gh0strat | e22b01b3e9fbf507b295b4eaf636cf2dac724e2463567d695e31032ff0898ed1

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 15:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

04633c60e3edc0fec19defb750e2cfd0.exe
Size

920KB
MD5

04633c60e3edc0fec19defb750e2cfd0
SHA1

050f30070bec6d1287b698b2727770d8a94d0b8e
SHA256

e22b01b3e9fbf507b295b4eaf636cf2dac724e2463567d695e31032ff0898ed1
SHA512

194251d8490e876f3919bbcc0d89edd3b1b6da655b1552e9cdb2e4fcae613d3a4e60f9f788a83f15e8a874c14cc0554b3087f695677c115df7ce027568a1c7f0
SSDEEP

12288:iM5jZKbBL3aKHx5r+TuxX+fWbwFBfdGmZ1vqT:iM5j8Z3aKHx5r+TuxX+IwffFZ1vqT

Score

10^/10

gh0strat persistence rat

Malware Config

Signatures

Gh0st RAT payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000b000000015c67-5.dat	family_gh0strat
behavioral1/files/0x000b000000015c67-4.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Executes dropped EXE 1 IoCs

pid	Process
3036	svchest001465662051.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kris = "c:\\Windows\\notepab.exe"	04633c60e3edc0fec19defb750e2cfd0.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	\??\c:\Windows\svchest001465662051.exe	04633c60e3edc0fec19defb750e2cfd0.exe
File opened for modification	\??\c:\Windows\svchest001465662051.exe	04633c60e3edc0fec19defb750e2cfd0.exe
File created	\??\c:\Windows\notepab.exe	04633c60e3edc0fec19defb750e2cfd0.exe
File opened for modification	\??\c:\Windows\BJ.exe	04633c60e3edc0fec19defb750e2cfd0.exe
File created	\??\c:\Windows\BJ.exe	04633c60e3edc0fec19defb750e2cfd0.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 3036	2924	04633c60e3edc0fec19defb750e2cfd0.exe	17
PID 2924 wrote to memory of 3036	2924	04633c60e3edc0fec19defb750e2cfd0.exe	17
PID 2924 wrote to memory of 3036	2924	04633c60e3edc0fec19defb750e2cfd0.exe	17
PID 2924 wrote to memory of 3036	2924	04633c60e3edc0fec19defb750e2cfd0.exe	17

C:\Users\Admin\AppData\Local\Temp\04633c60e3edc0fec19defb750e2cfd0.exe
"C:\Users\Admin\AppData\Local\Temp\04633c60e3edc0fec19defb750e2cfd0.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2924
- \??\c:\Windows\svchest001465662051.exe
  c:\Windows\svchest001465662051.exe
  2⤵
  - Executes dropped EXE
  PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\svchest001465662051.exe

Filesize
14KB

MD5
9325fc78c595289e4dea9dc8b10794e4

SHA1
8ab33e6104a3220b0549f14e9d662e87ac8b2d7d

SHA256
0af519d1783dc089fc673e9c0e14a977de25b0737f9079bb49de6ea6f6ca2eb5

SHA512
c0de325c849a77ce8baa03fddd9ce44cfddb3ae540328aacf0aecead8ea9e0278284b45a244b2dbdb7f3a01cf834524ff10e57370fd23c11e193e95cda4ad249

Download Submit
C:\Windows\svchest001465662051.exe

Filesize
11KB

MD5
ddbb1e2f052cc4829333e3f1335af8a6

SHA1
68dee807480760e26e60910238ac1928bbf64e22

SHA256
d83cf0281271cb3c678e30e547a5621cf45005861ef452c6fe13649c6253feaa

SHA512
04036cfc20cb041842c5b2c9af0ace8453f168474a9e258b7ead9e37ea0edd53d5ce20d47284e67bd73c8abb36a1285e10acda19f2615896eb0345f30faf4b65

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads