gh0strat | 438e44aae94e8376d2e36e23212920e936b7517bca24eaf66e9d7d014e21552c

Analysis

max time kernel
150s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
27-03-2023 09:42

Target

360sb.exe
Size

74KB
MD5

ff3638137bdb13438ae78bdb295fb74d
SHA1

d1ff58701713d307430fd061592ecea3c1cf4e6b
SHA256

61e5303a9e3c3f0b5c70749c4ea2d619f3b5bae341189eaff28393f337113fca
SHA512

dc87de3bb1689bea6409c33b2af420f8274d4c36862dfe79b98b2195c72057e76a0222aa3c61a144e6927a0bbe5a3a95afe4df430a342f35ba1c7d5c6fda339f
SSDEEP

1536:aunpULRX92uqnsRDwdQW3YBlCOCbZawM:aunyLR0z3QOal/CbowM

Score

10^/10

gh0strat rat upx

Gh0st RAT payload 3 IoCs

Processes:

resource	yara_rule
behavioral3/memory/1424-56-0x0000000000400000-0x0000000000431000-memory.dmp	family_gh0strat
behavioral3/memory/1880-57-0x0000000000400000-0x0000000000431000-memory.dmp	family_gh0strat
behavioral3/memory/1880-59-0x0000000000400000-0x0000000000431000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Executes dropped EXE 1 IoCs

Processes:

caycwq.exe

pid process

1880 caycwq.exe

pid	process
1880	caycwq.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
C:\Windows\SysWOW64\caycwq.exe	upx
behavioral3/memory/1424-56-0x0000000000400000-0x0000000000431000-memory.dmp	upx
behavioral3/memory/1880-57-0x0000000000400000-0x0000000000431000-memory.dmp	upx
C:\Windows\SysWOW64\caycwq.exe	upx
behavioral3/memory/1880-59-0x0000000000400000-0x0000000000431000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

Processes:

360sb.exe

description ioc process

File created C:\Windows\SysWOW64\caycwq.exe 360sb.exe
File opened for modification C:\Windows\SysWOW64\caycwq.exe 360sb.exe

description	ioc	process
File created	C:\Windows\SysWOW64\caycwq.exe	360sb.exe
File opened for modification	C:\Windows\SysWOW64\caycwq.exe	360sb.exe

C:\Users\Admin\AppData\Local\Temp\360sb.exe
"C:\Users\Admin\AppData\Local\Temp\360sb.exe"
1⤵
- Drops file in System32 directory
PID:1424

C:\Windows\SysWOW64\caycwq.exe
C:\Windows\SysWOW64\caycwq.exe
1⤵
- Executes dropped EXE
PID:1880

C:\Windows\SysWOW64\caycwq.exe
Filesize
74KB

MD5
ff3638137bdb13438ae78bdb295fb74d

SHA1
d1ff58701713d307430fd061592ecea3c1cf4e6b

SHA256
61e5303a9e3c3f0b5c70749c4ea2d619f3b5bae341189eaff28393f337113fca

SHA512
dc87de3bb1689bea6409c33b2af420f8274d4c36862dfe79b98b2195c72057e76a0222aa3c61a144e6927a0bbe5a3a95afe4df430a342f35ba1c7d5c6fda339f

Download Submit
C:\Windows\SysWOW64\caycwq.exe
Filesize
74KB

MD5
ff3638137bdb13438ae78bdb295fb74d

SHA1
d1ff58701713d307430fd061592ecea3c1cf4e6b

SHA256
61e5303a9e3c3f0b5c70749c4ea2d619f3b5bae341189eaff28393f337113fca

SHA512
dc87de3bb1689bea6409c33b2af420f8274d4c36862dfe79b98b2195c72057e76a0222aa3c61a144e6927a0bbe5a3a95afe4df430a342f35ba1c7d5c6fda339f

Download Submit
memory/1424-56-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1880-57-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1880-59-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download