gh0strat | edd2d40dcf22ccda50923974cd012c5f4347f97193f80ba7703e00ec68182bde

Analysis

max time kernel
140s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
15-10-2023 14:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

829cf4d4d062b1fda42b43b4c00eab30_dll32_JC.dll
Size

137KB
MD5

829cf4d4d062b1fda42b43b4c00eab30
SHA1

2d643c9cd1a30bfeb1b9d4642c2cda695dd15251
SHA256

edd2d40dcf22ccda50923974cd012c5f4347f97193f80ba7703e00ec68182bde
SHA512

c73525c66abc8c4d2276c9204185cb2ab697b2f3a5aeb46441b84eae0c480c27c458d085df95633c7a6294006d4eb710e8cb68ce7ffb13e1132cd34449b20c61
SSDEEP

3072:DR02WMK8RJGInTlhnaBanONVk40rpg4yeF/TyUGSK9FrafcUksPxx6iTUu+:O25GgFny61mra8

Score

10^/10

gh0strat persistence rat

Malware Config

Signatures

Gh0st RAT payload 3 IoCs

resource	yara_rule
behavioral1/memory/2360-5-0x0000000010000000-0x000000001001C000-memory.dmp	family_gh0strat
behavioral1/memory/2360-4-0x0000000010000000-0x000000001001C000-memory.dmp	family_gh0strat
behavioral1/memory/2360-6-0x0000000010000000-0x000000001001C000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Registers new Print Monitor 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\SCSI Port Monitor	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\SCSI Port Monitor\Driver = "scsimon.dll"	rundll32.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Spooler\ImagePath = "Spoolsv.exe"	rundll32.exe

ACProtect 1.3x - 1.4x DLL software 3 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/memory/2360-5-0x0000000010000000-0x000000001001C000-memory.dmp	acprotect
behavioral1/memory/2360-4-0x0000000010000000-0x000000001001C000-memory.dmp	acprotect
behavioral1/memory/2360-6-0x0000000010000000-0x000000001001C000-memory.dmp	acprotect

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\com\comb.dll	rundll32.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\AppPatch\ComBack.Dll	rundll32.exe
File created	C:\Windows\AppPatch\ComBack.Dll	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2328	2360	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2360	2112	rundll32.exe	27
PID 2112 wrote to memory of 2360	2112	rundll32.exe	27
PID 2112 wrote to memory of 2360	2112	rundll32.exe	27
PID 2112 wrote to memory of 2360	2112	rundll32.exe	27
PID 2112 wrote to memory of 2360	2112	rundll32.exe	27
PID 2112 wrote to memory of 2360	2112	rundll32.exe	27
PID 2112 wrote to memory of 2360	2112	rundll32.exe	27
PID 2360 wrote to memory of 2328	2360	rundll32.exe	29
PID 2360 wrote to memory of 2328	2360	rundll32.exe	29
PID 2360 wrote to memory of 2328	2360	rundll32.exe	29
PID 2360 wrote to memory of 2328	2360	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\829cf4d4d062b1fda42b43b4c00eab30_dll32_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\829cf4d4d062b1fda42b43b4c00eab30_dll32_JC.dll,#1
  2⤵
  - Registers new Print Monitor
  - Sets service image path in registry
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2360 -s 232
    3⤵
    - Program crash
    PID:2328

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding
1⤵
PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2360-5-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/2360-4-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/2360-6-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/2360-7-0x0000000043E50000-0x0000000043E77000-memory.dmp

Filesize
156KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads