gh0strat | edd2d40dcf22ccda50923974cd012c5f4347f97193f80ba7703e00ec68182bde

General

Target

829cf4d4d062b1fda42b43b4c00eab30_dll32_JC.dll
Size

137KB
MD5

829cf4d4d062b1fda42b43b4c00eab30
SHA1

2d643c9cd1a30bfeb1b9d4642c2cda695dd15251
SHA256

edd2d40dcf22ccda50923974cd012c5f4347f97193f80ba7703e00ec68182bde
SHA512

c73525c66abc8c4d2276c9204185cb2ab697b2f3a5aeb46441b84eae0c480c27c458d085df95633c7a6294006d4eb710e8cb68ce7ffb13e1132cd34449b20c61
SSDEEP

3072:DR02WMK8RJGInTlhnaBanONVk40rpg4yeF/TyUGSK9FrafcUksPxx6iTUu+:O25GgFny61mra8

Score

10^/10

Malware Config

Signatures

Gh0st RAT payload 3 IoCs

resource	yara_rule
behavioral2/memory/1900-5-0x0000000010000000-0x000000001001C000-memory.dmp	family_gh0strat
behavioral2/memory/1900-6-0x0000000010000000-0x000000001001C000-memory.dmp	family_gh0strat
behavioral2/memory/1900-33-0x0000000010000000-0x000000001001C000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Blocklisted process makes network request 1 IoCs

flow	pid	Process
27	1900	rundll32.exe

Registers new Print Monitor 2 TTPs 16 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Ports	Spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\IPP	Spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\SCSI Port Monitor	svchost.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Local Port	Spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Microsoft Shared Fax Monitor	Spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\USB Monitor	Spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port	Spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\WSPrint	Spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Appmon	Spoolsv.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\SCSI Port Monitor\Driver = "scsimon.dll"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\SCSI Port Monitor\Driver = "scsimon.dll"	svchost.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Appmon\Ports	Spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Standard TCP/IP Port	Spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\WSPrint\OfflinePorts	Spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\SCSI Port Monitor	rundll32.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Standard TCP/IP Port\Ports	Spoolsv.exe

Sets service image path in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Spooler\ImagePath = "Spoolsv.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Spooler\ImagePath = "Spoolsv.exe"	rundll32.exe

ACProtect 1.3x - 1.4x DLL software 11 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/memory/1900-5-0x0000000010000000-0x000000001001C000-memory.dmp	acprotect
behavioral2/memory/1900-6-0x0000000010000000-0x000000001001C000-memory.dmp	acprotect
behavioral2/memory/1900-7-0x00000000030B0000-0x00000000030CD000-memory.dmp	acprotect
behavioral2/memory/1900-12-0x00000000030B0000-0x00000000030CD000-memory.dmp	acprotect
behavioral2/memory/1900-11-0x00000000030B0000-0x00000000030CD000-memory.dmp	acprotect
behavioral2/memory/1900-15-0x00000000030B0000-0x00000000030CD000-memory.dmp	acprotect
behavioral2/memory/3476-26-0x0000000000BD0000-0x0000000000BED000-memory.dmp	acprotect
behavioral2/memory/3476-27-0x0000000000BD0000-0x0000000000BED000-memory.dmp	acprotect
behavioral2/memory/3476-28-0x0000000000BD0000-0x0000000000BED000-memory.dmp	acprotect
behavioral2/memory/3476-24-0x0000000000BD0000-0x0000000000BED000-memory.dmp	acprotect
behavioral2/memory/1900-33-0x0000000010000000-0x000000001001C000-memory.dmp	acprotect

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\com\comb.dll	svchost.exe
File opened for modification	C:\Windows\SysWOW64\Miscson.dll	svchost.exe
File created	C:\Windows\SysWOW64\Miscson.dll	svchost.exe
File opened for modification	C:\Windows\SysWOW64\scsimon.dll	svchost.exe
File created	C:\Windows\SysWOW64\scsimon.dll	svchost.exe
File opened for modification	C:\Windows\SysWOW64\com\comb.dll	rundll32.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1900 set thread context of 3476	1900	rundll32.exe	88

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\AppPatch\AcSvcst.dll	rundll32.exe
File opened for modification	C:\Windows\AppPatch\ComBack.Dll	rundll32.exe
File created	C:\Windows\AppPatch\ComBack.Dll	rundll32.exe
File opened for modification	C:\Windows\AppPatch\AcSvcst.dll	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4008	1900	WerFault.exe	84

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	Spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	Spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	Spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	Spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	Spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002	Spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002	Spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002	Spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	Spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	Spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	Spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002	Spoolsv.exe

Modifies data under HKEY_USERS 22 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Fax = "winspool,Ne02:,15,45"	Spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts	Spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Send To OneNote 2016 = "winspool,nul:"	Spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft XPS Document Writer = "winspool,Ne00:,15,45"	Spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft Print to PDF = "winspool,Ne01:,15,45"	Spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Fax = "winspool,Ne02:,15,45"	Spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Send To OneNote 2016 = "winspool,nul:,15,45"	Spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Fax = "winspool,Ne02:"	Spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\Devices	Spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Send To OneNote 2016 = "winspool,nul:,15,45"	Spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Microsoft Print to PDF = "winspool,Ne01:"	Spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft XPS Document Writer = "winspool,Ne00:,15,45"	Spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Devices	Spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts	Spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts	Spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Microsoft XPS Document Writer = "winspool,Ne00:"	Spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Fax = "winspool,Ne02:"	Spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Devices	Spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Send To OneNote 2016 = "winspool,nul:"	Spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Microsoft XPS Document Writer = "winspool,Ne00:"	Spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Microsoft Print to PDF = "winspool,Ne01:"	Spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft Print to PDF = "winspool,Ne01:,15,45"	Spoolsv.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1900	rundll32.exe
Token: SeDebugPrivilege	3476	svchost.exe
Token: SeDebugPrivilege	1900	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3188 wrote to memory of 1900	3188	rundll32.exe	84
PID 3188 wrote to memory of 1900	3188	rundll32.exe	84
PID 3188 wrote to memory of 1900	3188	rundll32.exe	84
PID 1900 wrote to memory of 3476	1900	rundll32.exe	88
PID 1900 wrote to memory of 3476	1900	rundll32.exe	88
PID 1900 wrote to memory of 3476	1900	rundll32.exe	88
PID 1900 wrote to memory of 3476	1900	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\829cf4d4d062b1fda42b43b4c00eab30_dll32_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3188
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\829cf4d4d062b1fda42b43b4c00eab30_dll32_JC.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Registers new Print Monitor
  - Sets service image path in registry
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1900
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe -k rundll32
    3⤵
    - Registers new Print Monitor
    - Sets service image path in registry
    - Drops file in System32 directory
    - Suspicious use of AdjustPrivilegeToken
    PID:3476
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 624
    3⤵
    - Program crash
    PID:4008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1900 -ip 1900
1⤵
PID:2420

C:\Windows\system32\Spoolsv.exe
Spoolsv.exe
1⤵
- Registers new Print Monitor
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\AppPatch\ComBack.Dll

Filesize
137KB

MD5
f91ca8802f9e62f67dd4c7220a371fc5

SHA1
1ef55e8d8e6208e103ab81067e5f3da73563a4be

SHA256
560bfc45cd97f2881e8def5ceefd34cdaaf1e50a5869968370abbe52cc690c6a

SHA512
b490076e88731022a5cb7081503dc68e9864259dd3aad68fd559d6405a2c62728e386c7d51308d73a077c098a6e725cb8debd2a660b86c3559eedb7226c4c447

Download Submit
C:\Windows\SysWOW64\com\comb.dll

Filesize
128B

MD5
e894f6b37b9f8c49fe47ef8b59ef7b70

SHA1
e1b7945c0b4bfeec84e19eba07fb865b3083b3c7

SHA256
33506206a593cafd9e8547fee0b098df654034223c395f1ab446227d99dc27fb

SHA512
48743f485253ae4e3c4618ddd657770b1c9a45f6c24a5e4abe77989b62caaa08443700646fa05094dd164a99f555c4cf70973df8d503fd980d91a85ce3df2d10

Download Submit
C:\Windows\SysWOW64\com\comb.dll

Filesize
247B

MD5
0bbc8df4e2fec1ea844759a221695128

SHA1
fd40aceab2fd9500f97878499bedadf278f6194b

SHA256
3f0f04014c854740d397a6fa4d691f37c840e727be29b7160345ade808bbfab7

SHA512
c4a61c989298ee38a14dbf9a0245065942c1fa47427e7b972e052041ab4cac7a34b8f84c067d0471c364bc0c9f445670b63cfcf9a945bb5221dd8616e2caabd2

Download Submit
C:\Windows\SysWOW64\com\comb.dll

Filesize
326B

MD5
bd34b6a9c8c18fcdf20943cf44eb258a

SHA1
1ec83775c94f57b6f656739ae3dfa5276d07d929

SHA256
6067631cb668c6146d2959c97e702879382dad8ea50e30fe94b62038ac5b7f2a

SHA512
5302fc24fcdb6a26e75543c288d078bb634bb836a59ac4bb810625a77bd3a55e95ea2b3a85e143ba46619be476114a119a2a9214d4bf5982cfb0ba0aacf7d61d

Download Submit
memory/1900-6-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/1900-7-0x00000000030B0000-0x00000000030CD000-memory.dmp

Filesize
116KB

Download
memory/1900-12-0x00000000030B0000-0x00000000030CD000-memory.dmp

Filesize
116KB

Download
memory/1900-11-0x00000000030B0000-0x00000000030CD000-memory.dmp

Filesize
116KB

Download
memory/1900-5-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/1900-15-0x00000000030B0000-0x00000000030CD000-memory.dmp

Filesize
116KB

Download
memory/1900-35-0x0000000043E50000-0x0000000043E77000-memory.dmp

Filesize
156KB

Download
memory/1900-33-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/3476-14-0x00000000008C0000-0x00000000008E3000-memory.dmp

Filesize
140KB

Download
memory/3476-28-0x0000000000BD0000-0x0000000000BED000-memory.dmp

Filesize
116KB

Download
memory/3476-24-0x0000000000BD0000-0x0000000000BED000-memory.dmp

Filesize
116KB

Download
memory/3476-27-0x0000000000BD0000-0x0000000000BED000-memory.dmp

Filesize
116KB

Download
memory/3476-26-0x0000000000BD0000-0x0000000000BED000-memory.dmp

Filesize
116KB

Download
memory/3476-34-0x0000000000A80000-0x0000000000AA7000-memory.dmp

Filesize
156KB

Download
memory/3476-21-0x0000000000A80000-0x0000000000AA7000-memory.dmp

Filesize
156KB

Download
memory/3476-13-0x0000000000A80000-0x0000000000AA7000-memory.dmp

Filesize
156KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads