gh0strat | 90a9a9a95482f3ac671e5ca6fa903f77981d8c4e9a5fdfdab30aa9e78b209caa

Analysis

max time kernel
119s
max time network
149s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
28-08-2023 04:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

90a9a9a95482f3ac671e5ca6fa903f77981d8c4e9a5fdfdab30aa9e78b209caa.exe
Size

88KB
MD5

53288ce74e42c1d735fd47e24212e97d
SHA1

3bdc0fac46e971383aab3f12f59ca57aee6bf2e8
SHA256

90a9a9a95482f3ac671e5ca6fa903f77981d8c4e9a5fdfdab30aa9e78b209caa
SHA512

de43cd22e0d5c0ab6bcecd69a716f5f870d511c4dc65d63354f1ffc0ce241fe8493f872c25beca34570d336944e969e5617fb37f277794c0a8a876003a88db57
SSDEEP

1536:L09QyXIbKQ2ctn5lbE2buHW1111111111111111111111111111111111111111f:+QyXImQ2ctnvbEDW111111111111111t

Score

10^/10

gh0strat persistence rat

Malware Config

Signatures

Gh0st RAT payload 2 IoCs

resource	yara_rule
behavioral1/memory/2292-0-0x0000000001EB0000-0x0000000001EFE000-memory.dmp	family_gh0strat
behavioral1/memory/2292-1-0x0000000010000000-0x0000000010018000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ÏµÍ³Éý¼¶Ö§³Ö = "C:\\Users\\Admin\\AppData\\Local\\Temp\\90a9a9a95482f3ac671e5ca6fa903f77981d8c4e9a5fdfdab30aa9e78b209caa.exe"	90a9a9a95482f3ac671e5ca6fa903f77981d8c4e9a5fdfdab30aa9e78b209caa.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2292	90a9a9a95482f3ac671e5ca6fa903f77981d8c4e9a5fdfdab30aa9e78b209caa.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2292	90a9a9a95482f3ac671e5ca6fa903f77981d8c4e9a5fdfdab30aa9e78b209caa.exe
2292	90a9a9a95482f3ac671e5ca6fa903f77981d8c4e9a5fdfdab30aa9e78b209caa.exe

C:\Users\Admin\AppData\Local\Temp\90a9a9a95482f3ac671e5ca6fa903f77981d8c4e9a5fdfdab30aa9e78b209caa.exe
"C:\Users\Admin\AppData\Local\Temp\90a9a9a95482f3ac671e5ca6fa903f77981d8c4e9a5fdfdab30aa9e78b209caa.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2292-0-0x0000000001EB0000-0x0000000001EFE000-memory.dmp

Filesize
312KB

Download
memory/2292-1-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download