gh0strat | 438e44aae94e8376d2e36e23212920e936b7517bca24eaf66e9d7d014e21552c

Analysis

max time kernel
148s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
27-03-2023 09:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

server.exe
Size

333KB
MD5

44283b85db8476e3dbcab39e644a76bb
SHA1

afed9e102d07782074a63b8f5fae6ac0ee96ec1f
SHA256

5e213f963cb6c381a34388e9d66456cc044c395d4921440acb9d80a9625803b2
SHA512

a5f5dd9ac7116971c65ad376d31b463d0b44b6cced3db08593030eb8ccd64e1fefa1f2c0531004dc347407c2f4f8090bab860e6485f91c3a31eb49b44df78bdf
SSDEEP

6144:EgiFIfdAcDJiMm02wKURWl3I+q4NqBqAG:ri2dTDJiMmRvUROI+q4UBqAG

Score

10^/10

gh0strat persistence rat

Malware Config

Signatures

Gh0st RAT payload 5 IoCs

Processes:

resource	yara_rule
behavioral32/memory/1324-58-0x0000000000400000-0x000000000042C000-memory.dmp	family_gh0strat
C:\Windows\SysWOW64\rcflye.exe	family_gh0strat
C:\Windows\SysWOW64\rcflye.exe	family_gh0strat
behavioral32/memory/2044-67-0x0000000000400000-0x000000000042C000-memory.dmp	family_gh0strat
behavioral32/memory/2044-70-0x0000000000400000-0x000000000042C000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\dak224.tmp	acprotect
\Windows\Temp\ick1A55.tmp	acprotect

Executes dropped EXE 1 IoCs

Processes:

rcflye.exe

pid process

2044 rcflye.exe
Loads dropped DLL 2 IoCs

Processes:

server.exercflye.exe

pid process

1324 server.exe
2044 rcflye.exe

pid	process
2044	rcflye.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

server.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\rcflye.exe"	server.exe

Drops file in System32 directory 2 IoCs

Processes:

server.exe

description ioc process

File created C:\Windows\SysWOW64\rcflye.exe server.exe
File opened for modification C:\Windows\SysWOW64\rcflye.exe server.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

server.exercflye.exe

pid process

1324 server.exe
2044 rcflye.exe

description	ioc	process
File created	C:\Windows\SysWOW64\rcflye.exe	server.exe
File opened for modification	C:\Windows\SysWOW64\rcflye.exe	server.exe

Suspicious behavior: MapViewOfSection 45 IoCs

Processes:

server.exercflye.exe

pid	process
1324	server.exe
1324	server.exe
1324	server.exe
1324	server.exe
1324	server.exe
1324	server.exe
1324	server.exe
1324	server.exe
1324	server.exe
1324	server.exe
1324	server.exe
1324	server.exe
1324	server.exe
1324	server.exe
1324	server.exe
1324	server.exe
1324	server.exe
1324	server.exe
1324	server.exe
1324	server.exe
1324	server.exe
1324	server.exe
2044	rcflye.exe
2044	rcflye.exe
2044	rcflye.exe
2044	rcflye.exe
2044	rcflye.exe
2044	rcflye.exe
2044	rcflye.exe
2044	rcflye.exe
2044	rcflye.exe
2044	rcflye.exe
2044	rcflye.exe
2044	rcflye.exe
2044	rcflye.exe
2044	rcflye.exe
2044	rcflye.exe
2044	rcflye.exe
2044	rcflye.exe
2044	rcflye.exe
2044	rcflye.exe
2044	rcflye.exe
2044	rcflye.exe
2044	rcflye.exe
2044	rcflye.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

server.exercflye.exe

description pid process

Token: SeDebugPrivilege 1324 server.exe
Token: SeDebugPrivilege 2044 rcflye.exe
Token: SeIncBasePriorityPrivilege 1324 server.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

server.exercflye.exe

pid process

1324 server.exe
2044 rcflye.exe

description	pid	process
Token: SeDebugPrivilege	1324	server.exe
Token: SeDebugPrivilege	2044	rcflye.exe
Token: SeIncBasePriorityPrivilege	1324	server.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

server.exe

description	pid	process	target process
PID 1324 wrote to memory of 372	1324	server.exe	wininit.exe
PID 1324 wrote to memory of 372	1324	server.exe	wininit.exe
PID 1324 wrote to memory of 372	1324	server.exe	wininit.exe
PID 1324 wrote to memory of 372	1324	server.exe	wininit.exe
PID 1324 wrote to memory of 372	1324	server.exe	wininit.exe
PID 1324 wrote to memory of 372	1324	server.exe	wininit.exe
PID 1324 wrote to memory of 372	1324	server.exe	wininit.exe
PID 1324 wrote to memory of 384	1324	server.exe	csrss.exe
PID 1324 wrote to memory of 384	1324	server.exe	csrss.exe
PID 1324 wrote to memory of 384	1324	server.exe	csrss.exe
PID 1324 wrote to memory of 384	1324	server.exe	csrss.exe
PID 1324 wrote to memory of 384	1324	server.exe	csrss.exe
PID 1324 wrote to memory of 384	1324	server.exe	csrss.exe
PID 1324 wrote to memory of 384	1324	server.exe	csrss.exe
PID 1324 wrote to memory of 420	1324	server.exe	winlogon.exe
PID 1324 wrote to memory of 420	1324	server.exe	winlogon.exe
PID 1324 wrote to memory of 420	1324	server.exe	winlogon.exe
PID 1324 wrote to memory of 420	1324	server.exe	winlogon.exe
PID 1324 wrote to memory of 420	1324	server.exe	winlogon.exe
PID 1324 wrote to memory of 420	1324	server.exe	winlogon.exe
PID 1324 wrote to memory of 420	1324	server.exe	winlogon.exe
PID 1324 wrote to memory of 464	1324	server.exe	services.exe
PID 1324 wrote to memory of 464	1324	server.exe	services.exe
PID 1324 wrote to memory of 464	1324	server.exe	services.exe
PID 1324 wrote to memory of 464	1324	server.exe	services.exe
PID 1324 wrote to memory of 464	1324	server.exe	services.exe
PID 1324 wrote to memory of 464	1324	server.exe	services.exe
PID 1324 wrote to memory of 464	1324	server.exe	services.exe
PID 1324 wrote to memory of 480	1324	server.exe	lsass.exe
PID 1324 wrote to memory of 480	1324	server.exe	lsass.exe
PID 1324 wrote to memory of 480	1324	server.exe	lsass.exe
PID 1324 wrote to memory of 480	1324	server.exe	lsass.exe
PID 1324 wrote to memory of 480	1324	server.exe	lsass.exe
PID 1324 wrote to memory of 480	1324	server.exe	lsass.exe
PID 1324 wrote to memory of 480	1324	server.exe	lsass.exe
PID 1324 wrote to memory of 488	1324	server.exe	lsm.exe
PID 1324 wrote to memory of 488	1324	server.exe	lsm.exe
PID 1324 wrote to memory of 488	1324	server.exe	lsm.exe
PID 1324 wrote to memory of 488	1324	server.exe	lsm.exe
PID 1324 wrote to memory of 488	1324	server.exe	lsm.exe
PID 1324 wrote to memory of 488	1324	server.exe	lsm.exe
PID 1324 wrote to memory of 488	1324	server.exe	lsm.exe
PID 1324 wrote to memory of 592	1324	server.exe	svchost.exe
PID 1324 wrote to memory of 592	1324	server.exe	svchost.exe
PID 1324 wrote to memory of 592	1324	server.exe	svchost.exe
PID 1324 wrote to memory of 592	1324	server.exe	svchost.exe
PID 1324 wrote to memory of 592	1324	server.exe	svchost.exe
PID 1324 wrote to memory of 592	1324	server.exe	svchost.exe
PID 1324 wrote to memory of 592	1324	server.exe	svchost.exe
PID 1324 wrote to memory of 668	1324	server.exe	svchost.exe
PID 1324 wrote to memory of 668	1324	server.exe	svchost.exe
PID 1324 wrote to memory of 668	1324	server.exe	svchost.exe
PID 1324 wrote to memory of 668	1324	server.exe	svchost.exe
PID 1324 wrote to memory of 668	1324	server.exe	svchost.exe
PID 1324 wrote to memory of 668	1324	server.exe	svchost.exe
PID 1324 wrote to memory of 668	1324	server.exe	svchost.exe
PID 1324 wrote to memory of 752	1324	server.exe	svchost.exe
PID 1324 wrote to memory of 752	1324	server.exe	svchost.exe
PID 1324 wrote to memory of 752	1324	server.exe	svchost.exe
PID 1324 wrote to memory of 752	1324	server.exe	svchost.exe
PID 1324 wrote to memory of 752	1324	server.exe	svchost.exe
PID 1324 wrote to memory of 752	1324	server.exe	svchost.exe
PID 1324 wrote to memory of 752	1324	server.exe	svchost.exe
PID 1324 wrote to memory of 812	1324	server.exe	svchost.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:480

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:464

C:\Windows\system32\taskhost.exe
"taskhost.exe"
2⤵
PID:1120

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
2⤵
PID:1672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
2⤵
PID:1060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
2⤵
PID:1076

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
2⤵
PID:300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
2⤵
PID:108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
2⤵
PID:964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
2⤵
PID:840

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
2⤵
PID:812

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
2⤵
PID:752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
2⤵
PID:668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
2⤵
PID:592

C:\Windows\SysWOW64\rcflye.exe
C:\Windows\SysWOW64\rcflye.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2044

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:384

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:372

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
2⤵
PID:488

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:1964

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:2016

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1212

C:\Users\Admin\AppData\Local\Temp\server.exe
"C:\Users\Admin\AppData\Local\Temp\server.exe"
2⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1324

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1160

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\rcflye.exe
Filesize
333KB

MD5
44283b85db8476e3dbcab39e644a76bb

SHA1
afed9e102d07782074a63b8f5fae6ac0ee96ec1f

SHA256
5e213f963cb6c381a34388e9d66456cc044c395d4921440acb9d80a9625803b2

SHA512
a5f5dd9ac7116971c65ad376d31b463d0b44b6cced3db08593030eb8ccd64e1fefa1f2c0531004dc347407c2f4f8090bab860e6485f91c3a31eb49b44df78bdf

Download Submit
C:\Windows\SysWOW64\rcflye.exe
Filesize
333KB

MD5
44283b85db8476e3dbcab39e644a76bb

SHA1
afed9e102d07782074a63b8f5fae6ac0ee96ec1f

SHA256
5e213f963cb6c381a34388e9d66456cc044c395d4921440acb9d80a9625803b2

SHA512
a5f5dd9ac7116971c65ad376d31b463d0b44b6cced3db08593030eb8ccd64e1fefa1f2c0531004dc347407c2f4f8090bab860e6485f91c3a31eb49b44df78bdf

Download Submit
\Users\Admin\AppData\Local\Temp\dak224.tmp
Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
\Windows\Temp\ick1A55.tmp
Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
memory/1324-58-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1324-59-0x0000000000350000-0x00000000003C3000-memory.dmp

Filesize
460KB

Download
memory/1324-65-0x0000000000350000-0x00000000003C3000-memory.dmp

Filesize
460KB

Download
memory/1324-66-0x000000007EF90000-0x000000007EF9C000-memory.dmp

Filesize
48KB

Download
memory/2044-67-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2044-68-0x0000000000260000-0x00000000002D3000-memory.dmp

Filesize
460KB

Download
memory/2044-70-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2044-76-0x0000000000260000-0x00000000002D3000-memory.dmp

Filesize
460KB

Download