gh0strat | 9516bff6ff164376cebf71d54f4fdc4277d3b82842b8af30f3b85d93a68830ee

Analysis

max time kernel
232s
max time network
334s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 05:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9516bff6ff164376cebf71d54f4fdc4277d3b82842b8af30f3b85d93a68830ee.exe
Size

272KB
MD5

746b18598fa3ef1ea9940e1c34dfaab0
SHA1

8b521cfcf91e3e6da4f7ec85d9fc3f852ce798c3
SHA256

9516bff6ff164376cebf71d54f4fdc4277d3b82842b8af30f3b85d93a68830ee
SHA512

175efafe11b2fdd3914745a7deb6a806d5a9cac10f4b4d6ee48130278db6b4206658004d20d6856e0071952e3980bc21fe1fc0c7615742a188f8973bd11d37e1
SSDEEP

6144:QXt1geJ6RgCHsM1NpUgGsoozQ9bVxwuLm:It1geJagC516kgxwu

Score

10^/10

gh0strat rat

Malware Config

Signatures

Gh0st RAT payload 3 IoCs

resource	yara_rule
behavioral1/files/0x00090000000122f8-66.dat	family_gh0strat
behavioral1/memory/1520-67-0x0000000000400000-0x0000000000482000-memory.dmp	family_gh0strat
behavioral1/memory/1520-85-0x0000000000400000-0x0000000000482000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Executes dropped EXE 2 IoCs

pid	Process
672	ctfn0m.ini
996	ctrpnm.exe

Deletes itself 1 IoCs

pid	Process
2000	cmd.exe

Loads dropped DLL 5 IoCs

pid	Process
1520	9516bff6ff164376cebf71d54f4fdc4277d3b82842b8af30f3b85d93a68830ee.exe
1520	9516bff6ff164376cebf71d54f4fdc4277d3b82842b8af30f3b85d93a68830ee.exe
996	ctrpnm.exe
996	ctrpnm.exe
996	ctrpnm.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\loveuu.bat	9516bff6ff164376cebf71d54f4fdc4277d3b82842b8af30f3b85d93a68830ee.exe
File created	C:\Program Files\rmstcnb\klqdmmmj.rpn	9516bff6ff164376cebf71d54f4fdc4277d3b82842b8af30f3b85d93a68830ee.exe
File opened for modification	C:\Program Files\Common Files\loveuu.png	9516bff6ff164376cebf71d54f4fdc4277d3b82842b8af30f3b85d93a68830ee.exe
File created	C:\Program Files\Common Files\loveuu.png	9516bff6ff164376cebf71d54f4fdc4277d3b82842b8af30f3b85d93a68830ee.exe
File created	C:\Program Files\Common Files\ctfn0m.ini	9516bff6ff164376cebf71d54f4fdc4277d3b82842b8af30f3b85d93a68830ee.exe
File opened for modification	C:\Program Files\Common Files\ctfn0m.ini	9516bff6ff164376cebf71d54f4fdc4277d3b82842b8af30f3b85d93a68830ee.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1696	sc.exe
1100	sc.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 672	1520	9516bff6ff164376cebf71d54f4fdc4277d3b82842b8af30f3b85d93a68830ee.exe	28
PID 1520 wrote to memory of 672	1520	9516bff6ff164376cebf71d54f4fdc4277d3b82842b8af30f3b85d93a68830ee.exe	28
PID 1520 wrote to memory of 672	1520	9516bff6ff164376cebf71d54f4fdc4277d3b82842b8af30f3b85d93a68830ee.exe	28
PID 1520 wrote to memory of 672	1520	9516bff6ff164376cebf71d54f4fdc4277d3b82842b8af30f3b85d93a68830ee.exe	28
PID 1520 wrote to memory of 672	1520	9516bff6ff164376cebf71d54f4fdc4277d3b82842b8af30f3b85d93a68830ee.exe	28
PID 1520 wrote to memory of 672	1520	9516bff6ff164376cebf71d54f4fdc4277d3b82842b8af30f3b85d93a68830ee.exe	28
PID 1520 wrote to memory of 672	1520	9516bff6ff164376cebf71d54f4fdc4277d3b82842b8af30f3b85d93a68830ee.exe	28
PID 1520 wrote to memory of 1696	1520	9516bff6ff164376cebf71d54f4fdc4277d3b82842b8af30f3b85d93a68830ee.exe	29
PID 1520 wrote to memory of 1696	1520	9516bff6ff164376cebf71d54f4fdc4277d3b82842b8af30f3b85d93a68830ee.exe	29
PID 1520 wrote to memory of 1696	1520	9516bff6ff164376cebf71d54f4fdc4277d3b82842b8af30f3b85d93a68830ee.exe	29
PID 1520 wrote to memory of 1696	1520	9516bff6ff164376cebf71d54f4fdc4277d3b82842b8af30f3b85d93a68830ee.exe	29
PID 1520 wrote to memory of 1696	1520	9516bff6ff164376cebf71d54f4fdc4277d3b82842b8af30f3b85d93a68830ee.exe	29
PID 1520 wrote to memory of 1696	1520	9516bff6ff164376cebf71d54f4fdc4277d3b82842b8af30f3b85d93a68830ee.exe	29
PID 1520 wrote to memory of 1696	1520	9516bff6ff164376cebf71d54f4fdc4277d3b82842b8af30f3b85d93a68830ee.exe	29
PID 1520 wrote to memory of 1100	1520	9516bff6ff164376cebf71d54f4fdc4277d3b82842b8af30f3b85d93a68830ee.exe	30
PID 1520 wrote to memory of 1100	1520	9516bff6ff164376cebf71d54f4fdc4277d3b82842b8af30f3b85d93a68830ee.exe	30
PID 1520 wrote to memory of 1100	1520	9516bff6ff164376cebf71d54f4fdc4277d3b82842b8af30f3b85d93a68830ee.exe	30
PID 1520 wrote to memory of 1100	1520	9516bff6ff164376cebf71d54f4fdc4277d3b82842b8af30f3b85d93a68830ee.exe	30
PID 1520 wrote to memory of 1100	1520	9516bff6ff164376cebf71d54f4fdc4277d3b82842b8af30f3b85d93a68830ee.exe	30
PID 1520 wrote to memory of 1100	1520	9516bff6ff164376cebf71d54f4fdc4277d3b82842b8af30f3b85d93a68830ee.exe	30
PID 1520 wrote to memory of 1100	1520	9516bff6ff164376cebf71d54f4fdc4277d3b82842b8af30f3b85d93a68830ee.exe	30
PID 1520 wrote to memory of 996	1520	9516bff6ff164376cebf71d54f4fdc4277d3b82842b8af30f3b85d93a68830ee.exe	32
PID 1520 wrote to memory of 996	1520	9516bff6ff164376cebf71d54f4fdc4277d3b82842b8af30f3b85d93a68830ee.exe	32
PID 1520 wrote to memory of 996	1520	9516bff6ff164376cebf71d54f4fdc4277d3b82842b8af30f3b85d93a68830ee.exe	32
PID 1520 wrote to memory of 996	1520	9516bff6ff164376cebf71d54f4fdc4277d3b82842b8af30f3b85d93a68830ee.exe	32
PID 1520 wrote to memory of 996	1520	9516bff6ff164376cebf71d54f4fdc4277d3b82842b8af30f3b85d93a68830ee.exe	32
PID 1520 wrote to memory of 996	1520	9516bff6ff164376cebf71d54f4fdc4277d3b82842b8af30f3b85d93a68830ee.exe	32
PID 1520 wrote to memory of 996	1520	9516bff6ff164376cebf71d54f4fdc4277d3b82842b8af30f3b85d93a68830ee.exe	32
PID 996 wrote to memory of 1680	996	ctrpnm.exe	34
PID 996 wrote to memory of 1680	996	ctrpnm.exe	34
PID 996 wrote to memory of 1680	996	ctrpnm.exe	34
PID 996 wrote to memory of 1680	996	ctrpnm.exe	34
PID 996 wrote to memory of 1680	996	ctrpnm.exe	34
PID 996 wrote to memory of 1680	996	ctrpnm.exe	34
PID 996 wrote to memory of 1680	996	ctrpnm.exe	34
PID 1520 wrote to memory of 2000	1520	9516bff6ff164376cebf71d54f4fdc4277d3b82842b8af30f3b85d93a68830ee.exe	35
PID 1520 wrote to memory of 2000	1520	9516bff6ff164376cebf71d54f4fdc4277d3b82842b8af30f3b85d93a68830ee.exe	35
PID 1520 wrote to memory of 2000	1520	9516bff6ff164376cebf71d54f4fdc4277d3b82842b8af30f3b85d93a68830ee.exe	35
PID 1520 wrote to memory of 2000	1520	9516bff6ff164376cebf71d54f4fdc4277d3b82842b8af30f3b85d93a68830ee.exe	35
PID 1520 wrote to memory of 2000	1520	9516bff6ff164376cebf71d54f4fdc4277d3b82842b8af30f3b85d93a68830ee.exe	35
PID 1520 wrote to memory of 2000	1520	9516bff6ff164376cebf71d54f4fdc4277d3b82842b8af30f3b85d93a68830ee.exe	35
PID 1520 wrote to memory of 2000	1520	9516bff6ff164376cebf71d54f4fdc4277d3b82842b8af30f3b85d93a68830ee.exe	35

C:\Users\Admin\AppData\Local\Temp\9516bff6ff164376cebf71d54f4fdc4277d3b82842b8af30f3b85d93a68830ee.exe
"C:\Users\Admin\AppData\Local\Temp\9516bff6ff164376cebf71d54f4fdc4277d3b82842b8af30f3b85d93a68830ee.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Program Files\Common Files\ctfn0m.ini
  "C:\Program Files\Common Files\ctfn0m.ini" "C:\Program Files\rmstcnb\klqdmmmj.rpn" ServiceMain
  2⤵
  - Executes dropped EXE
  PID:672
- C:\Windows\SysWOW64\sc.exe
  sc config RasAuto start= auto
  2⤵
  - Launches sc.exe
  PID:1696
- C:\Windows\SysWOW64\sc.exe
  sc config RasAuto start= auto
  2⤵
  - Launches sc.exe
  PID:1100
- C:\Documents and Settings\ctrpnm.exe
  "C:\Documents and Settings\ctrpnm.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:996
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c del C:\DOCUME~1\ctrpnm.exe
    3⤵
    PID:1680
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del C:\Users\Admin\AppData\Local\Temp\9516BF~1.EXE
  2⤵
  - Deletes itself
  PID:2000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Documents and Settings\ctrpnm.exe

Filesize
34KB

MD5
000b07bc3dcbe39a3b5bfaff2abd9db8

SHA1
07d6b1ebeed50ca9aa2339eb8dd0005ae6f23fdf

SHA256
8480e783eeb76a34262df127f28d4008e8ec395f225dcf58a2c4d81fbd002775

SHA512
3e0026b3863001c4a0306db0f3ebd761ad9758c7f0a1dbfbf7a8a6de4fc412e876309697e9499e38620c3c27143d103a871b690118c11b9b08b6702fd6266a72

Download Submit
C:\Program Files\Common Files\ctfn0m.ini

Filesize
43KB

MD5
51138beea3e2c21ec44d0932c71762a8

SHA1
8939cf35447b22dd2c6e6f443446acc1bf986d58

SHA256
5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

SHA512
794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

Download Submit
C:\Program Files\Common Files\ctfn0m.ini

Filesize
43KB

MD5
51138beea3e2c21ec44d0932c71762a8

SHA1
8939cf35447b22dd2c6e6f443446acc1bf986d58

SHA256
5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

SHA512
794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

Download Submit
C:\Program Files\rmstcnb\klqdmmmj.rpn

Filesize
448KB

MD5
4fca7aabba7f5ea7a84f4e8a29fc38f4

SHA1
742c726a3cf1ba0faffd56995263cbd6c0f45563

SHA256
854a5fbf2f0a9a7e90ecd9cfd6372c92ed93af278e54f481b7ff3f6526a154d7

SHA512
93268ef9584cd60b984989686f5ba123982ac3eae156a2fd6168b94918f182707454098346c5985633f5a6c6b76051752822a3e35635fda9a5212e82aea22412

Download Submit
C:\Users\ctrpnm.exe

Filesize
34KB

MD5
000b07bc3dcbe39a3b5bfaff2abd9db8

SHA1
07d6b1ebeed50ca9aa2339eb8dd0005ae6f23fdf

SHA256
8480e783eeb76a34262df127f28d4008e8ec395f225dcf58a2c4d81fbd002775

SHA512
3e0026b3863001c4a0306db0f3ebd761ad9758c7f0a1dbfbf7a8a6de4fc412e876309697e9499e38620c3c27143d103a871b690118c11b9b08b6702fd6266a72

Download Submit
\Program Files\Common Files\ctfn0m.ini

Filesize
43KB

MD5
51138beea3e2c21ec44d0932c71762a8

SHA1
8939cf35447b22dd2c6e6f443446acc1bf986d58

SHA256
5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

SHA512
794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

Download Submit
\Users\ctrpnm.exe

Filesize
34KB

MD5
000b07bc3dcbe39a3b5bfaff2abd9db8

SHA1
07d6b1ebeed50ca9aa2339eb8dd0005ae6f23fdf

SHA256
8480e783eeb76a34262df127f28d4008e8ec395f225dcf58a2c4d81fbd002775

SHA512
3e0026b3863001c4a0306db0f3ebd761ad9758c7f0a1dbfbf7a8a6de4fc412e876309697e9499e38620c3c27143d103a871b690118c11b9b08b6702fd6266a72

Download Submit
\Users\ctrpnm.exe

Filesize
34KB

MD5
000b07bc3dcbe39a3b5bfaff2abd9db8

SHA1
07d6b1ebeed50ca9aa2339eb8dd0005ae6f23fdf

SHA256
8480e783eeb76a34262df127f28d4008e8ec395f225dcf58a2c4d81fbd002775

SHA512
3e0026b3863001c4a0306db0f3ebd761ad9758c7f0a1dbfbf7a8a6de4fc412e876309697e9499e38620c3c27143d103a871b690118c11b9b08b6702fd6266a72

Download Submit
\Users\ctrpnm.exe

Filesize
34KB

MD5
000b07bc3dcbe39a3b5bfaff2abd9db8

SHA1
07d6b1ebeed50ca9aa2339eb8dd0005ae6f23fdf

SHA256
8480e783eeb76a34262df127f28d4008e8ec395f225dcf58a2c4d81fbd002775

SHA512
3e0026b3863001c4a0306db0f3ebd761ad9758c7f0a1dbfbf7a8a6de4fc412e876309697e9499e38620c3c27143d103a871b690118c11b9b08b6702fd6266a72

Download Submit
\Users\ctrpnm.exe

Filesize
34KB

MD5
000b07bc3dcbe39a3b5bfaff2abd9db8

SHA1
07d6b1ebeed50ca9aa2339eb8dd0005ae6f23fdf

SHA256
8480e783eeb76a34262df127f28d4008e8ec395f225dcf58a2c4d81fbd002775

SHA512
3e0026b3863001c4a0306db0f3ebd761ad9758c7f0a1dbfbf7a8a6de4fc412e876309697e9499e38620c3c27143d103a871b690118c11b9b08b6702fd6266a72

Download Submit
memory/996-84-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1520-69-0x0000000000250000-0x000000000028E000-memory.dmp

Filesize
248KB

Download
memory/1520-54-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download
memory/1520-68-0x0000000000490000-0x0000000000512000-memory.dmp

Filesize
520KB

Download
memory/1520-58-0x0000000000490000-0x0000000000512000-memory.dmp

Filesize
520KB

Download
memory/1520-57-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1520-67-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1520-59-0x0000000000490000-0x0000000000512000-memory.dmp

Filesize
520KB

Download
memory/1520-86-0x0000000000250000-0x000000000028E000-memory.dmp

Filesize
248KB

Download
memory/1520-56-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1520-55-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1520-60-0x0000000000250000-0x000000000028E000-memory.dmp

Filesize
248KB

Download
memory/1520-85-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download