gh0strat | 22503a27c8bd1299e67f484b0c750276323d5a97b9dd45e1da7a935fe377ec1e

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
27-03-2023 09:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

hfs_1.exe
Size

153KB
MD5

8d1d6e7c36bc9c97338a71c862dc52a0
SHA1

ea0cd6c2983a4fda97302cf338b3fbac20a3cc1e
SHA256

636f404892310f7f7cbffd013d5ebd5895b309af2b0bb18814e52c5548e4d4a6
SHA512

fe89091867ddfb2e9b8a94edaf5c5d56d61fffa5dd9f604013ebfd19498625d5d0a8c7db0ae4c215bbe00c2c6682a90137abc91de24c89d16dbcd0f961194923
SSDEEP

3072:EFQ7RD+UBjvu9GrUvUy6ApRrlsbJIpYQVFdLkR2ZmYhM:Ecd+8jvtrNApRQIp/FdpZmYhM

Score

10^/10

gh0strat persistence rat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral13/memory/4472-133-0x0000000010000000-0x000000001002B000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

hfs_1.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Realtek¸ßÇåÎúÒôÆµ¹ÜÀíÆ÷ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hfs_1.exe"	hfs_1.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

hfs_1.exe

pid process

4472 hfs_1.exe
4472 hfs_1.exe

pid	process
4472	hfs_1.exe
4472	hfs_1.exe

C:\Users\Admin\AppData\Local\Temp\hfs_1.exe
"C:\Users\Admin\AppData\Local\Temp\hfs_1.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:4472

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4472-133-0x0000000010000000-0x000000001002B000-memory.dmp

Filesize
172KB

Download