1720	server.exe
Token: SeBackupPrivilege	1720	server.exe
Token: SeRestorePrivilege	1720	server.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1476	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1464	¾¢Îè6.9Í¨ÓÃ°æ£¨Ö§³ÖË½·þ£©.exe
1464	¾¢Îè6.9Í¨ÓÃ°æ£¨Ö§³ÖË½·þ£©.exe
1476	iexplore.exe
1476	iexplore.exe
1912	IEXPLORE.EXE
1912	IEXPLORE.EXE
1912	IEXPLORE.EXE
1912	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 1464	1552	c660ace33bc9a82ff6b0f600b7cede4b533c72721ab31758b1775eb6757662e9.exe	26
PID 1552 wrote to memory of 1464	1552	c660ace33bc9a82ff6b0f600b7cede4b533c72721ab31758b1775eb6757662e9.exe	26
PID 1552 wrote to memory of 1464	1552	c660ace33bc9a82ff6b0f600b7cede4b533c72721ab31758b1775eb6757662e9.exe	26
PID 1552 wrote to memory of 1464	1552	c660ace33bc9a82ff6b0f600b7cede4b533c72721ab31758b1775eb6757662e9.exe	26
PID 1552 wrote to memory of 1720	1552	c660ace33bc9a82ff6b0f600b7cede4b533c72721ab31758b1775eb6757662e9.exe	27
PID 1552 wrote to memory of 1720	1552	c660ace33bc9a82ff6b0f600b7cede4b533c72721ab31758b1775eb6757662e9.exe	27
PID 1552 wrote to memory of 1720	1552	c660ace33bc9a82ff6b0f600b7cede4b533c72721ab31758b1775eb6757662e9.exe	27
PID 1552 wrote to memory of 1720	1552	c660ace33bc9a82ff6b0f600b7cede4b533c72721ab31758b1775eb6757662e9.exe	27
PID 1464 wrote to memory of 1476	1464	¾¢Îè6.9Í¨ÓÃ°æ£¨Ö§³ÖË½·þ£©.exe	28
PID 1464 wrote to memory of 1476	1464	¾¢Îè6.9Í¨ÓÃ°æ£¨Ö§³ÖË½·þ£©.exe	28
PID 1464 wrote to memory of 1476	1464	¾¢Îè6.9Í¨ÓÃ°æ£¨Ö§³ÖË½·þ£©.exe	28
PID 1464 wrote to memory of 1476	1464	¾¢Îè6.9Í¨ÓÃ°æ£¨Ö§³ÖË½·þ£©.exe	28
PID 1476 wrote to memory of 1912	1476	iexplore.exe	30
PID 1476 wrote to memory of 1912	1476	iexplore.exe	30
PID 1476 wrote to memory of 1912	1476	iexplore.exe	30
PID 1476 wrote to memory of 1912	1476	iexplore.exe	30

C:\Users\Admin\AppData\Local\Temp\c660ace33bc9a82ff6b0f600b7cede4b533c72721ab31758b1775eb6757662e9.exe
"C:\Users\Admin\AppData\Local\Temp\c660ace33bc9a82ff6b0f600b7cede4b533c72721ab31758b1775eb6757662e9.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Users\Admin\AppData\Local\Temp\¾¢Îè6.9Í¨ÓÃ°æ£¨Ö§³ÖË½·þ£©.exe
  "C:\Users\Admin\AppData\Local\Temp\¾¢Îè6.9Í¨ÓÃ°æ£¨Ö§³ÖË½·þ£©.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1464
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://www.5203y.com/
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1476
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1476 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1912
- C:\Users\Admin\AppData\Local\Temp\server.exe
  "C:\Users\Admin\AppData\Local\Temp\server.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1720
- - \??\c:\users\admin\appdata\local\dedcisjxuu
    "C:\Users\Admin\AppData\Local\Temp\server.exe" a -sc:\users\admin\appdata\local\temp\server.exe
    3⤵
    - Executes dropped EXE
    PID:1668

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\server.exe

Filesize
196KB

MD5
54b5926b964e7280448dff92eff7fd38

SHA1
d9fa67ffe3e33a530a929368bcec80212d57477e

SHA256
375d6fc7db4185183b562b63352d89a5865d3d3f7d9b7988ed48f4e2af600c95

SHA512
b0ab73c30503aa14b207b17e10b492c4cfe39896e247d4de245068756671298cc6498538f20947245ff182d6df3945487644b3e1d8c41eef27e60610f7aedae2

Download Submit
C:\Users\Admin\AppData\Local\Temp\¾¢Îè6.9Í¨ÓÃ°æ£¨Ö§³ÖË½·þ£©.exe

Filesize
904KB

MD5
99ea9f16c4f432f12d23ac1f50f05fbc

SHA1
660bda601a4f6c078d47ffdc91bba3a6875dda0f

SHA256
b8c05c9f4bdd4fb29b7d1c50771c630cfeed85b3fb26146e171cd75cba2542d4

SHA512
783a892754092ccbfb462487751f690a3df72aa9e5c6c88d6a229e04b8f24ee11da3de0b282d8e1707edc11ae07c96e49ca27ddc0b7df71ec10f88b17930d985

Download Submit
C:\Users\Admin\AppData\Local\dedcisjxuu

Filesize
23.7MB

MD5
8a41d175a2a6473bce239e518a584983

SHA1
e686ddb39c29462c7ea9da086a66f835a812563e

SHA256
946f824b3296b0fc7a1905050c1352a1d0769d59de565a8736b30eb2b08177ff

SHA512
819028c229e5ac3d7da769b79b30f43abb5561fa0e1d58a88e408d005c26cfdbb27ff2565536b9f209eeb8c718388378041c778f02d68b3b904129c25d6f2c1d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\LUKGJUDP.txt

Filesize
603B

MD5
7a3cb5165a7a60ae911779b5348c464b

SHA1
0f54e5e48ac96044f8ad090838c330e6ab9c78b1

SHA256
38929a2ec2fe71a2bd9e8e8f9bf8520e2466c8f9d6d890297ef7e1b1a307102c

SHA512
eb04c9eb61c98860ab706f1f4e19c1bed3cbca5e0050d4549baee2e7cc2e1a047c417e8107b9b76919cdc5cae232e8e2d5d0e874374f81d0532b7060852954b7

Download Submit
\??\c:\users\admin\appdata\local\temp\server.exe

Filesize
196KB

MD5
54b5926b964e7280448dff92eff7fd38

SHA1
d9fa67ffe3e33a530a929368bcec80212d57477e

SHA256
375d6fc7db4185183b562b63352d89a5865d3d3f7d9b7988ed48f4e2af600c95

SHA512
b0ab73c30503aa14b207b17e10b492c4cfe39896e247d4de245068756671298cc6498538f20947245ff182d6df3945487644b3e1d8c41eef27e60610f7aedae2

Download Submit
\Users\Admin\AppData\Local\Temp\server.exe

Filesize
196KB

MD5
54b5926b964e7280448dff92eff7fd38

SHA1
d9fa67ffe3e33a530a929368bcec80212d57477e

SHA256
375d6fc7db4185183b562b63352d89a5865d3d3f7d9b7988ed48f4e2af600c95

SHA512
b0ab73c30503aa14b207b17e10b492c4cfe39896e247d4de245068756671298cc6498538f20947245ff182d6df3945487644b3e1d8c41eef27e60610f7aedae2

Download Submit
\Users\Admin\AppData\Local\Temp\server.exe

Filesize
196KB

MD5
54b5926b964e7280448dff92eff7fd38

SHA1
d9fa67ffe3e33a530a929368bcec80212d57477e

SHA256
375d6fc7db4185183b562b63352d89a5865d3d3f7d9b7988ed48f4e2af600c95

SHA512
b0ab73c30503aa14b207b17e10b492c4cfe39896e247d4de245068756671298cc6498538f20947245ff182d6df3945487644b3e1d8c41eef27e60610f7aedae2

Download Submit
\Users\Admin\AppData\Local\Temp\¾¢Îè6.9Í¨ÓÃ°æ£¨Ö§³ÖË½·þ£©.exe

Filesize
904KB

MD5
99ea9f16c4f432f12d23ac1f50f05fbc

SHA1
660bda601a4f6c078d47ffdc91bba3a6875dda0f

SHA256
b8c05c9f4bdd4fb29b7d1c50771c630cfeed85b3fb26146e171cd75cba2542d4

SHA512
783a892754092ccbfb462487751f690a3df72aa9e5c6c88d6a229e04b8f24ee11da3de0b282d8e1707edc11ae07c96e49ca27ddc0b7df71ec10f88b17930d985

Download Submit
\Users\Admin\AppData\Local\Temp\¾¢Îè6.9Í¨ÓÃ°æ£¨Ö§³ÖË½·þ£©.exe

Filesize
904KB

MD5
99ea9f16c4f432f12d23ac1f50f05fbc

SHA1
660bda601a4f6c078d47ffdc91bba3a6875dda0f

SHA256
b8c05c9f4bdd4fb29b7d1c50771c630cfeed85b3fb26146e171cd75cba2542d4

SHA512
783a892754092ccbfb462487751f690a3df72aa9e5c6c88d6a229e04b8f24ee11da3de0b282d8e1707edc11ae07c96e49ca27ddc0b7df71ec10f88b17930d985

Download Submit
\Users\Admin\AppData\Local\dedcisjxuu

Filesize
23.7MB

MD5
8a41d175a2a6473bce239e518a584983

SHA1
e686ddb39c29462c7ea9da086a66f835a812563e

SHA256
946f824b3296b0fc7a1905050c1352a1d0769d59de565a8736b30eb2b08177ff

SHA512
819028c229e5ac3d7da769b79b30f43abb5561fa0e1d58a88e408d005c26cfdbb27ff2565536b9f209eeb8c718388378041c778f02d68b3b904129c25d6f2c1d

Download Submit
memory/1552-54-0x0000000075681000-0x0000000075683000-memory.dmp

Filesize
8KB

Download
memory/1668-69-0x0000000000400000-0x0000000000432800-memory.dmp

Filesize
202KB

Download
memory/1720-65-0x0000000000400000-0x0000000000432800-memory.dmp

Filesize
202KB

Download
memory/1720-64-0x0000000000400000-0x0000000000432800-memory.dmp

Filesize
202KB

Download
memory/1720-70-0x00000000002C0000-0x00000000002F3000-memory.dmp

Filesize
204KB

Download
memory/1720-71-0x00000000002C0000-0x00000000002F3000-memory.dmp

Filesize
204KB

Download
memory/1720-73-0x0000000000400000-0x0000000000432800-memory.dmp

Filesize
202KB

Download