gh0strat | 5a1dd5d210d973e1bd4027e9a6fc16efe3dce6d8ed3dbd9c4a2463c0158687e0

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/01/2024, 08:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67192514274aac738a2b014e7c8a913c.exe
Size

260KB
MD5

67192514274aac738a2b014e7c8a913c
SHA1

d5ed248403057efff3e8d717d1cf0f650d655790
SHA256

5a1dd5d210d973e1bd4027e9a6fc16efe3dce6d8ed3dbd9c4a2463c0158687e0
SHA512

6f4d56afd1a2a99bd011700a6eac284b5ef20d24bbf66d3180bde5aec060f2bbc716c155469f83388229117535fd1abd24f2952f32886fa2f6af77e786d6dead
SSDEEP

6144:+wxvges2lBlZL02vIM/N5gAshXqBdYHEzodHVe4C7:lvges2lBlOA9/oAspqBqHEzo1Ve4C7

Score

10^/10

gh0strat bootkit persistence rat

Malware Config

Signatures

Gh0st RAT payload 8 IoCs

resource	yara_rule
behavioral1/files/0x002d000000014c1d-20.dat	family_gh0strat
behavioral1/files/0x002d000000014c1d-21.dat	family_gh0strat
behavioral1/files/0x002d000000014c1d-24.dat	family_gh0strat
behavioral1/memory/2684-25-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral1/files/0x002d000000014c1d-23.dat	family_gh0strat
behavioral1/files/0x002d000000014c1d-22.dat	family_gh0strat
behavioral1/memory/1856-26-0x0000000000400000-0x0000000000479000-memory.dmp	family_gh0strat
behavioral1/memory/1856-42-0x0000000000400000-0x0000000000479000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Deletes itself 1 IoCs

pid	Process
2652	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2684	maolan.exe
2512	qiuqi1.exe

Loads dropped DLL 11 IoCs

pid	Process
1856	67192514274aac738a2b014e7c8a913c.exe
2684	maolan.exe
2684	maolan.exe
2684	maolan.exe
2684	maolan.exe
2684	maolan.exe
2684	maolan.exe
1856	67192514274aac738a2b014e7c8a913c.exe
2512	qiuqi1.exe
2512	qiuqi1.exe
2512	qiuqi1.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	maolan.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\xxxooo.bat	67192514274aac738a2b014e7c8a913c.exe
File created	C:\Program Files\Common Files\maolan.dll	67192514274aac738a2b014e7c8a913c.exe
File created	C:\Program Files\Common Files\xxxooo.dll	67192514274aac738a2b014e7c8a913c.exe
File created	C:\Program Files\Common Files\maolan.exe	67192514274aac738a2b014e7c8a913c.exe
File opened for modification	C:\Program Files\Common Files\maolan.exe	67192514274aac738a2b014e7c8a913c.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	maolan.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	maolan.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{603D3801-BD81-11d0-A3A5-00C04FD706EC}\InProcServer32	qiuqi1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	qiuqi1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{603D3801-BD81-11d0-A3A5-00C04FD706EC}	qiuqi1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{603D3801-BD81-11D0-A3A5-00C04FD706EC}\InProcServer32	qiuqi1.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2684	maolan.exe
2684	maolan.exe
2684	maolan.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 2684	1856	67192514274aac738a2b014e7c8a913c.exe	28
PID 1856 wrote to memory of 2684	1856	67192514274aac738a2b014e7c8a913c.exe	28
PID 1856 wrote to memory of 2684	1856	67192514274aac738a2b014e7c8a913c.exe	28
PID 1856 wrote to memory of 2684	1856	67192514274aac738a2b014e7c8a913c.exe	28
PID 1856 wrote to memory of 2684	1856	67192514274aac738a2b014e7c8a913c.exe	28
PID 1856 wrote to memory of 2684	1856	67192514274aac738a2b014e7c8a913c.exe	28
PID 1856 wrote to memory of 2684	1856	67192514274aac738a2b014e7c8a913c.exe	28
PID 1856 wrote to memory of 2512	1856	67192514274aac738a2b014e7c8a913c.exe	29
PID 1856 wrote to memory of 2512	1856	67192514274aac738a2b014e7c8a913c.exe	29
PID 1856 wrote to memory of 2512	1856	67192514274aac738a2b014e7c8a913c.exe	29
PID 1856 wrote to memory of 2512	1856	67192514274aac738a2b014e7c8a913c.exe	29
PID 1856 wrote to memory of 2512	1856	67192514274aac738a2b014e7c8a913c.exe	29
PID 1856 wrote to memory of 2512	1856	67192514274aac738a2b014e7c8a913c.exe	29
PID 1856 wrote to memory of 2512	1856	67192514274aac738a2b014e7c8a913c.exe	29
PID 2512 wrote to memory of 2608	2512	qiuqi1.exe	30
PID 2512 wrote to memory of 2608	2512	qiuqi1.exe	30
PID 2512 wrote to memory of 2608	2512	qiuqi1.exe	30
PID 2512 wrote to memory of 2608	2512	qiuqi1.exe	30
PID 2512 wrote to memory of 2608	2512	qiuqi1.exe	30
PID 2512 wrote to memory of 2608	2512	qiuqi1.exe	30
PID 2512 wrote to memory of 2608	2512	qiuqi1.exe	30
PID 1856 wrote to memory of 2652	1856	67192514274aac738a2b014e7c8a913c.exe	32
PID 1856 wrote to memory of 2652	1856	67192514274aac738a2b014e7c8a913c.exe	32
PID 1856 wrote to memory of 2652	1856	67192514274aac738a2b014e7c8a913c.exe	32
PID 1856 wrote to memory of 2652	1856	67192514274aac738a2b014e7c8a913c.exe	32
PID 1856 wrote to memory of 2652	1856	67192514274aac738a2b014e7c8a913c.exe	32
PID 1856 wrote to memory of 2652	1856	67192514274aac738a2b014e7c8a913c.exe	32
PID 1856 wrote to memory of 2652	1856	67192514274aac738a2b014e7c8a913c.exe	32

C:\Users\Admin\AppData\Local\Temp\67192514274aac738a2b014e7c8a913c.exe
"C:\Users\Admin\AppData\Local\Temp\67192514274aac738a2b014e7c8a913c.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Program Files\Common Files\maolan.exe
  "C:\Program Files\Common Files\maolan.exe" "C:\Program Files\Common Files\maolan.dll" ServiceMain
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:2684
- C:\Documents and Settings\qiuqi1.exe
  "C:\Documents and Settings\qiuqi1.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c del C:\DOCUME~1\qiuqi1.exe
    3⤵
    PID:2608
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del C:\Users\Admin\AppData\Local\Temp\671925~1.EXE
  2⤵
  - Deletes itself
  PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Documents and Settings\qiuqi1.exe

Filesize
97KB

MD5
9a2ac34d780d37ec45731772e38519d8

SHA1
4ef188f311680329b0b31664c075f2016a3a52f7

SHA256
4b1d12ee9cd10139f77453afb333a70d01938f00fce08db84dd26f748dd51e8e

SHA512
5d6e7fa50401204fecca993f8fe8b21da1cf4b25fb98addf527b59fe5a40b5a3890ce6dc1332caf4146097d324feab4744ce8905fa1248b656071f83ee179377

Download Submit
C:\Program Files\Common Files\maolan.dll

Filesize
2.8MB

MD5
e40dd28d954deb1e3f5559289d2b7552

SHA1
ffa346d1470090e074c1690dc922bee705ec4dd1

SHA256
f01219062c7921e14ab854ca2e3dd50acb9ea965dbc71f3960c0495ce2ec6765

SHA512
8c77a752156ac7bc38cd07e592d7305492529b1ed1eaf325b0d60491433507061f8f60ba905378461e965a0904d668bf1cae44382f4f2b82ce0e57e39da821e4

Download Submit
C:\Users\qiuqi1.exe

Filesize
93KB

MD5
9d4e057fe19386b6d7226ab5ddff8952

SHA1
ac21f063cdf80aa0e946c56245ba7555d09905ba

SHA256
8042643e61faf6c4122fd74b6321369321d483403368eef28d9028458338a93f

SHA512
2212197dcb9c8bb7f3f4a7c1dc3512d17adb730dbe220c74b506c290d857a45a1077d86416bcb490a65765c28c0d582b8438938c2838fc3780268035a11c7224

Download Submit
\Program Files\Common Files\maolan.dll

Filesize
420KB

MD5
ba96e5df213870ee45cf54f33c01aa5f

SHA1
61cd0ac21aeda1bb9bbf4a261803ca6628e8fb3b

SHA256
6c306a55e86846ef2f4dd4158245110068367a5514583660e975a0a531baa597

SHA512
b9ef45807d4018062d2322d355622da6d3ebc91995990c34a643168d732e5a4777244c4511b57eb7a9e386bae725890a394ecdfa09cf1c3846871a3cb8a21b5c

Download Submit
\Program Files\Common Files\maolan.dll

Filesize
477KB

MD5
dcb137e4fc3b18cf502363a65ed8dd00

SHA1
1f8df60f720d051de769db1b1be908ac48b97f00

SHA256
7ef0da20be326ddacea33ba83323a1fc819edacec2380e70414a6461eb0a58a2

SHA512
50da63069770774766630823bbe15d33582602b45a97eb3536716a75246c00a98f82792de81364bc13a3b4ff369f020e30234a5f98bf142420368f348cdbec32

Download Submit
\Program Files\Common Files\maolan.dll

Filesize
402KB

MD5
fdd89bac28a1f121dc637c88d80ea9a6

SHA1
d5096897d526de5cb497d8d886d89ab1a3380105

SHA256
8cf4ec5e2fab51233bc014c0af64a6d5716f4117b0a77b41c7c549b829d4f2a4

SHA512
70996670196999f537fc626ef1c312ed4fd2ee9d09c89b510488da13b86980a8cb01aff4804a977481e6a4446f9f37b7424e070687f896003576f463e93dfa69

Download Submit
\Program Files\Common Files\maolan.dll

Filesize
460KB

MD5
76eac3ab4a65c41dd1021d8f57edd311

SHA1
b4b630349f4b934d96b74b1207e591060d9592f9

SHA256
78ffec6c36d4d549a6d62a43e2839688323be3e2baa6a777409e4ac63c615a9e

SHA512
27e2d77797e27a204b760ac405f692bc6fb8dba618b166596a925ae24ddb168a580ffac27d1b39f77e98603841b5c41c16d92a18bf406fa578406c2b05a776a9

Download Submit
\Program Files\Common Files\maolan.exe

Filesize
43KB

MD5
51138beea3e2c21ec44d0932c71762a8

SHA1
8939cf35447b22dd2c6e6f443446acc1bf986d58

SHA256
5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

SHA512
794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

Download Submit
\Users\qiuqi1.exe

Filesize
130KB

MD5
46d7f5f26d51e21cb7a052ec46fca0db

SHA1
792476144b73bfa90b7c839da3ba11e3bac7484f

SHA256
abaedba7d8065830f6c54ac92085887ab73df325815daf628251e58e99cd6a98

SHA512
4911af647fc259059c3017e17174feaae341806036e778ba5b500b820ea19febaaa12c3645a2a0ffb74f11f3f3ae293254b7082b9c069bdcc5f25d662130c8b7

Download Submit
\Users\qiuqi1.exe

Filesize
115KB

MD5
855d7a658a8821b43736f2585a102568

SHA1
cffbda8174ee8dc485879c3dfacff4a9a86907ee

SHA256
2c9c959220487e0e5b5ae41c95c1ea4e8b5dd49cfb84752357e7c1d9cc7044d5

SHA512
c0aec3b6f591e08053e1cf6cab18d9bda88d1f53f3f4b276395987517a9c438554d059b90d3ad3c2c9d6a04f52e1481dd45ed87d6a9abe3a12ea12aa88e133c5

Download Submit
\Users\qiuqi1.exe

Filesize
53KB

MD5
03e08fcd46fbd803e4b3affef79530c1

SHA1
98fe9da42ffa3427bab3a25ddc10a29c7dd44618

SHA256
f219e25735ceae8fced789b1042be25a9e08c23a48f40b22184fea5c1147b86f

SHA512
ab2f13512b0fa17b05ef407f1603b3dc0d0a521c6f5034ae1b49095423b2b2ad7437f0b4cbea9059ae68ef1e692ffff7f7843155e64aa300ec3acbad372a0760

Download Submit
\Users\qiuqi1.exe

Filesize
117KB

MD5
2f5f1305ad58c80179a502f676abe349

SHA1
a438b5ed970102518526d48ef1bf79f9bbc4ffa3

SHA256
24b1da484824a924643532b953fa690e55cf53647b428941c4e755159ed05a19

SHA512
98fe24c9f81172e9eb80d583634844da95879105ac3c77b5fa27190d03016483cadcc9f4959a1e2119c226192cbc9ea3a83718a9131dabbaf324989c6fee67e9

Download Submit
memory/1856-6-0x00000000002A0000-0x00000000002A2000-memory.dmp

Filesize
8KB

Download
memory/1856-33-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/1856-0-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1856-26-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1856-27-0x0000000000250000-0x000000000028E000-memory.dmp

Filesize
248KB

Download
memory/1856-7-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1856-3-0x0000000000250000-0x000000000028E000-memory.dmp

Filesize
248KB

Download
memory/1856-4-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1856-42-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1856-43-0x0000000000240000-0x000000000024D000-memory.dmp

Filesize
52KB

Download
memory/1856-41-0x0000000000250000-0x000000000028E000-memory.dmp

Filesize
248KB

Download
memory/1856-5-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/1856-2-0x0000000000250000-0x000000000028E000-memory.dmp

Filesize
248KB

Download
memory/1856-1-0x0000000000240000-0x00000000002B9000-memory.dmp

Filesize
484KB

Download
memory/2512-38-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2512-39-0x0000000000020000-0x0000000000026000-memory.dmp

Filesize
24KB

Download
memory/2512-40-0x0000000000020000-0x0000000000026000-memory.dmp

Filesize
24KB

Download
memory/2684-25-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download