gh0strat | 4de3a1ad420f6aadd0bb1397f8537b7e8628435d030b536a86a7d371c379e2f3

General

Target

4de3a1ad420f6aadd0bb1397f8537b7e8628435d030b536a86a7d371c379e2f3.exe
Size

5.3MB
MD5

903580e3baf539e5b2775b9870661428
SHA1

b28518ae55c852b1995dffff9191697113e67dca
SHA256

4de3a1ad420f6aadd0bb1397f8537b7e8628435d030b536a86a7d371c379e2f3
SHA512

e36e3e6c149b585dd86649733b46ce0954dc68fe437f42537d5c11baadf62cabe8f86ea166fddb958c2818a4b80037b50ac1715ebd8d20c9842223d8c5aa1c9f
SSDEEP

98304:ygBLGCCmiKM7O2UbGQqIqRpZqBabzTT0zBcrt//svPYRA3Dyt2jc31T:yghGCFBsiabzTTO9QOX4T

Score

10^/10

Malware Config

Signatures

Gh0st RAT payload 10 IoCs

resource	yara_rule
behavioral1/memory/1120-17-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat
behavioral1/memory/1120-19-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat
behavioral1/memory/1120-18-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat
behavioral1/memory/1120-23-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat
behavioral1/memory/1120-28-0x0000000002BD0000-0x0000000002D1C000-memory.dmp	family_gh0strat
behavioral1/memory/1120-29-0x0000000002BD0000-0x0000000002D1C000-memory.dmp	family_gh0strat
behavioral1/memory/1120-30-0x0000000002BD0000-0x0000000002D1C000-memory.dmp	family_gh0strat
behavioral1/memory/1120-32-0x0000000002BD0000-0x0000000002D1C000-memory.dmp	family_gh0strat
behavioral1/memory/1120-34-0x0000000002BD0000-0x0000000002D1C000-memory.dmp	family_gh0strat
behavioral1/memory/1120-39-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
1120	MinirunSetup_zhw-c_1.0.0.1639.exe

Loads dropped DLL 2 IoCs

pid	Process
2572	4de3a1ad420f6aadd0bb1397f8537b7e8628435d030b536a86a7d371c379e2f3.exe
1120	MinirunSetup_zhw-c_1.0.0.1639.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1120-14-0x0000000010000000-0x0000000010011000-memory.dmp	upx
behavioral1/memory/1120-17-0x0000000010000000-0x0000000010011000-memory.dmp	upx
behavioral1/memory/1120-19-0x0000000010000000-0x0000000010011000-memory.dmp	upx
behavioral1/memory/1120-18-0x0000000010000000-0x0000000010011000-memory.dmp	upx
behavioral1/memory/1120-23-0x0000000010000000-0x0000000010011000-memory.dmp	upx
behavioral1/memory/1120-25-0x0000000002BD0000-0x0000000002D1C000-memory.dmp	upx
behavioral1/memory/1120-28-0x0000000002BD0000-0x0000000002D1C000-memory.dmp	upx
behavioral1/memory/1120-29-0x0000000002BD0000-0x0000000002D1C000-memory.dmp	upx
behavioral1/memory/1120-30-0x0000000002BD0000-0x0000000002D1C000-memory.dmp	upx
behavioral1/memory/1120-32-0x0000000002BD0000-0x0000000002D1C000-memory.dmp	upx
behavioral1/memory/1120-34-0x0000000002BD0000-0x0000000002D1C000-memory.dmp	upx
behavioral1/memory/1120-39-0x0000000010000000-0x0000000010011000-memory.dmp	upx

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Logs\nw_elf.dll	4de3a1ad420f6aadd0bb1397f8537b7e8628435d030b536a86a7d371c379e2f3.exe
File created	C:\Windows\Logs\SetUpDaDa.exe	4de3a1ad420f6aadd0bb1397f8537b7e8628435d030b536a86a7d371c379e2f3.exe
File created	C:\Windows\a1.txt	4de3a1ad420f6aadd0bb1397f8537b7e8628435d030b536a86a7d371c379e2f3.exe
File created	C:\Windows\Logs\MinirunSetup_zhw-c_1.0.0.1639.exe	4de3a1ad420f6aadd0bb1397f8537b7e8628435d030b536a86a7d371c379e2f3.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
2572	4de3a1ad420f6aadd0bb1397f8537b7e8628435d030b536a86a7d371c379e2f3.exe
1120	MinirunSetup_zhw-c_1.0.0.1639.exe
1120	MinirunSetup_zhw-c_1.0.0.1639.exe
1120	MinirunSetup_zhw-c_1.0.0.1639.exe
1120	MinirunSetup_zhw-c_1.0.0.1639.exe
1120	MinirunSetup_zhw-c_1.0.0.1639.exe
1120	MinirunSetup_zhw-c_1.0.0.1639.exe
1120	MinirunSetup_zhw-c_1.0.0.1639.exe
1120	MinirunSetup_zhw-c_1.0.0.1639.exe
1120	MinirunSetup_zhw-c_1.0.0.1639.exe
1120	MinirunSetup_zhw-c_1.0.0.1639.exe
1120	MinirunSetup_zhw-c_1.0.0.1639.exe
1120	MinirunSetup_zhw-c_1.0.0.1639.exe
1120	MinirunSetup_zhw-c_1.0.0.1639.exe
1120	MinirunSetup_zhw-c_1.0.0.1639.exe
1120	MinirunSetup_zhw-c_1.0.0.1639.exe
1120	MinirunSetup_zhw-c_1.0.0.1639.exe
1120	MinirunSetup_zhw-c_1.0.0.1639.exe
1120	MinirunSetup_zhw-c_1.0.0.1639.exe
1120	MinirunSetup_zhw-c_1.0.0.1639.exe
1120	MinirunSetup_zhw-c_1.0.0.1639.exe
1120	MinirunSetup_zhw-c_1.0.0.1639.exe
1120	MinirunSetup_zhw-c_1.0.0.1639.exe
1120	MinirunSetup_zhw-c_1.0.0.1639.exe
1120	MinirunSetup_zhw-c_1.0.0.1639.exe
1120	MinirunSetup_zhw-c_1.0.0.1639.exe
1120	MinirunSetup_zhw-c_1.0.0.1639.exe
1120	MinirunSetup_zhw-c_1.0.0.1639.exe
1120	MinirunSetup_zhw-c_1.0.0.1639.exe
1120	MinirunSetup_zhw-c_1.0.0.1639.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 1120	2572	4de3a1ad420f6aadd0bb1397f8537b7e8628435d030b536a86a7d371c379e2f3.exe	29
PID 2572 wrote to memory of 1120	2572	4de3a1ad420f6aadd0bb1397f8537b7e8628435d030b536a86a7d371c379e2f3.exe	29
PID 2572 wrote to memory of 1120	2572	4de3a1ad420f6aadd0bb1397f8537b7e8628435d030b536a86a7d371c379e2f3.exe	29
PID 2572 wrote to memory of 1120	2572	4de3a1ad420f6aadd0bb1397f8537b7e8628435d030b536a86a7d371c379e2f3.exe	29
PID 2572 wrote to memory of 1120	2572	4de3a1ad420f6aadd0bb1397f8537b7e8628435d030b536a86a7d371c379e2f3.exe	29
PID 2572 wrote to memory of 1120	2572	4de3a1ad420f6aadd0bb1397f8537b7e8628435d030b536a86a7d371c379e2f3.exe	29
PID 2572 wrote to memory of 1120	2572	4de3a1ad420f6aadd0bb1397f8537b7e8628435d030b536a86a7d371c379e2f3.exe	29

C:\Users\Admin\AppData\Local\Temp\4de3a1ad420f6aadd0bb1397f8537b7e8628435d030b536a86a7d371c379e2f3.exe
"C:\Users\Admin\AppData\Local\Temp\4de3a1ad420f6aadd0bb1397f8537b7e8628435d030b536a86a7d371c379e2f3.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Windows\Logs\MinirunSetup_zhw-c_1.0.0.1639.exe
  C:\Windows\Logs\MinirunSetup_zhw-c_1.0.0.1639.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:1120

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Logs\MinirunSetup_zhw-c_1.0.0.1639.exe

Filesize
2.8MB

MD5
1f2c3c73a13570d4fc757263f87e1dfc

SHA1
05a571400b0e4860d955ac926c6bfb46275bfb6f

SHA256
017559b5ae438abdc62a834e6b6282efcfb142b592b2258e488877ec98b4eff8

SHA512
512fb8c107abe837a6f994da0894ad5d9b33a87586c219c9107fedef377ab8d9d7ce7fd33bac125a9b4cb60e3474d8438e605760847d083c21cdb8d9c6bfb802

Download Submit
C:\Windows\Logs\nw_elf.dll

Filesize
114KB

MD5
6617ebd76619ec88c18f8a94be1fcadd

SHA1
8bfb3ce7a0e4d66ff0502949b8e407f72bf1335f

SHA256
dff1f5e0e0c76b952c2ea92857b7d3b0cfc8ad7977316d95ae4d5b9b4aa5b93f

SHA512
fa8a68b734712553ff91d7a9aab9f8527b85dbaf6beed37fe77e9b0e87455b7e9797ab5d599f2187d33f3a674aebce44680e13a6d47f66cdac27339e7127b65b

Download Submit
C:\Windows\a1.txt

Filesize
1KB

MD5
6f8c827b22e3322f5304f8f101699f15

SHA1
13016ec943ea862f5a3759da05f347e1e106de09

SHA256
6a802b1f6e52a756e975b6360f9e5813084a0751ed04b780023ee62114a3134f

SHA512
aba439d673e1abbf4898d1f9e1e8e32c076406e5f2e6a04156bcb4b3184a2a6811ccf42c7ea8fe0b32ac9902dcb423562f6fae9ced022503b6b517e4d33339ce

Download Submit
\Windows\Logs\MinirunSetup_zhw-c_1.0.0.1639.exe

Filesize
2.8MB

MD5
1f2c3c73a13570d4fc757263f87e1dfc

SHA1
05a571400b0e4860d955ac926c6bfb46275bfb6f

SHA256
017559b5ae438abdc62a834e6b6282efcfb142b592b2258e488877ec98b4eff8

SHA512
512fb8c107abe837a6f994da0894ad5d9b33a87586c219c9107fedef377ab8d9d7ce7fd33bac125a9b4cb60e3474d8438e605760847d083c21cdb8d9c6bfb802

Download Submit
\Windows\Logs\nw_elf.dll

Filesize
114KB

MD5
6617ebd76619ec88c18f8a94be1fcadd

SHA1
8bfb3ce7a0e4d66ff0502949b8e407f72bf1335f

SHA256
dff1f5e0e0c76b952c2ea92857b7d3b0cfc8ad7977316d95ae4d5b9b4aa5b93f

SHA512
fa8a68b734712553ff91d7a9aab9f8527b85dbaf6beed37fe77e9b0e87455b7e9797ab5d599f2187d33f3a674aebce44680e13a6d47f66cdac27339e7127b65b

Download Submit
memory/1120-18-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/1120-23-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/1120-14-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/1120-17-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/1120-19-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/1120-12-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/1120-22-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/1120-13-0x0000000000240000-0x000000000028E000-memory.dmp

Filesize
312KB

Download
memory/1120-25-0x0000000002BD0000-0x0000000002D1C000-memory.dmp

Filesize
1.3MB

Download
memory/1120-28-0x0000000002BD0000-0x0000000002D1C000-memory.dmp

Filesize
1.3MB

Download
memory/1120-29-0x0000000002BD0000-0x0000000002D1C000-memory.dmp

Filesize
1.3MB

Download
memory/1120-30-0x0000000002BD0000-0x0000000002D1C000-memory.dmp

Filesize
1.3MB

Download
memory/1120-32-0x0000000002BD0000-0x0000000002D1C000-memory.dmp

Filesize
1.3MB

Download
memory/1120-34-0x0000000002BD0000-0x0000000002D1C000-memory.dmp

Filesize
1.3MB

Download
memory/1120-39-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing