gh0strat | 428953d326aea4be1445afe7684143b7f9d014f54e281d5b005e144406e2871f

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
24/10/2023, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

428953d326aea4be1445afe7684143b7f9d014f54e281d5b005e144406e2871f.exe
Size

2.8MB
MD5

85d4bdf57db35a9c5c4a4390160df479
SHA1

b4b768402ebd814e21c1590afc6029ac73f8954e
SHA256

428953d326aea4be1445afe7684143b7f9d014f54e281d5b005e144406e2871f
SHA512

68d7819aa28f921821ee0d632b2975b9875eb82d48e39cf782a452551e3ee00d6cb6b1e4bde297e429516d768f5c32cbff06d85fc403bd0eae63888aba27a40d
SSDEEP

49152:gWONjfsJlQ4tMnGSorq1b4pJNEtlu0qBTSqZSr2gIak0bMred3f/Gg/G:kNjfs84tMnGPqWpJNEtlu0qBWzr2gIud

Score

10^/10

gh0strat rat

Malware Config

Signatures

Gh0st RAT payload 2 IoCs

resource	yara_rule
behavioral1/memory/2576-42-0x00000000027E0000-0x000000000285B000-memory.dmp	family_gh0strat
behavioral1/memory/2576-55-0x0000000002250000-0x00000000022E6000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Executes dropped EXE 1 IoCs

pid	Process
2576	ypager.exe

Loads dropped DLL 6 IoCs

pid	Process
2404	428953d326aea4be1445afe7684143b7f9d014f54e281d5b005e144406e2871f.exe
2576	ypager.exe
2576	ypager.exe
2576	ypager.exe
2576	ypager.exe
2576	ypager.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	ypager.exe
File opened (read-only)	\??\P:	ypager.exe
File opened (read-only)	\??\U:	ypager.exe
File opened (read-only)	\??\V:	ypager.exe
File opened (read-only)	\??\L:	ypager.exe
File opened (read-only)	\??\Y:	ypager.exe
File opened (read-only)	\??\W:	ypager.exe
File opened (read-only)	\??\G:	ypager.exe
File opened (read-only)	\??\H:	ypager.exe
File opened (read-only)	\??\K:	ypager.exe
File opened (read-only)	\??\N:	ypager.exe
File opened (read-only)	\??\O:	ypager.exe
File opened (read-only)	\??\S:	ypager.exe
File opened (read-only)	\??\T:	ypager.exe
File opened (read-only)	\??\X:	ypager.exe
File opened (read-only)	\??\E:	ypager.exe
File opened (read-only)	\??\I:	ypager.exe
File opened (read-only)	\??\J:	ypager.exe
File opened (read-only)	\??\M:	ypager.exe
File opened (read-only)	\??\Q:	ypager.exe
File opened (read-only)	\??\R:	ypager.exe
File opened (read-only)	\??\Z:	ypager.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ypager.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ypager.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
2576	ypager.exe
2576	ypager.exe
2576	ypager.exe
2576	ypager.exe
2576	ypager.exe
2576	ypager.exe
2576	ypager.exe
2576	ypager.exe
2576	ypager.exe
2576	ypager.exe
2576	ypager.exe
2576	ypager.exe
2576	ypager.exe
2576	ypager.exe
2576	ypager.exe
2576	ypager.exe
2576	ypager.exe
2576	ypager.exe
2576	ypager.exe
2576	ypager.exe
2576	ypager.exe
2576	ypager.exe
2576	ypager.exe
2576	ypager.exe
2576	ypager.exe
2576	ypager.exe
2576	ypager.exe
2576	ypager.exe
2576	ypager.exe
2576	ypager.exe
2576	ypager.exe
2576	ypager.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2576	ypager.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2576	ypager.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2404	428953d326aea4be1445afe7684143b7f9d014f54e281d5b005e144406e2871f.exe
2576	ypager.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 2576	2404	428953d326aea4be1445afe7684143b7f9d014f54e281d5b005e144406e2871f.exe	28
PID 2404 wrote to memory of 2576	2404	428953d326aea4be1445afe7684143b7f9d014f54e281d5b005e144406e2871f.exe	28
PID 2404 wrote to memory of 2576	2404	428953d326aea4be1445afe7684143b7f9d014f54e281d5b005e144406e2871f.exe	28
PID 2404 wrote to memory of 2576	2404	428953d326aea4be1445afe7684143b7f9d014f54e281d5b005e144406e2871f.exe	28

C:\Users\Admin\AppData\Local\Temp\428953d326aea4be1445afe7684143b7f9d014f54e281d5b005e144406e2871f.exe
"C:\Users\Admin\AppData\Local\Temp\428953d326aea4be1445afe7684143b7f9d014f54e281d5b005e144406e2871f.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Users\Public\WinZip\ypager.exe
  "C:\Users\Public\WinZip\ypager.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\WinZip\MSVCP100.dll

Filesize
411KB

MD5
e3c817f7fe44cc870ecdbcbc3ea36132

SHA1
2ada702a0c143a7ae39b7de16a4b5cc994d2548b

SHA256
d769fafa2b3232de9fa7153212ba287f68e745257f1c00fafb511e7a02de7adf

SHA512
4fcf3fcdd27c97a714e173aa221f53df6c152636d77dea49e256a9788f2d3f2c2d7315dd0b4d72ecefc553082f9149b8580779abb39891a88907f16ec9e13cbe

Download Submit
C:\Users\Public\WinZip\MSVCR100.dll

Filesize
755KB

MD5
bf38660a9125935658cfa3e53fdc7d65

SHA1
0b51fb415ec89848f339f8989d323bea722bfd70

SHA256
60c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa

SHA512
25f521ffe25a950d0f1a4de63b04cb62e2a3b0e72e7405799586913208bf8f8fa52aa34e96a9cc6ee47afcd41870f3aa0cd8289c53461d1b6e792d19b750c9a1

Download Submit
C:\Users\Public\WinZip\donottrace.txt

Filesize
576KB

MD5
996972c41df8c8b31918fd8a3f0ebd36

SHA1
dc14b37cd985d9991cd4ebd2219dc472a932d9ae

SHA256
78434681a3b49431867dd233b83fdfbe227055e3521a8e53cee6d14050bfa7a7

SHA512
84a8520ae556c28bade671efc38f922f778ab2855bfc642c598fe81fe88fb93f30c1daac02627d5585e34e5984c9129656ab1868709b044b552cb4a62c4db9a6

Download Submit
C:\Users\Public\WinZip\mfc100u.dll

Filesize
4.2MB

MD5
f32077df74efd435a1dcdf415e189df1

SHA1
2771393d56ff167275bf03170377c43c28ee14e1

SHA256
24bb6838defd491df5460a88bed2d70b903a2156c49fb63e214e2c77251eca71

SHA512
fb708e0949854998fb80635138c80ac05d77dca3089d3e5974663ddf2376d6a03535dae1a068514c3b58bc06c8e4078b37cfb6bc90f080f7f31fefc972a34850

Download Submit
C:\Users\Public\WinZip\mirage_cm.dll

Filesize
305KB

MD5
5d6c90d2cb177500f7b46f8c7caf6531

SHA1
4fc46eb0cf80073855580ec34b319fe361020379

SHA256
e512dc10ff8d33efe688c3214be608a40ecf4f1f7b4f9659ff6efc9a6827ee40

SHA512
eb35f337e0a6387d4bc47b6d9be241e4ea2c28936e3b4edc58448fc205b55c8171ec40399293b24e949fbb2a656918056e498b6dbedd6757c7bf2151862aa0d0

Download Submit
C:\Users\Public\WinZip\task.dat

Filesize
78B

MD5
caf31f6a4a64b9915efa333caf02b121

SHA1
31a7cbd957c027ffa4d8ff5071daeb14b58c2681

SHA256
f964494e1a1d58c0b5a790604d07e8e096069bc5a7de2066b95fa969c4fbf7f8

SHA512
319ad026c6611bd5d99bccbf963548c9ee60142402dfe856424ef312a168a5017cc72ccff79cc98703abc176578852abd4fe8aa6753c50f84c9b08266aa6c44c

Download Submit
C:\Users\Public\WinZip\wrapcef.dll

Filesize
108KB

MD5
78a0324050af5733d33195d8f1992266

SHA1
58aab3cf01eb83729fb274c2b4b27e193371992f

SHA256
c493acd992ed5cff56139bb7a852ed3227bf60446318b93f02ec5cadb40f7cdc

SHA512
a5aa0bcb10a23e016252b2317f21b9a859f1750ab4a9c98879c33e6764e9558fd0239109bef5eb1ddb7751a2cedc2be288c3b53b657710ccbf8ace08fb5770ab

Download Submit
C:\Users\Public\WinZip\ypager.dat

Filesize
61B

MD5
024aca72ad6c6390f9ca087b91720df1

SHA1
c1908e24c1dc46be360402c3b6b1fc6fecb190b7

SHA256
6f5c9db54d6a40a355ec100d387924e3578ebbcdd4c539223a0363124f9b4804

SHA512
a3cffa95c5235ae61be42e34c8ae4dbf6ee94c1e7f1639bf707d62d3b334be8e5078e6ee8f0e9228ec60205079792fe38a85add8b0aebc995823511947bc78a0

Download Submit
C:\Users\Public\WinZip\ypager.exe

Filesize
2.0MB

MD5
2ff236ca982bc4fdd29586ab77c49fdd

SHA1
187b43ea891e01b6530d249b988c713d826c04e7

SHA256
9064ab3843cb154f46a2e4d9a5d0f2df9bedd1a684efaba8a6e94cb77070edf3

SHA512
c43f693d095fe02a53368fb9d3ea207f1082201afebd00076eb08bad082e71cf2ec66bc1bb45405278c91afdf8b6087b366540843c88cfcf80184c2e15b1504d

Download Submit
C:\Users\Public\WinZip\ypager.exe

Filesize
2.0MB

MD5
2ff236ca982bc4fdd29586ab77c49fdd

SHA1
187b43ea891e01b6530d249b988c713d826c04e7

SHA256
9064ab3843cb154f46a2e4d9a5d0f2df9bedd1a684efaba8a6e94cb77070edf3

SHA512
c43f693d095fe02a53368fb9d3ea207f1082201afebd00076eb08bad082e71cf2ec66bc1bb45405278c91afdf8b6087b366540843c88cfcf80184c2e15b1504d

Download Submit
\Users\Public\WinZip\mfc100u.dll

Filesize
4.2MB

MD5
f32077df74efd435a1dcdf415e189df1

SHA1
2771393d56ff167275bf03170377c43c28ee14e1

SHA256
24bb6838defd491df5460a88bed2d70b903a2156c49fb63e214e2c77251eca71

SHA512
fb708e0949854998fb80635138c80ac05d77dca3089d3e5974663ddf2376d6a03535dae1a068514c3b58bc06c8e4078b37cfb6bc90f080f7f31fefc972a34850

Download Submit
\Users\Public\WinZip\mirage_cm.dll

Filesize
305KB

MD5
5d6c90d2cb177500f7b46f8c7caf6531

SHA1
4fc46eb0cf80073855580ec34b319fe361020379

SHA256
e512dc10ff8d33efe688c3214be608a40ecf4f1f7b4f9659ff6efc9a6827ee40

SHA512
eb35f337e0a6387d4bc47b6d9be241e4ea2c28936e3b4edc58448fc205b55c8171ec40399293b24e949fbb2a656918056e498b6dbedd6757c7bf2151862aa0d0

Download Submit
\Users\Public\WinZip\msvcp100.dll

Filesize
411KB

MD5
e3c817f7fe44cc870ecdbcbc3ea36132

SHA1
2ada702a0c143a7ae39b7de16a4b5cc994d2548b

SHA256
d769fafa2b3232de9fa7153212ba287f68e745257f1c00fafb511e7a02de7adf

SHA512
4fcf3fcdd27c97a714e173aa221f53df6c152636d77dea49e256a9788f2d3f2c2d7315dd0b4d72ecefc553082f9149b8580779abb39891a88907f16ec9e13cbe

Download Submit
\Users\Public\WinZip\msvcr100.dll

Filesize
755KB

MD5
bf38660a9125935658cfa3e53fdc7d65

SHA1
0b51fb415ec89848f339f8989d323bea722bfd70

SHA256
60c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa

SHA512
25f521ffe25a950d0f1a4de63b04cb62e2a3b0e72e7405799586913208bf8f8fa52aa34e96a9cc6ee47afcd41870f3aa0cd8289c53461d1b6e792d19b750c9a1

Download Submit
\Users\Public\WinZip\wrapcef.dll

Filesize
108KB

MD5
78a0324050af5733d33195d8f1992266

SHA1
58aab3cf01eb83729fb274c2b4b27e193371992f

SHA256
c493acd992ed5cff56139bb7a852ed3227bf60446318b93f02ec5cadb40f7cdc

SHA512
a5aa0bcb10a23e016252b2317f21b9a859f1750ab4a9c98879c33e6764e9558fd0239109bef5eb1ddb7751a2cedc2be288c3b53b657710ccbf8ace08fb5770ab

Download Submit
\Users\Public\WinZip\ypager.exe

Filesize
2.0MB

MD5
2ff236ca982bc4fdd29586ab77c49fdd

SHA1
187b43ea891e01b6530d249b988c713d826c04e7

SHA256
9064ab3843cb154f46a2e4d9a5d0f2df9bedd1a684efaba8a6e94cb77070edf3

SHA512
c43f693d095fe02a53368fb9d3ea207f1082201afebd00076eb08bad082e71cf2ec66bc1bb45405278c91afdf8b6087b366540843c88cfcf80184c2e15b1504d

Download Submit
memory/2576-39-0x0000000002250000-0x00000000022E6000-memory.dmp

Filesize
600KB

Download
memory/2576-40-0x0000000002250000-0x00000000022E6000-memory.dmp

Filesize
600KB

Download
memory/2576-42-0x00000000027E0000-0x000000000285B000-memory.dmp

Filesize
492KB

Download
memory/2576-55-0x0000000002250000-0x00000000022E6000-memory.dmp

Filesize
600KB

Download