gh0strat | ba18b133270ec5ac4f95db3657754e69a7c210e38d031d8839d6b6def5785a73

Analysis

max time kernel
2s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2024, 19:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4915e13ff1642028c458dd576c44142f.exe
Size 170KB
Sample240107-yaastacfdp
SHA256 ba18b133270ec5ac4f95db3657754e69a7c210e38d031d8839d6b6def5785a73
MD5 4915e13ff1642028c458dd576c44142f
SHA1 f731af1b5acdcc376cab976eeeaa196646fdbcb9
SHA512 cabf6cfc707633afcb023e09f34945ace4a0f369ed968e9e20d5b66a1a63a54b69a4b4c75ef00a2124365ec8af2d92033d70450023d9d89de04b5f0d7ed4134a
SSDEEP 3072:ALk395hYXJag6e5gEZDQQghyGl7b20cHPi+0XLTU8xlEl:AQq+eassQg0i2nq+0bTFlQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat persistence rat

Malware Config

Signatures

Gh0st RAT payload 3 IoCs

resource	yara_rule
behavioral2/files/0x00090000000231f3-4.dat	family_gh0strat
behavioral2/files/0x00090000000231f3-9.dat	family_gh0strat
behavioral2/files/0x00090000000231f3-10.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	4915e13ff1642028c458dd576c44142f.exe

Executes dropped EXE 1 IoCs

pid	Process
3216	2011522597.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ball = "C:\\WINDOWS\\Ball.exe"	2011522597.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\Ball.exe	2011522597.exe
File opened for modification	C:\WINDOWS\Ball.exe	2011522597.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3216	2011522597.exe
3216	2011522597.exe
3216	2011522597.exe
3216	2011522597.exe
3216	2011522597.exe
3216	2011522597.exe
3216	2011522597.exe
3216	2011522597.exe
3216	2011522597.exe
3216	2011522597.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3216	2011522597.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 3216	5044	4915e13ff1642028c458dd576c44142f.exe	43
PID 5044 wrote to memory of 3216	5044	4915e13ff1642028c458dd576c44142f.exe	43
PID 5044 wrote to memory of 3216	5044	4915e13ff1642028c458dd576c44142f.exe	43

C:\Users\Admin\AppData\Local\Temp\4915e13ff1642028c458dd576c44142f.exe
"C:\Users\Admin\AppData\Local\Temp\4915e13ff1642028c458dd576c44142f.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Windows\temp\2011522597.exe
  "C:\Windows\temp\2011522597.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2011522597.exe

Path C:\Windows\Temp\2011522597.exe
Size 73KB
SHA256 0c9d2e063f9744c1629eba6a793edf95e2e97d76d6badc33f7c5a93ce7c9bfa6
MD5 75776c419e8ce0d9c8f000f5f3a1b102
SHA1 76db7798b228ccaa01807ca2e497638c7c91f8f8
SHA512 b93161a088b53bba95124894ba89a70307104715379056e274256b2c69993ea60b1c552a15897ad855f600283b610a45ecae05af3723c36315dd9d608d91d9e6
SSDEEP 1536:Kf7ezCNkHjYj1hgGkcfjFbW4crqwPSufn8IW5Na:KTeTY1km5WBqwP3fsg
MD5 SHA1 SHA512 SSDEEP

Submit Download

2011522597.exe

Path C:\Windows\Temp\2011522597.exe
Size 126KB
SHA256 41f3e74fb8a93e2df12c4ebc380600947da91916de3a546f0be16b430f868e6e
MD5 d8995a007ba1f251da666319890dced6
SHA1 aaa16ae640931c273e15a64f31bf8a6a38c38773
SHA512 27ed33ab0c05abfbc837e7390563e8618be717b3e33a2dc89e33b8545760daa2455e0b9d33241e4d13584f81c3a1066eb9842a482f565c2fcd7ba91c108d0a29
SSDEEP 3072:KTeTY1km5WBqwP3fspQ/Xz7iasXHyC/hU:KiTtiWB0mL7teJ5U
MD5 SHA1 SHA512 SSDEEP

Submit Download

2011522597.exe

Path C:\Windows\temp\2011522597.exe
Size 28KB
SHA256 f361e080d86407addeb26ca3862ec695c7d382c377d40b5d03097e0f15ad36bb
MD5 f40a7daa1b425f73ebc71a981c8a95cc
SHA1 39b5957cc96474e5c44d405e06ae862cf804740a
SHA512 0f8705ff0e084f30a148c1d6f6c41cec59e1d09a5c74f44177e69f700cfa960ccd2293971f98c2113c63e1b84ae0b04a8005bb6f9724fa340ccc5d7f7ef37267
SSDEEP 384:KfMGpBxOMvEz22LZCyxQzje6QQ8N0a8oSuZnjIEbu9dZN3AMYvhYjfyj2fQCfER1:Kf7N8znuPe6Nk8EnjYjY1R2hgGkZ
MD5 SHA1 SHA512 SSDEEP

Submit Download