gh0strat | f21bfc6660cd64adc45eda10613e5c705273ad7bb6099dad5c4eefa5012c9b6a

Analysis

max time kernel
101s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 05:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f21bfc6660cd64adc45eda10613e5c705273ad7bb6099dad5c4eefa5012c9b6a.exe
Size

492KB
MD5

323601ea013a93514856cb43a58030b4
SHA1

53263b5e5122881756b597e58d90b713ad61e16c
SHA256

f21bfc6660cd64adc45eda10613e5c705273ad7bb6099dad5c4eefa5012c9b6a
SHA512

6f170cd2dd8b22bc76a05eb591356ae813399f1414d23f129849eadd68a01f830d791e6db86d50d8c1c4a0cbf72edefd5064e28f59ada692841301d8ac8f4b48
SSDEEP

6144:o4RFDmLzNZVazYloL8cKCXTq7drxfBr5h1MmUdKrw2Rnh5Esym2E87RzYQR0jXH7:FRFDmH3VHFF3MmUiweh5EsyY8dzPML

Score

10^/10

gh0strat aspackv2 persistence rat

Malware Config

Signatures

Gh0st RAT payload 4 IoCs

resource	yara_rule
behavioral2/files/0x0006000000022f5d-140.dat	family_gh0strat
behavioral2/files/0x0006000000022f5d-141.dat	family_gh0strat
behavioral2/files/0x0006000000022f5e-144.dat	family_gh0strat
behavioral2/files/0x0006000000022f5e-145.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x0006000000022f5c-137.dat	aspack_v212_v242
behavioral2/files/0x0006000000022f5c-136.dat	aspack_v212_v242

Executes dropped EXE 4 IoCs

pid	Process
4132	½â³ý½û±Õ.exe
1384	¸¨ÖúÎÄ¼þ.exe
1196	server.exe
1588	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	f21bfc6660cd64adc45eda10613e5c705273ad7bb6099dad5c4eefa5012c9b6a.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\V2011 = "C:\\WINDOWS\\V2011.exe"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	svchost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\V2011.exe	svchost.exe
File opened for modification	C:\WINDOWS\V2011.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
824	1384	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1196	server.exe
1196	server.exe
1588	svchost.exe
1588	svchost.exe
1588	svchost.exe
1588	svchost.exe
1588	svchost.exe
1588	svchost.exe
1588	svchost.exe
1588	svchost.exe
1588	svchost.exe
1588	svchost.exe
1588	svchost.exe
1588	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1588	svchost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1588	svchost.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4772	f21bfc6660cd64adc45eda10613e5c705273ad7bb6099dad5c4eefa5012c9b6a.exe
4772	f21bfc6660cd64adc45eda10613e5c705273ad7bb6099dad5c4eefa5012c9b6a.exe
4132	½â³ý½û±Õ.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 4132	4772	f21bfc6660cd64adc45eda10613e5c705273ad7bb6099dad5c4eefa5012c9b6a.exe	80
PID 4772 wrote to memory of 4132	4772	f21bfc6660cd64adc45eda10613e5c705273ad7bb6099dad5c4eefa5012c9b6a.exe	80
PID 4772 wrote to memory of 4132	4772	f21bfc6660cd64adc45eda10613e5c705273ad7bb6099dad5c4eefa5012c9b6a.exe	80
PID 4772 wrote to memory of 1384	4772	f21bfc6660cd64adc45eda10613e5c705273ad7bb6099dad5c4eefa5012c9b6a.exe	81
PID 4772 wrote to memory of 1384	4772	f21bfc6660cd64adc45eda10613e5c705273ad7bb6099dad5c4eefa5012c9b6a.exe	81
PID 4772 wrote to memory of 1384	4772	f21bfc6660cd64adc45eda10613e5c705273ad7bb6099dad5c4eefa5012c9b6a.exe	81
PID 4772 wrote to memory of 1196	4772	f21bfc6660cd64adc45eda10613e5c705273ad7bb6099dad5c4eefa5012c9b6a.exe	83
PID 4772 wrote to memory of 1196	4772	f21bfc6660cd64adc45eda10613e5c705273ad7bb6099dad5c4eefa5012c9b6a.exe	83
PID 4772 wrote to memory of 1196	4772	f21bfc6660cd64adc45eda10613e5c705273ad7bb6099dad5c4eefa5012c9b6a.exe	83
PID 1196 wrote to memory of 1588	1196	server.exe	84
PID 1196 wrote to memory of 1588	1196	server.exe	84
PID 1196 wrote to memory of 1588	1196	server.exe	84
PID 1196 wrote to memory of 1140	1196	server.exe	94
PID 1196 wrote to memory of 1140	1196	server.exe	94
PID 1196 wrote to memory of 1140	1196	server.exe	94

C:\Users\Admin\AppData\Local\Temp\f21bfc6660cd64adc45eda10613e5c705273ad7bb6099dad5c4eefa5012c9b6a.exe
"C:\Users\Admin\AppData\Local\Temp\f21bfc6660cd64adc45eda10613e5c705273ad7bb6099dad5c4eefa5012c9b6a.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Users\Admin\AppData\Local\Temp\½â³ý½û±Õ.exe
  "C:\Users\Admin\AppData\Local\Temp\½â³ý½û±Õ.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4132
- C:\Users\Admin\AppData\Local\Temp\¸¨ÖúÎÄ¼þ.exe
  "C:\Users\Admin\AppData\Local\Temp\¸¨ÖúÎÄ¼þ.exe"
  2⤵
  - Executes dropped EXE
  PID:1384
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 284
    3⤵
    - Program crash
    PID:824
- C:\Users\Admin\AppData\Local\Temp\server.exe
  "C:\Users\Admin\AppData\Local\Temp\server.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1196
- - C:\Users\Admin\AppData\Local\Temp\V2011\svchost.exe
    C:\Users\Admin\AppData\Local\Temp\V2011\svchost.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:1588
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c afc9fe2f418b00a0.bat
    3⤵
    PID:1140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1384 -ip 1384
1⤵
PID:628

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\V2011\svchost.exe

Filesize
198KB

MD5
bfcd6f1d33f043473fd56f3331e60638

SHA1
dc0c64bf0579397125259c9f90412864423c1a9f

SHA256
c0d6ee695be90042757349307664f25eeced4753dedc03436915c23fb51d542d

SHA512
f41a39faa68fe66164fdd97a6019dc4ab49aa1aad3f48cc34551450e1c1127c1ecf46a544442967a72122fe61edca196bef9ecde983c41191758a46d512a639b

Download Submit
C:\Users\Admin\AppData\Local\Temp\V2011\svchost.exe

Filesize
198KB

MD5
bfcd6f1d33f043473fd56f3331e60638

SHA1
dc0c64bf0579397125259c9f90412864423c1a9f

SHA256
c0d6ee695be90042757349307664f25eeced4753dedc03436915c23fb51d542d

SHA512
f41a39faa68fe66164fdd97a6019dc4ab49aa1aad3f48cc34551450e1c1127c1ecf46a544442967a72122fe61edca196bef9ecde983c41191758a46d512a639b

Download Submit
C:\Users\Admin\AppData\Local\Temp\afc9fe2f418b00a0.bat

Filesize
2KB

MD5
410e2424a78b78473ed6f786478d690e

SHA1
e00fc8e126b42949b6d9e4b99c726ca86fb4c241

SHA256
42915e2d18ac3d175b0ba851a217687aa0367d6ce554add594948f52c812e559

SHA512
4ca4682ee41fc6aec747b5cbae1d9933ca5212660ed0ea81d6f38802d115659c9144b824d6a57b4a546b0fc7357d7332b77dcae6bd4343d8daa0ec6042e051ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\server.exe

Filesize
198KB

MD5
bfcd6f1d33f043473fd56f3331e60638

SHA1
dc0c64bf0579397125259c9f90412864423c1a9f

SHA256
c0d6ee695be90042757349307664f25eeced4753dedc03436915c23fb51d542d

SHA512
f41a39faa68fe66164fdd97a6019dc4ab49aa1aad3f48cc34551450e1c1127c1ecf46a544442967a72122fe61edca196bef9ecde983c41191758a46d512a639b

Download Submit
C:\Users\Admin\AppData\Local\Temp\server.exe

Filesize
198KB

MD5
bfcd6f1d33f043473fd56f3331e60638

SHA1
dc0c64bf0579397125259c9f90412864423c1a9f

SHA256
c0d6ee695be90042757349307664f25eeced4753dedc03436915c23fb51d542d

SHA512
f41a39faa68fe66164fdd97a6019dc4ab49aa1aad3f48cc34551450e1c1127c1ecf46a544442967a72122fe61edca196bef9ecde983c41191758a46d512a639b

Download Submit
C:\Users\Admin\AppData\Local\Temp\¸¨ÖúÎÄ¼þ.exe

Filesize
98KB

MD5
830276d53103857f05a1f9852fff8421

SHA1
b60c02c47101f7c189966ffbe3d4a4a7d6636b73

SHA256
e39a04bdf23c1dc15780501e128b3779a73e621ee2a3b6497f3dbcab1aebf13c

SHA512
43ad60a0ca92b1aa1078df164ad86cb0838a76adb6099d18b17f67c2d985ee9d1a594624113d28fcb2f9893a05eacbf201c49bce480862996cd862715fe54118

Download Submit
C:\Users\Admin\AppData\Local\Temp\¸¨ÖúÎÄ¼þ.exe

Filesize
98KB

MD5
830276d53103857f05a1f9852fff8421

SHA1
b60c02c47101f7c189966ffbe3d4a4a7d6636b73

SHA256
e39a04bdf23c1dc15780501e128b3779a73e621ee2a3b6497f3dbcab1aebf13c

SHA512
43ad60a0ca92b1aa1078df164ad86cb0838a76adb6099d18b17f67c2d985ee9d1a594624113d28fcb2f9893a05eacbf201c49bce480862996cd862715fe54118

Download Submit
C:\Users\Admin\AppData\Local\Temp\½â³ý½û±Õ.exe

Filesize
20KB

MD5
fae21ca43806a51cd0cadbf38471ec83

SHA1
1c56dea7dbbed91a65d739164f2ebc7f5bd238e1

SHA256
2df19b1d4b2895071c21a77976957d7217696902d036dbb57e86ccf1614e81f7

SHA512
aa2fc20dc8a069eb5a62688bfa536442d9b38accaa2fab35dabdffea3d3f1c24f487a4c8dde63907228c1e6fa0e91f71053d3a84600091b08a5f5d90c222b0f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\½â³ý½û±Õ.exe

Filesize
20KB

MD5
fae21ca43806a51cd0cadbf38471ec83

SHA1
1c56dea7dbbed91a65d739164f2ebc7f5bd238e1

SHA256
2df19b1d4b2895071c21a77976957d7217696902d036dbb57e86ccf1614e81f7

SHA512
aa2fc20dc8a069eb5a62688bfa536442d9b38accaa2fab35dabdffea3d3f1c24f487a4c8dde63907228c1e6fa0e91f71053d3a84600091b08a5f5d90c222b0f3

Download Submit
memory/1384-138-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download