gh0strat | bd287e1c525b965941aa21441690017d7a39d53f6931cb01bef4fdbe3fa1df36

Analysis

max time kernel
145s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 03:33

Target

50a99bf8df5923ae5bbf70652a7bca5d.exe
Size

10.2MB
MD5

50a99bf8df5923ae5bbf70652a7bca5d
SHA1

28de7d338e1e44de8f5341289025d3dfaf19319f
SHA256

bd287e1c525b965941aa21441690017d7a39d53f6931cb01bef4fdbe3fa1df36
SHA512

0757ff7d491d4fb8ca8403ae318ef880b22e9f9f7e51c289a24ae5dd5517494514ad1993ad0f860a1531ebf72d99f1efc81b499070f3a27fc12a892cb90dcb91
SSDEEP

3072:EIXD6t2GloVFwz8BD0cjRTyVwdUE3AZnC69NJ09sTpwl:E3lQwz8BDpWwOUA1C6rTul

Score

10^/10

gh0strat rat

Gh0st RAT payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000a00000001223b-2.dat	family_gh0strat
behavioral1/files/0x000a00000001223b-3.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	2380	RUNDLL32.exe
7	2380	RUNDLL32.exe

Deletes itself 1 IoCs

pid	Process
3028	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
2380	RUNDLL32.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	\??\c:\Program Files\WINDOWSS.INI	50a99bf8df5923ae5bbf70652a7bca5d.exe
File created	C:\Program Files\temp0\QQ.exe	50a99bf8df5923ae5bbf70652a7bca5d.exe
File opened for modification	C:\Program Files\temp0\QQ.exe	50a99bf8df5923ae5bbf70652a7bca5d.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
3056	taskkill.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3056	taskkill.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 3056	2500	50a99bf8df5923ae5bbf70652a7bca5d.exe	20
PID 2500 wrote to memory of 3056	2500	50a99bf8df5923ae5bbf70652a7bca5d.exe	20
PID 2500 wrote to memory of 3056	2500	50a99bf8df5923ae5bbf70652a7bca5d.exe	20
PID 2500 wrote to memory of 3056	2500	50a99bf8df5923ae5bbf70652a7bca5d.exe	20
PID 2500 wrote to memory of 2380	2500	50a99bf8df5923ae5bbf70652a7bca5d.exe	24
PID 2500 wrote to memory of 2380	2500	50a99bf8df5923ae5bbf70652a7bca5d.exe	24
PID 2500 wrote to memory of 2380	2500	50a99bf8df5923ae5bbf70652a7bca5d.exe	24
PID 2500 wrote to memory of 2380	2500	50a99bf8df5923ae5bbf70652a7bca5d.exe	24
PID 2500 wrote to memory of 2380	2500	50a99bf8df5923ae5bbf70652a7bca5d.exe	24
PID 2500 wrote to memory of 2380	2500	50a99bf8df5923ae5bbf70652a7bca5d.exe	24
PID 2500 wrote to memory of 2380	2500	50a99bf8df5923ae5bbf70652a7bca5d.exe	24
PID 2500 wrote to memory of 3028	2500	50a99bf8df5923ae5bbf70652a7bca5d.exe	35
PID 2500 wrote to memory of 3028	2500	50a99bf8df5923ae5bbf70652a7bca5d.exe	35
PID 2500 wrote to memory of 3028	2500	50a99bf8df5923ae5bbf70652a7bca5d.exe	35
PID 2500 wrote to memory of 3028	2500	50a99bf8df5923ae5bbf70652a7bca5d.exe	35

C:\Users\Admin\AppData\Local\Temp\50a99bf8df5923ae5bbf70652a7bca5d.exe
"C:\Users\Admin\AppData\Local\Temp\50a99bf8df5923ae5bbf70652a7bca5d.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\SysWOW64\RUNDLL32.exe
  RUNDLL32 "c:\Program Files\WINDOWSS.INI" main
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:2380
- C:\Windows\SysWOW64\cmd.exe
  cmd /c afc9fe2f418b00a0.bat
  2⤵
  - Deletes itself
  PID:3028

\??\c:\Program Files\WINDOWSS.INI

Filesize
96KB

MD5
c9e2396bfd616592bf7d8b6025577851

SHA1
54d53def338abbed6081afdf0c097e9736e2bbf9

SHA256
77797701732e5b828d3b4894cb9c782383b8a254d92ff908bc36651786080a2d

SHA512
9a724028e0968b279f52ec4c18be0c0da9f23526dc12caaa5a073fad8a6091cce93522c83644a00ebe6c0be3702c6f19e3a82f78ce29656a54c1037bf6f1bb3d

Download Submit
\Program Files\WINDOWSS.INI

Filesize
381KB

MD5
e2320e9a82b6c669f404eabd2af58ccd

SHA1
1c547734a57947372e84668527d153121462de48

SHA256
cd0bd6fbc2de7157d904c813628d257f9295a93b332958ae554d4edf6efd9e32

SHA512
90c64f24ef2db16d2ad5500c7a0c802bb77ee0685cb84b6728eec02e5341863ad654b4d2842f8f54662bb88234a335081baa82b40b5ba44b17d935134de5800f

Download Submit