gh0strat | 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b

Analysis

max time kernel
150s
max time network
152s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
03/03/2023, 12:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
Size

2.2MB
MD5

2d7288e193e533dafab9d8c2f2038e6f
SHA1

52f0067ede836a52a144f52520c37a24421b1a3c
SHA256

79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b
SHA512

6948377720d4eb0bc153289aa004696869264bd99940ed894b02689672d68032346360e2d49bb406d8764e42a982c93bdb8b3db08646ec275f9dbb279f92f445
SSDEEP

24576:xL9QwSgxmxylZViyf6KOGSKC891D8vRMFgcvahnsCYXDC1SROmDn3I:xffwGSf8CRMFgcvrXGSRBDn3I

Score

10^/10

gh0strat rat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/1100-4823-0x0000000000400000-0x000000000062C000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ini.ini	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

pid	Process
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
Token: SeIncBasePriorityPrivilege	1100	79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe

C:\Users\Admin\AppData\Local\Temp\79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
"C:\Users\Admin\AppData\Local\Temp\79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:1100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1100-54-0x0000000075EB0000-0x0000000075EF7000-memory.dmp

Filesize
284KB

Download
memory/1100-459-0x0000000000400000-0x000000000062C000-memory.dmp

Filesize
2.2MB

Download
memory/1100-461-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-463-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-462-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-464-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-465-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-466-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-467-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-468-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-469-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-470-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-471-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-472-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-473-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-474-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-475-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-476-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-477-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-478-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-479-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-480-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-481-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-482-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-483-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-484-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-485-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-486-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-487-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-488-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-489-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-490-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-491-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-492-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-493-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-494-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-495-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-496-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-497-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-499-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-498-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-500-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-501-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-502-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-503-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-504-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-505-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-506-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-507-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-508-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-509-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-510-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-511-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-512-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-513-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-514-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-515-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-516-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-517-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-518-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-519-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-521-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-520-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-522-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-523-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-1386-0x00000000020B0000-0x00000000021B0000-memory.dmp

Filesize
1024KB

Download
memory/1100-1387-0x0000000002240000-0x00000000023C1000-memory.dmp

Filesize
1.5MB

Download
memory/1100-4667-0x00000000020B0000-0x00000000021B0000-memory.dmp

Filesize
1024KB

Download
memory/1100-4813-0x00000000024F0000-0x0000000002601000-memory.dmp

Filesize
1.1MB

Download
memory/1100-4823-0x0000000000400000-0x000000000062C000-memory.dmp

Filesize
2.2MB

Download