gh0strat | c355fb44451a9829f548229fadc437b737e0507cdea75337fdf810081c99e9ec

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 21:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8d66ba59ed4904c73ff13b59056f9593.exe
Size

110KB
MD5

8d66ba59ed4904c73ff13b59056f9593
SHA1

b206d6f447bf1ee75fe6fa8063c48d330b087712
SHA256

c355fb44451a9829f548229fadc437b737e0507cdea75337fdf810081c99e9ec
SHA512

d1d135e258a7c02731fd7bd74f89d033b1e50db04ce8732b4f9da91468a82f86da1e616dba3d002efeba967a4b0cd1c67df6cd970f59828e5b252c5ced433698
SSDEEP

3072:iXqu8kHvzJT1wQ6NpvgPC4Wa8CHOi4W9oD5zaQ66C:iXB8IvMpqCvUOi4WUzaD

Score

10^/10

gh0strat persistence rat

Malware Config

Signatures

Gh0st RAT payload 5 IoCs

resource	yara_rule
behavioral1/memory/1716-0-0x0000000000400000-0x000000000041D000-memory.dmp	family_gh0strat
behavioral1/memory/1716-4-0x0000000000400000-0x000000000041D000-memory.dmp	family_gh0strat
behavioral1/files/0x000a000000015cb3-3.dat	family_gh0strat
behavioral1/memory/2512-6-0x0000000010000000-0x000000001001B000-memory.dmp	family_gh0strat
behavioral1/memory/2512-7-0x0000000010000000-0x000000001001B000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Documents and Settings\\Local User\\naxiaozi.dll"	8d66ba59ed4904c73ff13b59056f9593.exe

Deletes itself 1 IoCs

pid	Process
2512	SVCHOST.EXE

Loads dropped DLL 1 IoCs

pid	Process
2512	SVCHOST.EXE

C:\Users\Admin\AppData\Local\Temp\8d66ba59ed4904c73ff13b59056f9593.exe
"C:\Users\Admin\AppData\Local\Temp\8d66ba59ed4904c73ff13b59056f9593.exe"
1⤵
- Sets DLL path for service in the registry
PID:1716

C:\Windows\SysWOW64\SVCHOST.EXE
C:\Windows\SysWOW64\SVCHOST.EXE -K NETSVCS
1⤵
- Deletes itself
- Loads dropped DLL
PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\documents and settings\local user\naxiaozi.dll

Filesize
100KB

MD5
6de1a64b1ffaef2215a19dd3744deb6e

SHA1
6022b19e1d6d3360da9e629f6db8f8f7bfa65883

SHA256
f02eae188a03a1378ae41db0a81215b05874e46d3507b1ff3f460567bc7f983a

SHA512
f9e90e6c3d71ab7049180eb699e33f30a44e33128c15c1ab18b83121343c8742f314c81d0c59069f2f6b2d2bca64c0906c9fa26c10a61867776841f799e49404

Download Submit
memory/1716-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1716-4-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2512-6-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download
memory/2512-7-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads