gh0strat | a734a09cb77fcebf23e2817c703cb701b99a4aacef04e40f6adbaf82846651f1

Analysis

max time kernel
130s
max time network
144s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
22-11-2023 12:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a734a09cb77fcebf23e2817c703cb701b99a4aacef04e40f6adbaf82846651f1.exe
Size

376KB
MD5

674baf399497aa2f28c5f710b8aa48e3
SHA1

f9f1197d09cb35d08370c07abd9b41b52cfc3018
SHA256

a734a09cb77fcebf23e2817c703cb701b99a4aacef04e40f6adbaf82846651f1
SHA512

b7f0af05dae9e944da36bf3a4ce21c750aaa6bdaf2a989ca4e1d4f62ffa7a2fe105dff0804ab9c6b0a30559418dc6b692e15630bf7fbceb30877f12530b6a6a3
SSDEEP

3072:RvK/yLrQbWaR5Qax8c/YtDZiftPRAqE3PC8tSoUOKK:ROyLEbWaR5CceifXc3PXS/OKK

Score

10^/10

gh0strat rat

Malware Config

Extracted

Family

gh0strat

54.251.130.99

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/2268-0-0x0000000010000000-0x0000000010015000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Executes dropped EXE 2 IoCs

pid	Process
2440	Tjprhln.exe
2844	Tjprhln.exe

Loads dropped DLL 1 IoCs

pid	Process
2440	Tjprhln.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Tjprhln.exe	a734a09cb77fcebf23e2817c703cb701b99a4aacef04e40f6adbaf82846651f1.exe
File opened for modification	C:\Program Files (x86)\Tjprhln.exe	a734a09cb77fcebf23e2817c703cb701b99a4aacef04e40f6adbaf82846651f1.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2268	a734a09cb77fcebf23e2817c703cb701b99a4aacef04e40f6adbaf82846651f1.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2844	2440	Tjprhln.exe	29
PID 2440 wrote to memory of 2844	2440	Tjprhln.exe	29
PID 2440 wrote to memory of 2844	2440	Tjprhln.exe	29
PID 2440 wrote to memory of 2844	2440	Tjprhln.exe	29

C:\Users\Admin\AppData\Local\Temp\a734a09cb77fcebf23e2817c703cb701b99a4aacef04e40f6adbaf82846651f1.exe
"C:\Users\Admin\AppData\Local\Temp\a734a09cb77fcebf23e2817c703cb701b99a4aacef04e40f6adbaf82846651f1.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: RenamesItself
PID:2268

C:\Program Files (x86)\Tjprhln.exe
"C:\Program Files (x86)\Tjprhln.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Program Files (x86)\Tjprhln.exe
  "C:\Program Files (x86)\Tjprhln.exe" Win7
  2⤵
  - Executes dropped EXE
  PID:2844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Tjprhln.exe

Filesize
376KB

MD5
674baf399497aa2f28c5f710b8aa48e3

SHA1
f9f1197d09cb35d08370c07abd9b41b52cfc3018

SHA256
a734a09cb77fcebf23e2817c703cb701b99a4aacef04e40f6adbaf82846651f1

SHA512
b7f0af05dae9e944da36bf3a4ce21c750aaa6bdaf2a989ca4e1d4f62ffa7a2fe105dff0804ab9c6b0a30559418dc6b692e15630bf7fbceb30877f12530b6a6a3

Download Submit
C:\Program Files (x86)\Tjprhln.exe

Filesize
376KB

MD5
674baf399497aa2f28c5f710b8aa48e3

SHA1
f9f1197d09cb35d08370c07abd9b41b52cfc3018

SHA256
a734a09cb77fcebf23e2817c703cb701b99a4aacef04e40f6adbaf82846651f1

SHA512
b7f0af05dae9e944da36bf3a4ce21c750aaa6bdaf2a989ca4e1d4f62ffa7a2fe105dff0804ab9c6b0a30559418dc6b692e15630bf7fbceb30877f12530b6a6a3

Download Submit
C:\Program Files (x86)\Tjprhln.exe

Filesize
376KB

MD5
674baf399497aa2f28c5f710b8aa48e3

SHA1
f9f1197d09cb35d08370c07abd9b41b52cfc3018

SHA256
a734a09cb77fcebf23e2817c703cb701b99a4aacef04e40f6adbaf82846651f1

SHA512
b7f0af05dae9e944da36bf3a4ce21c750aaa6bdaf2a989ca4e1d4f62ffa7a2fe105dff0804ab9c6b0a30559418dc6b692e15630bf7fbceb30877f12530b6a6a3

Download Submit
\Program Files (x86)\Tjprhln.exe

Filesize
376KB

MD5
674baf399497aa2f28c5f710b8aa48e3

SHA1
f9f1197d09cb35d08370c07abd9b41b52cfc3018

SHA256
a734a09cb77fcebf23e2817c703cb701b99a4aacef04e40f6adbaf82846651f1

SHA512
b7f0af05dae9e944da36bf3a4ce21c750aaa6bdaf2a989ca4e1d4f62ffa7a2fe105dff0804ab9c6b0a30559418dc6b692e15630bf7fbceb30877f12530b6a6a3

Download Submit
memory/2268-0-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download