gh0strat | b1231919acad3b987ccace0aa9a92ce6e01566867484f58a6e03e2516eff1b1c

Analysis

max time kernel
4s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 08:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1231919acad3b987ccace0aa9a92ce6e01566867484f58a6e03e2516eff1b1c.exe
Size

132KB
MD5

7fa1eccc1ae6fa313cbbd403737aa186
SHA1

2c63c8ee4a16fb7b6e7d4a5c2453d26aa881527d
SHA256

b1231919acad3b987ccace0aa9a92ce6e01566867484f58a6e03e2516eff1b1c
SHA512

7a6cb4dff686e84321e6f8ed30f98cbf6d1052a80635f90aeb4439cef5c997f6f01b25c2076b92d196197196a520ba751d13e43921bdd9ef33007b5d1491cbbd
SSDEEP

3072:EzbbN6esny5BV0D8C5oJu2gCFxg8qCZmWksd/V1B1B:Ezbb0dyxq9nAFWFUmZsd/

Score

10^/10

gh0strat persistence rat vmprotect

Malware Config

Signatures

Gh0st RAT payload 3 IoCs

resource	yara_rule
behavioral1/files/0x000b0000000122f8-54.dat	family_gh0strat
behavioral1/files/0x0009000000012302-56.dat	family_gh0strat
behavioral1/files/0x0009000000012302-57.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Drivers\beep.sys	svchost.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibilityex.dll"	b1231919acad3b987ccace0aa9a92ce6e01566867484f58a6e03e2516eff1b1c.exe

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/files/0x000b0000000122f8-54.dat	vmprotect
behavioral1/files/0x0009000000012302-56.dat	vmprotect
behavioral1/files/0x0009000000012302-57.dat	vmprotect

Deletes itself 1 IoCs

pid	Process
960	svchost.exe

Loads dropped DLL 2 IoCs

pid	Process
2040	b1231919acad3b987ccace0aa9a92ce6e01566867484f58a6e03e2516eff1b1c.exe
960	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\FastUserSwitchingCompatibilityex.dll	b1231919acad3b987ccace0aa9a92ce6e01566867484f58a6e03e2516eff1b1c.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
464	Process not Found

C:\Users\Admin\AppData\Local\Temp\b1231919acad3b987ccace0aa9a92ce6e01566867484f58a6e03e2516eff1b1c.exe
"C:\Users\Admin\AppData\Local\Temp\b1231919acad3b987ccace0aa9a92ce6e01566867484f58a6e03e2516eff1b1c.exe"
1⤵
- Sets DLL path for service in the registry
- Loads dropped DLL
- Drops file in System32 directory
PID:2040

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Drops file in Drivers directory
- Deletes itself
- Loads dropped DLL
PID:960

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\install.tmp

Filesize
102B

MD5
64dc68ef192f6552979cd0eeb5ab89f6

SHA1
22380085402a9a634b7606813c7dcf969bd22cce

SHA256
225fe55a272912701aaea2f724cdce4fec25e1e0001382e652370a22c858a7b4

SHA512
c6c6ec7e7d6df8d9c60c3e30b9ef4270daa7e937667be8231ebe82a8bac849e96c6b2bde074c2648726b5e41dfbd2de927734d8224cc075d2eb6736700268393

Download Submit
\??\c:\windows\SysWOW64\fastuserswitchingcompatibilityex.dll

Filesize
93KB

MD5
9f2203f9aa3c197d910fadc548844702

SHA1
af7d9bfe8898f5636db467b461a67726c53c0d43

SHA256
88e93ecd192cb473e0ab9b6a0817a7f527886964f22e691ba150e5d681b21458

SHA512
39e078c45a89f6da91378e077427181555963176c84b97eb6753341a80da85892b5d569e553c5641772c12043257ba04aa013528d479b12f44b8b345025f1c9e

Download Submit
\Users\Admin\AppData\Local\Temp\dll.tmp

Filesize
93KB

MD5
9f2203f9aa3c197d910fadc548844702

SHA1
af7d9bfe8898f5636db467b461a67726c53c0d43

SHA256
88e93ecd192cb473e0ab9b6a0817a7f527886964f22e691ba150e5d681b21458

SHA512
39e078c45a89f6da91378e077427181555963176c84b97eb6753341a80da85892b5d569e553c5641772c12043257ba04aa013528d479b12f44b8b345025f1c9e

Download Submit
\Windows\SysWOW64\FastUserSwitchingCompatibilityex.dll

Filesize
93KB

MD5
9f2203f9aa3c197d910fadc548844702

SHA1
af7d9bfe8898f5636db467b461a67726c53c0d43

SHA256
88e93ecd192cb473e0ab9b6a0817a7f527886964f22e691ba150e5d681b21458

SHA512
39e078c45a89f6da91378e077427181555963176c84b97eb6753341a80da85892b5d569e553c5641772c12043257ba04aa013528d479b12f44b8b345025f1c9e

Download Submit
memory/2040-55-0x00000000761E1000-0x00000000761E3000-memory.dmp

Filesize
8KB

Download