gh0strat | 6e61574af212af8a984e691c74b9bbd91d52285acd60fb778629e9bf13262b2b

General

Target

brunoHacker.exe
Size

408KB
MD5

cda724098f73a391b79378ef37177297
SHA1

c452c06614d914765eda8c33b7e618bdcddee50e
SHA256

6e61574af212af8a984e691c74b9bbd91d52285acd60fb778629e9bf13262b2b
SHA512

685f166a531911801fafaef22ddb91b43f040a7fe24a06c02c9bfd0db1b04b3982dbcb907b255fa93174f813aa754483d237a9173cc7788f44f41531ba680e1e
SSDEEP

6144:c2GWQGcZTVN+0yB6oJrcR/QRqrGj7LWd1ZDg7HHEqrGjG5vYEA:c2zQGyTVVYJrjqrG7uMHEqrGkvYE

Score

10^/10

gh0strat persistence rat

Malware Config

Signatures

Gh0st RAT payload 3 IoCs

Processes:

resource	yara_rule
\Windows\Logs\RunDllExe.dll	family_gh0strat
behavioral1/memory/324-56-0x0000000000400000-0x000000000040B000-memory.dmp	family_gh0strat
behavioral1/memory/324-57-0x0000000000400000-0x000000000040B000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Registers new Print Monitor 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

brunoHacker.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\RunDllExe	brunoHacker.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\RunDllExe\Driver = "C:\\Windows\\Logs\\RunDllExe.dll"	brunoHacker.exe

Deletes itself 1 IoCs

Processes:

powershell.exe

pid process

484 powershell.exe
Executes dropped EXE 1 IoCs

Processes:

pid process

564
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 203.124.11.111

pid	process
484	powershell.exe

pid	process
564

description	ioc
Destination IP	203.124.11.111

Drops file in System32 directory 2 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	svchost.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MpMgSvc[1].dll	svchost.exe

Drops file in Windows directory 1 IoCs

Processes:

brunoHacker.exe

description ioc process

File created C:\Windows\Logs\RunDllExe.dll brunoHacker.exe

description	ioc	process
File created	C:\Windows\Logs\RunDllExe.dll	brunoHacker.exe

Modifies data under HKEY_USERS 24 IoCs

Processes:

svchost.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0046000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E9E05470-AD65-4B2D-ACC5-F63A587D90BB}\WpadDecisionTime = f0103f742ea1d901	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E9E05470-AD65-4B2D-ACC5-F63A587D90BB}\WpadNetworkName = "Network 3"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ba-00-0e-6f-94-2e\WpadDecisionReason = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ba-00-0e-6f-94-2e\WpadDecisionTime = f0103f742ea1d901	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E9E05470-AD65-4B2D-ACC5-F63A587D90BB}\WpadDecisionReason = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E9E05470-AD65-4B2D-ACC5-F63A587D90BB}\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E9E05470-AD65-4B2D-ACC5-F63A587D90BB}\ba-00-0e-6f-94-2e	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E9E05470-AD65-4B2D-ACC5-F63A587D90BB}	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ba-00-0e-6f-94-2e	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ba-00-0e-6f-94-2e\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

brunoHacker.exepowershell.exe

pid process

1344 brunoHacker.exe
484 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 484 powershell.exe

pid	process
1344	brunoHacker.exe
484	powershell.exe

description	pid	process
Token: SeDebugPrivilege	484	powershell.exe

Suspicious use of WriteProcessMemory 48 IoCs

Processes:

brunoHacker.exe

description	pid	process	target process
PID 1344 wrote to memory of 1488	1344	brunoHacker.exe	netsh.exe
PID 1344 wrote to memory of 1488	1344	brunoHacker.exe	netsh.exe
PID 1344 wrote to memory of 1488	1344	brunoHacker.exe	netsh.exe
PID 1344 wrote to memory of 1488	1344	brunoHacker.exe	netsh.exe
PID 1344 wrote to memory of 560	1344	brunoHacker.exe	netsh.exe
PID 1344 wrote to memory of 560	1344	brunoHacker.exe	netsh.exe
PID 1344 wrote to memory of 560	1344	brunoHacker.exe	netsh.exe
PID 1344 wrote to memory of 560	1344	brunoHacker.exe	netsh.exe
PID 1344 wrote to memory of 664	1344	brunoHacker.exe	netsh.exe
PID 1344 wrote to memory of 664	1344	brunoHacker.exe	netsh.exe
PID 1344 wrote to memory of 664	1344	brunoHacker.exe	netsh.exe
PID 1344 wrote to memory of 664	1344	brunoHacker.exe	netsh.exe
PID 1344 wrote to memory of 308	1344	brunoHacker.exe	netsh.exe
PID 1344 wrote to memory of 308	1344	brunoHacker.exe	netsh.exe
PID 1344 wrote to memory of 308	1344	brunoHacker.exe	netsh.exe
PID 1344 wrote to memory of 308	1344	brunoHacker.exe	netsh.exe
PID 1344 wrote to memory of 932	1344	brunoHacker.exe	netsh.exe
PID 1344 wrote to memory of 932	1344	brunoHacker.exe	netsh.exe
PID 1344 wrote to memory of 932	1344	brunoHacker.exe	netsh.exe
PID 1344 wrote to memory of 932	1344	brunoHacker.exe	netsh.exe
PID 1344 wrote to memory of 900	1344	brunoHacker.exe	netsh.exe
PID 1344 wrote to memory of 900	1344	brunoHacker.exe	netsh.exe
PID 1344 wrote to memory of 900	1344	brunoHacker.exe	netsh.exe
PID 1344 wrote to memory of 900	1344	brunoHacker.exe	netsh.exe
PID 1344 wrote to memory of 952	1344	brunoHacker.exe	netsh.exe
PID 1344 wrote to memory of 952	1344	brunoHacker.exe	netsh.exe
PID 1344 wrote to memory of 952	1344	brunoHacker.exe	netsh.exe
PID 1344 wrote to memory of 952	1344	brunoHacker.exe	netsh.exe
PID 1344 wrote to memory of 1768	1344	brunoHacker.exe	netsh.exe
PID 1344 wrote to memory of 1768	1344	brunoHacker.exe	netsh.exe
PID 1344 wrote to memory of 1768	1344	brunoHacker.exe	netsh.exe
PID 1344 wrote to memory of 1768	1344	brunoHacker.exe	netsh.exe
PID 1344 wrote to memory of 1932	1344	brunoHacker.exe	netsh.exe
PID 1344 wrote to memory of 1932	1344	brunoHacker.exe	netsh.exe
PID 1344 wrote to memory of 1932	1344	brunoHacker.exe	netsh.exe
PID 1344 wrote to memory of 1932	1344	brunoHacker.exe	netsh.exe
PID 1344 wrote to memory of 1656	1344	brunoHacker.exe	netsh.exe
PID 1344 wrote to memory of 1656	1344	brunoHacker.exe	netsh.exe
PID 1344 wrote to memory of 1656	1344	brunoHacker.exe	netsh.exe
PID 1344 wrote to memory of 1656	1344	brunoHacker.exe	netsh.exe
PID 1344 wrote to memory of 1872	1344	brunoHacker.exe	netsh.exe
PID 1344 wrote to memory of 1872	1344	brunoHacker.exe	netsh.exe
PID 1344 wrote to memory of 1872	1344	brunoHacker.exe	netsh.exe
PID 1344 wrote to memory of 1872	1344	brunoHacker.exe	netsh.exe
PID 1344 wrote to memory of 484	1344	brunoHacker.exe	powershell.exe
PID 1344 wrote to memory of 484	1344	brunoHacker.exe	powershell.exe
PID 1344 wrote to memory of 484	1344	brunoHacker.exe	powershell.exe
PID 1344 wrote to memory of 484	1344	brunoHacker.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\brunoHacker.exe
"C:\Users\Admin\AppData\Local\Temp\brunoHacker.exe"
1⤵
- Registers new Print Monitor
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add policy name=Block
  2⤵
  PID:1488
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filterlist name=Filter1
  2⤵
  PID:560
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=TCP
  2⤵
  PID:664
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=UDP
  2⤵
  PID:308
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=TCP
  2⤵
  PID:932
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=UDP
  2⤵
  PID:900
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=TCP
  2⤵
  PID:952
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=UDP
  2⤵
  PID:1768
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filteraction name=FilteraAtion1 action=block
  2⤵
  PID:1932
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Block filterlist=Filter1 filteraction=FilteraAtion1
  2⤵
  PID:1656
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Block assign=y
  2⤵
  PID:1872
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Sleep -s 2;del "C:\Users\Admin\AppData\Local\Temp\brunoHacker.exe"
  2⤵
  - Deletes itself
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:484

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\SysWOW64\svchost.exe"
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:324

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\Logs\RunDllExe.dll

Filesize
159KB

MD5
3d52f96d0dab13ca75902ee709d916f9

SHA1
7d1d48f95f8ab059d55901cb128148ed7bbab83c

SHA256
f69397fe89df1aab5fe0af54da7658aff048c716383668909ad7929d6ba3741d

SHA512
db8187f9f114f84b4fa06bc8392ea93c51b03f1811a592c0bd62dbdfcf8aa82be8f5fee137ce8e0e28977bcc654b5269da1c0fbb34f90f7d585fcf7c5d682f62

Download Submit
memory/324-56-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/324-57-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/484-60-0x0000000002410000-0x0000000002450000-memory.dmp

Filesize
256KB

Download
memory/484-61-0x0000000002410000-0x0000000002450000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads