gh0strat | 2166039dff43718f7ec551e93353c1c439a5299a9afdad6286ea6e3054ae7f0c

Analysis

max time kernel
60s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
22/04/2023, 10:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5637b80c6dfa6a096df3684c7fcf0309.exe
Size

888KB
MD5

5637b80c6dfa6a096df3684c7fcf0309
SHA1

bb9feca97658ba25e31677f7844692ef4b9d9e63
SHA256

2166039dff43718f7ec551e93353c1c439a5299a9afdad6286ea6e3054ae7f0c
SHA512

4d85f9d1903569434907fff75b2bc48c13e609d0429f521411de968e5ac05e940ed0cd6c201f8df47fd18d9d863a892ac11a38b29f18ca12e333da9a969a0f75
SSDEEP

12288:WXwncX7nekNJyECJlBfsyiSLb0b3w99n/3GYECzqFwdFslbDeYFKi8xlzxrC5VB:WXccFnyBflRb0s99nJADv0Vjl

Score

10^/10

gh0strat rat vmprotect

Malware Config

Extracted

Family

gh0strat

15.cmananan.com

Signatures

Gh0st RAT payload 3 IoCs

resource	yara_rule
behavioral2/memory/4144-134-0x0000000000400000-0x00000000005E1000-memory.dmp	family_gh0strat
behavioral2/memory/4144-135-0x0000000010000000-0x0000000010010000-memory.dmp	family_gh0strat
behavioral2/memory/4144-138-0x0000000000400000-0x00000000005E1000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/4144-133-0x0000000000400000-0x00000000005E1000-memory.dmp	vmprotect
behavioral2/memory/4144-134-0x0000000000400000-0x00000000005E1000-memory.dmp	vmprotect
behavioral2/memory/4144-138-0x0000000000400000-0x00000000005E1000-memory.dmp	vmprotect

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	5637b80c6dfa6a096df3684c7fcf0309.exe
File opened (read-only)	\??\M:	5637b80c6dfa6a096df3684c7fcf0309.exe
File opened (read-only)	\??\Q:	5637b80c6dfa6a096df3684c7fcf0309.exe
File opened (read-only)	\??\B:	5637b80c6dfa6a096df3684c7fcf0309.exe
File opened (read-only)	\??\G:	5637b80c6dfa6a096df3684c7fcf0309.exe
File opened (read-only)	\??\W:	5637b80c6dfa6a096df3684c7fcf0309.exe
File opened (read-only)	\??\Y:	5637b80c6dfa6a096df3684c7fcf0309.exe
File opened (read-only)	\??\F:	5637b80c6dfa6a096df3684c7fcf0309.exe
File opened (read-only)	\??\P:	5637b80c6dfa6a096df3684c7fcf0309.exe
File opened (read-only)	\??\L:	5637b80c6dfa6a096df3684c7fcf0309.exe
File opened (read-only)	\??\R:	5637b80c6dfa6a096df3684c7fcf0309.exe
File opened (read-only)	\??\S:	5637b80c6dfa6a096df3684c7fcf0309.exe
File opened (read-only)	\??\T:	5637b80c6dfa6a096df3684c7fcf0309.exe
File opened (read-only)	\??\U:	5637b80c6dfa6a096df3684c7fcf0309.exe
File opened (read-only)	\??\V:	5637b80c6dfa6a096df3684c7fcf0309.exe
File opened (read-only)	\??\H:	5637b80c6dfa6a096df3684c7fcf0309.exe
File opened (read-only)	\??\I:	5637b80c6dfa6a096df3684c7fcf0309.exe
File opened (read-only)	\??\X:	5637b80c6dfa6a096df3684c7fcf0309.exe
File opened (read-only)	\??\N:	5637b80c6dfa6a096df3684c7fcf0309.exe
File opened (read-only)	\??\O:	5637b80c6dfa6a096df3684c7fcf0309.exe
File opened (read-only)	\??\Z:	5637b80c6dfa6a096df3684c7fcf0309.exe
File opened (read-only)	\??\E:	5637b80c6dfa6a096df3684c7fcf0309.exe
File opened (read-only)	\??\K:	5637b80c6dfa6a096df3684c7fcf0309.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	5637b80c6dfa6a096df3684c7fcf0309.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	5637b80c6dfa6a096df3684c7fcf0309.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4144	5637b80c6dfa6a096df3684c7fcf0309.exe
4144	5637b80c6dfa6a096df3684c7fcf0309.exe

C:\Users\Admin\AppData\Local\Temp\5637b80c6dfa6a096df3684c7fcf0309.exe
"C:\Users\Admin\AppData\Local\Temp\5637b80c6dfa6a096df3684c7fcf0309.exe"
1⤵
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4144

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4144-133-0x0000000000400000-0x00000000005E1000-memory.dmp

Filesize
1.9MB

Download
memory/4144-134-0x0000000000400000-0x00000000005E1000-memory.dmp

Filesize
1.9MB

Download
memory/4144-135-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/4144-138-0x0000000000400000-0x00000000005E1000-memory.dmp

Filesize
1.9MB

Download