gh0strat | 64174ba6ce7bc134f989a87a12cee143452b2530ea05b449bd76936b58500c79

General

Target

64174ba6ce7bc134f989a87a12cee143452b2530ea05b449bd76936b58500c79.exe
Size

496KB
MD5

3e821ec6513319de7cf6430a2f2ad072
SHA1

da2da5e6eafd983d7271a0898031d88205d1c03c
SHA256

64174ba6ce7bc134f989a87a12cee143452b2530ea05b449bd76936b58500c79
SHA512

d8025c62e5c40d8b925115cc24f08ea54572ffd29fb907a47a6981f0d8682bb7057b8ede436d2fd7d67067d3e878ddd903f70be6b11cefddbeff7ef706fe321e
SSDEEP

6144:QdyLEbWaR5CcwVPyZ5WfvD6Retk5ArfM:sUaWaR5vwNyZ5ckevrfM

Score

10^/10

gh0strat rat

Malware Config

Extracted

Family

gh0strat

C2

110.41.134.233

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/2232-0-0x0000000010000000-0x0000000010015000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Executes dropped EXE 2 IoCs

pid	Process
2540	Dumper.exe
2672	Dumper.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	64174ba6ce7bc134f989a87a12cee143452b2530ea05b449bd76936b58500c79.exe
File opened (read-only)	\??\G:	64174ba6ce7bc134f989a87a12cee143452b2530ea05b449bd76936b58500c79.exe
File opened (read-only)	\??\M:	64174ba6ce7bc134f989a87a12cee143452b2530ea05b449bd76936b58500c79.exe
File opened (read-only)	\??\Q:	64174ba6ce7bc134f989a87a12cee143452b2530ea05b449bd76936b58500c79.exe
File opened (read-only)	\??\T:	64174ba6ce7bc134f989a87a12cee143452b2530ea05b449bd76936b58500c79.exe
File opened (read-only)	\??\W:	64174ba6ce7bc134f989a87a12cee143452b2530ea05b449bd76936b58500c79.exe
File opened (read-only)	\??\X:	64174ba6ce7bc134f989a87a12cee143452b2530ea05b449bd76936b58500c79.exe
File opened (read-only)	\??\B:	64174ba6ce7bc134f989a87a12cee143452b2530ea05b449bd76936b58500c79.exe
File opened (read-only)	\??\H:	64174ba6ce7bc134f989a87a12cee143452b2530ea05b449bd76936b58500c79.exe
File opened (read-only)	\??\J:	64174ba6ce7bc134f989a87a12cee143452b2530ea05b449bd76936b58500c79.exe
File opened (read-only)	\??\K:	64174ba6ce7bc134f989a87a12cee143452b2530ea05b449bd76936b58500c79.exe
File opened (read-only)	\??\L:	64174ba6ce7bc134f989a87a12cee143452b2530ea05b449bd76936b58500c79.exe
File opened (read-only)	\??\N:	64174ba6ce7bc134f989a87a12cee143452b2530ea05b449bd76936b58500c79.exe
File opened (read-only)	\??\P:	64174ba6ce7bc134f989a87a12cee143452b2530ea05b449bd76936b58500c79.exe
File opened (read-only)	\??\S:	64174ba6ce7bc134f989a87a12cee143452b2530ea05b449bd76936b58500c79.exe
File opened (read-only)	\??\I:	64174ba6ce7bc134f989a87a12cee143452b2530ea05b449bd76936b58500c79.exe
File opened (read-only)	\??\Y:	64174ba6ce7bc134f989a87a12cee143452b2530ea05b449bd76936b58500c79.exe
File opened (read-only)	\??\O:	64174ba6ce7bc134f989a87a12cee143452b2530ea05b449bd76936b58500c79.exe
File opened (read-only)	\??\R:	64174ba6ce7bc134f989a87a12cee143452b2530ea05b449bd76936b58500c79.exe
File opened (read-only)	\??\U:	64174ba6ce7bc134f989a87a12cee143452b2530ea05b449bd76936b58500c79.exe
File opened (read-only)	\??\V:	64174ba6ce7bc134f989a87a12cee143452b2530ea05b449bd76936b58500c79.exe
File opened (read-only)	\??\Z:	64174ba6ce7bc134f989a87a12cee143452b2530ea05b449bd76936b58500c79.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Dumper.exe	64174ba6ce7bc134f989a87a12cee143452b2530ea05b449bd76936b58500c79.exe
File created	C:\Program Files (x86)\Dumper.exe	64174ba6ce7bc134f989a87a12cee143452b2530ea05b449bd76936b58500c79.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	64174ba6ce7bc134f989a87a12cee143452b2530ea05b449bd76936b58500c79.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	64174ba6ce7bc134f989a87a12cee143452b2530ea05b449bd76936b58500c79.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2232	64174ba6ce7bc134f989a87a12cee143452b2530ea05b449bd76936b58500c79.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 2672	2540	Dumper.exe	29
PID 2540 wrote to memory of 2672	2540	Dumper.exe	29
PID 2540 wrote to memory of 2672	2540	Dumper.exe	29
PID 2540 wrote to memory of 2672	2540	Dumper.exe	29

C:\Users\Admin\AppData\Local\Temp\64174ba6ce7bc134f989a87a12cee143452b2530ea05b449bd76936b58500c79.exe
"C:\Users\Admin\AppData\Local\Temp\64174ba6ce7bc134f989a87a12cee143452b2530ea05b449bd76936b58500c79.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2232

C:\Program Files (x86)\Dumper.exe
"C:\Program Files (x86)\Dumper.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Program Files (x86)\Dumper.exe
  "C:\Program Files (x86)\Dumper.exe" Win7
  2⤵
  - Executes dropped EXE
  PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Dumper.exe

Filesize
496KB

MD5
3e821ec6513319de7cf6430a2f2ad072

SHA1
da2da5e6eafd983d7271a0898031d88205d1c03c

SHA256
64174ba6ce7bc134f989a87a12cee143452b2530ea05b449bd76936b58500c79

SHA512
d8025c62e5c40d8b925115cc24f08ea54572ffd29fb907a47a6981f0d8682bb7057b8ede436d2fd7d67067d3e878ddd903f70be6b11cefddbeff7ef706fe321e

Download Submit
C:\Program Files (x86)\Dumper.exe

Filesize
496KB

MD5
3e821ec6513319de7cf6430a2f2ad072

SHA1
da2da5e6eafd983d7271a0898031d88205d1c03c

SHA256
64174ba6ce7bc134f989a87a12cee143452b2530ea05b449bd76936b58500c79

SHA512
d8025c62e5c40d8b925115cc24f08ea54572ffd29fb907a47a6981f0d8682bb7057b8ede436d2fd7d67067d3e878ddd903f70be6b11cefddbeff7ef706fe321e

Download Submit
C:\Program Files (x86)\Dumper.exe

Filesize
496KB

MD5
3e821ec6513319de7cf6430a2f2ad072

SHA1
da2da5e6eafd983d7271a0898031d88205d1c03c

SHA256
64174ba6ce7bc134f989a87a12cee143452b2530ea05b449bd76936b58500c79

SHA512
d8025c62e5c40d8b925115cc24f08ea54572ffd29fb907a47a6981f0d8682bb7057b8ede436d2fd7d67067d3e878ddd903f70be6b11cefddbeff7ef706fe321e

Download Submit
memory/2232-0-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads