gh0strat | e0876e96ff2cead5fb36f097f0312f809626287bda7809d9e741d869387cc618

Analysis

max time kernel
153s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2023, 15:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e0876e96ff2cead5fb36f097f0312f809626287bda7809d9e741d869387cc618.exe
Size

2.1MB
MD5

6ff22367445fd5b83fd988006910967e
SHA1

fff398692fc7c2da091b506a42b12cae8dad5212
SHA256

e0876e96ff2cead5fb36f097f0312f809626287bda7809d9e741d869387cc618
SHA512

25581e2ed2eccc263e8266d1936ea4c6daa2ea69439ef66a2fcc4b3d4e83de8c904d34334444f26e52d936b44be25f5412c53059456a555cf3a6ac0f1cf53a04
SSDEEP

49152:tTYcTarVjQllcn9XdeUxIMTr+Emb9XK6adYKuuTkP8UL2Z5e/gPSsP7YU4:tGVjQllcn9X/xdmEmb9XK68uuTkP0e/o

Score

10^/10

gh0strat rat

Malware Config

Signatures

Gh0st RAT payload 2 IoCs

resource	yara_rule
behavioral2/memory/4128-47-0x0000000010000000-0x000000001007B000-memory.dmp	family_gh0strat
behavioral2/memory/4128-64-0x0000000003800000-0x0000000003896000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation	e0876e96ff2cead5fb36f097f0312f809626287bda7809d9e741d869387cc618.exe

Executes dropped EXE 1 IoCs

pid	Process
4128	MSIF1.exe

Loads dropped DLL 6 IoCs

pid	Process
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	MSIF1.exe
File opened (read-only)	\??\B:	MSIF1.exe
File opened (read-only)	\??\G:	MSIF1.exe
File opened (read-only)	\??\R:	MSIF1.exe
File opened (read-only)	\??\S:	MSIF1.exe
File opened (read-only)	\??\T:	MSIF1.exe
File opened (read-only)	\??\E:	MSIF1.exe
File opened (read-only)	\??\Q:	MSIF1.exe
File opened (read-only)	\??\W:	MSIF1.exe
File opened (read-only)	\??\X:	MSIF1.exe
File opened (read-only)	\??\K:	MSIF1.exe
File opened (read-only)	\??\L:	MSIF1.exe
File opened (read-only)	\??\N:	MSIF1.exe
File opened (read-only)	\??\P:	MSIF1.exe
File opened (read-only)	\??\U:	MSIF1.exe
File opened (read-only)	\??\V:	MSIF1.exe
File opened (read-only)	\??\Z:	MSIF1.exe
File opened (read-only)	\??\H:	MSIF1.exe
File opened (read-only)	\??\I:	MSIF1.exe
File opened (read-only)	\??\J:	MSIF1.exe
File opened (read-only)	\??\M:	MSIF1.exe
File opened (read-only)	\??\O:	MSIF1.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSIF1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MSIF1.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe
4128	MSIF1.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4128	MSIF1.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4128	MSIF1.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4320	e0876e96ff2cead5fb36f097f0312f809626287bda7809d9e741d869387cc618.exe
4320	e0876e96ff2cead5fb36f097f0312f809626287bda7809d9e741d869387cc618.exe
4128	MSIF1.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4320 wrote to memory of 4128	4320	e0876e96ff2cead5fb36f097f0312f809626287bda7809d9e741d869387cc618.exe	98
PID 4320 wrote to memory of 4128	4320	e0876e96ff2cead5fb36f097f0312f809626287bda7809d9e741d869387cc618.exe	98
PID 4320 wrote to memory of 4128	4320	e0876e96ff2cead5fb36f097f0312f809626287bda7809d9e741d869387cc618.exe	98

C:\Users\Admin\AppData\Local\Temp\e0876e96ff2cead5fb36f097f0312f809626287bda7809d9e741d869387cc618.exe
"C:\Users\Admin\AppData\Local\Temp\e0876e96ff2cead5fb36f097f0312f809626287bda7809d9e741d869387cc618.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4320
- C:\Users\Public\LanecatTrial\MSIF1.exe
  "C:\Users\Public\LanecatTrial\MSIF1.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\LanecatTrial\MSIF1.dat

Filesize
61B

MD5
9007d611da15e2880500f4d32dce22b5

SHA1
36462ed68e1cc9be8e4caaab6af98f81ac1ac6e8

SHA256
daa0d81956c390e8a7928da1fb6cd5832f4a5fb10709b2093cca1015ce035389

SHA512
bcea1ff73980bd16b97427a1abcfc8cea1e4d1f1373f715a1968dc651c39944b132c4a280b8ae55b203d0f444decb756bad5a2535a857cd74f97729a3bca872f

Download Submit
C:\Users\Public\LanecatTrial\MSIF1.exe

Filesize
2.0MB

MD5
2ff236ca982bc4fdd29586ab77c49fdd

SHA1
187b43ea891e01b6530d249b988c713d826c04e7

SHA256
9064ab3843cb154f46a2e4d9a5d0f2df9bedd1a684efaba8a6e94cb77070edf3

SHA512
c43f693d095fe02a53368fb9d3ea207f1082201afebd00076eb08bad082e71cf2ec66bc1bb45405278c91afdf8b6087b366540843c88cfcf80184c2e15b1504d

Download Submit
C:\Users\Public\LanecatTrial\MSIF1.exe

Filesize
2.0MB

MD5
2ff236ca982bc4fdd29586ab77c49fdd

SHA1
187b43ea891e01b6530d249b988c713d826c04e7

SHA256
9064ab3843cb154f46a2e4d9a5d0f2df9bedd1a684efaba8a6e94cb77070edf3

SHA512
c43f693d095fe02a53368fb9d3ea207f1082201afebd00076eb08bad082e71cf2ec66bc1bb45405278c91afdf8b6087b366540843c88cfcf80184c2e15b1504d

Download Submit
C:\Users\Public\LanecatTrial\MSIF1.exe

Filesize
2.0MB

MD5
2ff236ca982bc4fdd29586ab77c49fdd

SHA1
187b43ea891e01b6530d249b988c713d826c04e7

SHA256
9064ab3843cb154f46a2e4d9a5d0f2df9bedd1a684efaba8a6e94cb77070edf3

SHA512
c43f693d095fe02a53368fb9d3ea207f1082201afebd00076eb08bad082e71cf2ec66bc1bb45405278c91afdf8b6087b366540843c88cfcf80184c2e15b1504d

Download Submit
C:\Users\Public\LanecatTrial\MSVCP100.dll

Filesize
411KB

MD5
e3c817f7fe44cc870ecdbcbc3ea36132

SHA1
2ada702a0c143a7ae39b7de16a4b5cc994d2548b

SHA256
d769fafa2b3232de9fa7153212ba287f68e745257f1c00fafb511e7a02de7adf

SHA512
4fcf3fcdd27c97a714e173aa221f53df6c152636d77dea49e256a9788f2d3f2c2d7315dd0b4d72ecefc553082f9149b8580779abb39891a88907f16ec9e13cbe

Download Submit
C:\Users\Public\LanecatTrial\MSVCR100.dll

Filesize
755KB

MD5
bf38660a9125935658cfa3e53fdc7d65

SHA1
0b51fb415ec89848f339f8989d323bea722bfd70

SHA256
60c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa

SHA512
25f521ffe25a950d0f1a4de63b04cb62e2a3b0e72e7405799586913208bf8f8fa52aa34e96a9cc6ee47afcd41870f3aa0cd8289c53461d1b6e792d19b750c9a1

Download Submit
C:\Users\Public\LanecatTrial\donottrace.txt

Filesize
576KB

MD5
0c7e1f10b913905bee841b78e3a35676

SHA1
ce4d74e314bca1d23afab5cb5d014f7e8e4efe89

SHA256
be554ac1cc79c2b7d5cd6ec35b2167a0e94e76bc78598eeb5c7b82cc366cd537

SHA512
137b54335b3b3b8254afbc27bc36b20360abae9dd43d336927cfa08a9c3654448e1c3fc33a559f5000433a482a22c8a03d902b61332b81a60d529ef3d68225fb

Download Submit
C:\Users\Public\LanecatTrial\mfc100u.dll

Filesize
4.2MB

MD5
f32077df74efd435a1dcdf415e189df1

SHA1
2771393d56ff167275bf03170377c43c28ee14e1

SHA256
24bb6838defd491df5460a88bed2d70b903a2156c49fb63e214e2c77251eca71

SHA512
fb708e0949854998fb80635138c80ac05d77dca3089d3e5974663ddf2376d6a03535dae1a068514c3b58bc06c8e4078b37cfb6bc90f080f7f31fefc972a34850

Download Submit
C:\Users\Public\LanecatTrial\mfc100u.dll

Filesize
4.2MB

MD5
f32077df74efd435a1dcdf415e189df1

SHA1
2771393d56ff167275bf03170377c43c28ee14e1

SHA256
24bb6838defd491df5460a88bed2d70b903a2156c49fb63e214e2c77251eca71

SHA512
fb708e0949854998fb80635138c80ac05d77dca3089d3e5974663ddf2376d6a03535dae1a068514c3b58bc06c8e4078b37cfb6bc90f080f7f31fefc972a34850

Download Submit
C:\Users\Public\LanecatTrial\mirage_cm.dll

Filesize
305KB

MD5
5d6c90d2cb177500f7b46f8c7caf6531

SHA1
4fc46eb0cf80073855580ec34b319fe361020379

SHA256
e512dc10ff8d33efe688c3214be608a40ecf4f1f7b4f9659ff6efc9a6827ee40

SHA512
eb35f337e0a6387d4bc47b6d9be241e4ea2c28936e3b4edc58448fc205b55c8171ec40399293b24e949fbb2a656918056e498b6dbedd6757c7bf2151862aa0d0

Download Submit
C:\Users\Public\LanecatTrial\mirage_cm.dll

Filesize
305KB

MD5
5d6c90d2cb177500f7b46f8c7caf6531

SHA1
4fc46eb0cf80073855580ec34b319fe361020379

SHA256
e512dc10ff8d33efe688c3214be608a40ecf4f1f7b4f9659ff6efc9a6827ee40

SHA512
eb35f337e0a6387d4bc47b6d9be241e4ea2c28936e3b4edc58448fc205b55c8171ec40399293b24e949fbb2a656918056e498b6dbedd6757c7bf2151862aa0d0

Download Submit
C:\Users\Public\LanecatTrial\msvcp100.dll

Filesize
411KB

MD5
e3c817f7fe44cc870ecdbcbc3ea36132

SHA1
2ada702a0c143a7ae39b7de16a4b5cc994d2548b

SHA256
d769fafa2b3232de9fa7153212ba287f68e745257f1c00fafb511e7a02de7adf

SHA512
4fcf3fcdd27c97a714e173aa221f53df6c152636d77dea49e256a9788f2d3f2c2d7315dd0b4d72ecefc553082f9149b8580779abb39891a88907f16ec9e13cbe

Download Submit
C:\Users\Public\LanecatTrial\msvcr100.dll

Filesize
755KB

MD5
bf38660a9125935658cfa3e53fdc7d65

SHA1
0b51fb415ec89848f339f8989d323bea722bfd70

SHA256
60c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa

SHA512
25f521ffe25a950d0f1a4de63b04cb62e2a3b0e72e7405799586913208bf8f8fa52aa34e96a9cc6ee47afcd41870f3aa0cd8289c53461d1b6e792d19b750c9a1

Download Submit
C:\Users\Public\LanecatTrial\task.dat

Filesize
79B

MD5
1a7daedf4733bcc6c469200bffc5d8b1

SHA1
9e18b345ca9e6b9f7c378b3060fb878856164330

SHA256
1fd13179203c52f4510a768e89cebcc3057490245ad8328ecd7756e5b85b9400

SHA512
62ed084e03227149f2940bcc636817666e2f07fe800046ef09f8e91e2d15ff39c689e463f5c7946605384fb6b1e9844f5204fe8615973db528b65b4edcd64309

Download Submit
C:\Users\Public\LanecatTrial\wrapcef.dll

Filesize
60KB

MD5
3b1d46c4eb061065a5bb32d4fbb86b79

SHA1
b04e3e18bee6dc6f298e2242c89041d16eb2d8bf

SHA256
4e56158a4c191bff82056902290346109c8354eb7e43ba7de8e127535eb09507

SHA512
d024ce1446086c0552d12f2bb117149821637cfaa887e4159a4fd94b0db4dee10126fc2c1577ef00e7efe89ee041b98f26c88996f4058b52300e4cff856af24d

Download Submit
C:\Users\Public\LanecatTrial\wrapcef.dll

Filesize
60KB

MD5
3b1d46c4eb061065a5bb32d4fbb86b79

SHA1
b04e3e18bee6dc6f298e2242c89041d16eb2d8bf

SHA256
4e56158a4c191bff82056902290346109c8354eb7e43ba7de8e127535eb09507

SHA512
d024ce1446086c0552d12f2bb117149821637cfaa887e4159a4fd94b0db4dee10126fc2c1577ef00e7efe89ee041b98f26c88996f4058b52300e4cff856af24d

Download Submit
C:\Users\Public\LanecatTrial\wrapcef.dll

Filesize
60KB

MD5
3b1d46c4eb061065a5bb32d4fbb86b79

SHA1
b04e3e18bee6dc6f298e2242c89041d16eb2d8bf

SHA256
4e56158a4c191bff82056902290346109c8354eb7e43ba7de8e127535eb09507

SHA512
d024ce1446086c0552d12f2bb117149821637cfaa887e4159a4fd94b0db4dee10126fc2c1577ef00e7efe89ee041b98f26c88996f4058b52300e4cff856af24d

Download Submit
memory/4128-44-0x0000000003800000-0x0000000003896000-memory.dmp

Filesize
600KB

Download
memory/4128-45-0x0000000003800000-0x0000000003896000-memory.dmp

Filesize
600KB

Download
memory/4128-47-0x0000000010000000-0x000000001007B000-memory.dmp

Filesize
492KB

Download
memory/4128-64-0x0000000003800000-0x0000000003896000-memory.dmp

Filesize
600KB

Download