gh0strat | aa8d6c51236f9b97959a8e963d4573c6cb41ceff9532ab3cc5ad18d70c5ddeb6

Analysis

max time kernel
192s
max time network
246s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2022 17:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa8d6c51236f9b97959a8e963d4573c6cb41ceff9532ab3cc5ad18d70c5ddeb6.exe
Size

108KB
MD5

0e1ccb59daeffd4c3f95f265f0fc2c3c
SHA1

a898f0b55a807a4a963fbb74457041134d987790
SHA256

aa8d6c51236f9b97959a8e963d4573c6cb41ceff9532ab3cc5ad18d70c5ddeb6
SHA512

087796f8a48cd9caf0de1a1a21b38fb0f2223103241997ffdba16c58eb8e86238654b9bd1935bdfb9ce8d02eecf625e3a24b3e58e7567947d00aa106daad95c0
SSDEEP

3072:nEDp5IucmVVLVTuoKem/1EQ6vEpvHa3Ha16nzJ:nyp5IucmVVLVxj6HTpf716F

Score

10^/10

gh0strat persistence rat

Malware Config

Signatures

Gh0st RAT payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3408-134-0x0000000000400000-0x000000000041C000-memory.dmp	family_gh0strat
\??\c:\documents and settings\local user\onlycjeg.dll	family_gh0strat
C:\Users\Local User\onlycjeg.dll	family_gh0strat
behavioral2/memory/1320-137-0x0000000010000000-0x0000000010019000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

aa8d6c51236f9b97959a8e963d4573c6cb41ceff9532ab3cc5ad18d70c5ddeb6.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Documents and Settings\\Local User\\onlycjeg.dll"	aa8d6c51236f9b97959a8e963d4573c6cb41ceff9532ab3cc5ad18d70c5ddeb6.exe

Loads dropped DLL 1 IoCs

Processes:

SVCHOST.EXE

pid process

1320 SVCHOST.EXE
Kills process with taskkill 2 IoCs
evasion

Processes:

taskkill.exetaskkill.exe

pid process

1596 taskkill.exe
1800 taskkill.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

SVCHOST.EXE

pid process

1320 SVCHOST.EXE
1320 SVCHOST.EXE
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

taskkill.exetaskkill.exe

description pid process

Token: SeDebugPrivilege 1596 taskkill.exe
Token: SeDebugPrivilege 1800 taskkill.exe

pid	process
1320	SVCHOST.EXE

pid	process
1596	taskkill.exe
1800	taskkill.exe

pid	process
1320	SVCHOST.EXE
1320	SVCHOST.EXE

description	pid	process
Token: SeDebugPrivilege	1596	taskkill.exe
Token: SeDebugPrivilege	1800	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

aa8d6c51236f9b97959a8e963d4573c6cb41ceff9532ab3cc5ad18d70c5ddeb6.exe

description	pid	process	target process
PID 3408 wrote to memory of 1596	3408	aa8d6c51236f9b97959a8e963d4573c6cb41ceff9532ab3cc5ad18d70c5ddeb6.exe	taskkill.exe
PID 3408 wrote to memory of 1596	3408	aa8d6c51236f9b97959a8e963d4573c6cb41ceff9532ab3cc5ad18d70c5ddeb6.exe	taskkill.exe
PID 3408 wrote to memory of 1596	3408	aa8d6c51236f9b97959a8e963d4573c6cb41ceff9532ab3cc5ad18d70c5ddeb6.exe	taskkill.exe
PID 3408 wrote to memory of 1800	3408	aa8d6c51236f9b97959a8e963d4573c6cb41ceff9532ab3cc5ad18d70c5ddeb6.exe	taskkill.exe
PID 3408 wrote to memory of 1800	3408	aa8d6c51236f9b97959a8e963d4573c6cb41ceff9532ab3cc5ad18d70c5ddeb6.exe	taskkill.exe
PID 3408 wrote to memory of 1800	3408	aa8d6c51236f9b97959a8e963d4573c6cb41ceff9532ab3cc5ad18d70c5ddeb6.exe	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\aa8d6c51236f9b97959a8e963d4573c6cb41ceff9532ab3cc5ad18d70c5ddeb6.exe
"C:\Users\Admin\AppData\Local\Temp\aa8d6c51236f9b97959a8e963d4573c6cb41ceff9532ab3cc5ad18d70c5ddeb6.exe"
1⤵
- Sets DLL path for service in the registry
- Suspicious use of WriteProcessMemory
PID:3408

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /t /im 360inst.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1596

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /t /im ZhuDongFangYu.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1800

C:\Windows\SysWOW64\SVCHOST.EXE
C:\Windows\SysWOW64\SVCHOST.EXE -K NETSVCS -s FastUserSwitchingCompatibility
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1320

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Local User\onlycjeg.dll
Filesize
91KB

MD5
8985cb817bf4fe84bb28ca9446684b7c

SHA1
bc868d16ddb51c112189324a920b1f67637a6c22

SHA256
83bfdb30c6147e4f90d3719cbc60ec1ed9655b15fa77d8424fb992b8b5ab10ff

SHA512
a58130ffd8a5b21ded1feaa19bd96077dd9dc5abfe69ee8b2672fe1b7fdd1446e679e656c48925e3fd3d639aedd770184d55c71f15fa759b85149e14196320d5

Download Submit
\??\c:\documents and settings\local user\onlycjeg.dll
Filesize
91KB

MD5
8985cb817bf4fe84bb28ca9446684b7c

SHA1
bc868d16ddb51c112189324a920b1f67637a6c22

SHA256
83bfdb30c6147e4f90d3719cbc60ec1ed9655b15fa77d8424fb992b8b5ab10ff

SHA512
a58130ffd8a5b21ded1feaa19bd96077dd9dc5abfe69ee8b2672fe1b7fdd1446e679e656c48925e3fd3d639aedd770184d55c71f15fa759b85149e14196320d5

Download Submit
memory/1320-137-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/1596-132-0x0000000000000000-mapping.dmp

Download
memory/1800-133-0x0000000000000000-mapping.dmp

Download
memory/3408-134-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download