gh0strat | 29bdf30d0b641a2fb9abc5dc9b5544e39cb91c9e2deb927b45679010198c765f

Analysis

max time kernel
150s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25/12/2022, 11:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ba5396e15e896c12f5b948b4ab134e44.exe
Size

91KB
MD5

ba5396e15e896c12f5b948b4ab134e44
SHA1

ad091a08da28014d915f0ba4dee83598d04eddaf
SHA256

29bdf30d0b641a2fb9abc5dc9b5544e39cb91c9e2deb927b45679010198c765f
SHA512

7a5ddd3e3459745c301723c8516fe09806a18c5e57c99eba068dade72e0e7da0fef4423120fe84106390b7cf426ad56ccedb26f05430f3d6c25560dd42b5ab4e
SSDEEP

1536:9Jvpm0PGt6rj5w0OqcocxrD5n6eDwDueLic+8ifnIcQ63xF+0j11BrM:XvpmuGt6rj5w0Oqcoc+ekDVLi580nIco

Score

10^/10

gh0strat persistence rat

Malware Config

Signatures

Gh0st RAT payload 6 IoCs

resource	yara_rule
behavioral1/memory/864-54-0x0000000000400000-0x0000000000419000-memory.dmp	family_gh0strat
behavioral1/memory/864-56-0x0000000000400000-0x0000000000419000-memory.dmp	family_gh0strat
behavioral1/files/0x000a0000000122e5-55.dat	family_gh0strat
behavioral1/files/0x000a0000000122e5-57.dat	family_gh0strat
behavioral1/memory/1780-59-0x0000000010000000-0x0000000010013000-memory.dmp	family_gh0strat
behavioral1/memory/1780-60-0x0000000010000000-0x0000000010013000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Documents and Settings\\Local User\\pcguard.dll"	ba5396e15e896c12f5b948b4ab134e44.exe

Deletes itself 1 IoCs

pid	Process
1780	SVCHOST.EXE

Loads dropped DLL 1 IoCs

pid	Process
1780	SVCHOST.EXE

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
864	ba5396e15e896c12f5b948b4ab134e44.exe
864	ba5396e15e896c12f5b948b4ab134e44.exe
1780	SVCHOST.EXE
1780	SVCHOST.EXE
1780	SVCHOST.EXE

C:\Users\Admin\AppData\Local\Temp\ba5396e15e896c12f5b948b4ab134e44.exe
"C:\Users\Admin\AppData\Local\Temp\ba5396e15e896c12f5b948b4ab134e44.exe"
1⤵
- Sets DLL path for service in the registry
- Suspicious behavior: EnumeratesProcesses
PID:864

C:\Windows\SysWOW64\SVCHOST.EXE
C:\Windows\SysWOW64\SVCHOST.EXE -K NETSVCS
1⤵
- Deletes itself
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1780

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\documents and settings\local user\pcguard.dll

Filesize
72KB

MD5
48aa18f2c741c9c81e99bf54525908b6

SHA1
b6190fd0c7b39c2baf653ceeb1a314772ab0d101

SHA256
551de1b9554f4a69459d036b91a5d206d2d4b7744285b124948ffe349093ec40

SHA512
55c02c7746d4b96b71fe410ab9bd57f428c7ee27a1c47456c3e520d7e468c3240646785dcea65ee7b3e104133f303036f667728aa4289c89b065b0ae93e3530b

Download Submit
\Users\Local User\pcguard.dll

Filesize
72KB

MD5
48aa18f2c741c9c81e99bf54525908b6

SHA1
b6190fd0c7b39c2baf653ceeb1a314772ab0d101

SHA256
551de1b9554f4a69459d036b91a5d206d2d4b7744285b124948ffe349093ec40

SHA512
55c02c7746d4b96b71fe410ab9bd57f428c7ee27a1c47456c3e520d7e468c3240646785dcea65ee7b3e104133f303036f667728aa4289c89b065b0ae93e3530b

Download Submit
memory/864-54-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/864-56-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1780-58-0x0000000076321000-0x0000000076323000-memory.dmp

Filesize
8KB

Download
memory/1780-59-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1780-60-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download