gh0strat | 554781b32d447c7bba31cfa4933565579e41c967c0ec10a223753e8301a016c3

Analysis

max time kernel
152s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05-01-2024 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4489f2b48781f4b9de9b1a5d3169ce80.exe
Size

53KB
MD5

4489f2b48781f4b9de9b1a5d3169ce80
SHA1

5eb15e2c66c07177bb1dd41d40c541fa1229700a
SHA256

554781b32d447c7bba31cfa4933565579e41c967c0ec10a223753e8301a016c3
SHA512

05d8183e73c62fb2ec080b4c5afab742132269d8ec48d3a92505800b88ff3211a8ed9f5ee8e4769c9d176a2eb7632245b1d7b383cb54ddd8c93902b2d118a964
SSDEEP

1536:N2vkocMOG+a9E9hR0GQ9s2nOBZweLLR6/nB:NLgOja9A8J9s2nCZwo96/nB

Score

10^/10

gh0strat persistence rat

Malware Config

Signatures

Gh0st RAT payload 3 IoCs

resource	yara_rule
behavioral1/memory/1916-6-0x0000000000400000-0x000000000042F000-memory.dmp	family_gh0strat
behavioral1/files/0x0007000000012281-5.dat	family_gh0strat
behavioral1/files/0x0007000000012281-7.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibilitymon.dll"	4489f2b48781f4b9de9b1a5d3169ce80.exe

Deletes itself 1 IoCs

pid	Process
2712	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
2712	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\FastUserSwitchingCompatibilitymon.dll	4489f2b48781f4b9de9b1a5d3169ce80.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2712	svchost.exe

C:\Users\Admin\AppData\Local\Temp\4489f2b48781f4b9de9b1a5d3169ce80.exe
"C:\Users\Admin\AppData\Local\Temp\4489f2b48781f4b9de9b1a5d3169ce80.exe"
1⤵
- Sets DLL path for service in the registry
- Drops file in System32 directory
PID:1916

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Deletes itself
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\fastuserswitchingcompatibilitymon.dll

Filesize
103KB

MD5
a7d58eb368f73092ed4a5eab5bf47119

SHA1
073d0d9cea8632320ade24635362c76dcf98774f

SHA256
d0ecfd0488e59811c15e29d9be6c3fd8fa1d93fdff03fe114dfafe360f42247c

SHA512
e61964e50715db5a035266947b4f07014de13bca36a9f47ba542aae2b665f64c93963ecfce914513c65f5992e59cb02e567dd5182b34f4d12e605c9b8317c530

Download Submit
\Windows\SysWOW64\FastUserSwitchingCompatibilitymon.dll

Filesize
93KB

MD5
fd8ab88534c309531985f48373ad403b

SHA1
04197b6fa891f58012dd022f9897fe32ac3dd7ba

SHA256
bd79a723adaf1ac98c839dff904b8206cd8e82126b4d2d30535e4e5aac5415a0

SHA512
b8c833b8ab02d252a4d09e00903a049d736dedee5b1e16174c06baeeca9a52573cce7d807f44d0c3fad4a384c9400ffb014901937b9759f153f7b35a49e3ec49

Download Submit
memory/1916-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1916-1-0x0000000000220000-0x0000000000260000-memory.dmp

Filesize
256KB

Download
memory/1916-6-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download