gh0strat | 299dc24f6f47135fdf42ecffca90150c8fdce331788b055b722f3bb0c4f5ba31

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 20:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b99b23c5f74702fd4a09a69d69d209b0.exe
Size

65KB
MD5

b99b23c5f74702fd4a09a69d69d209b0
SHA1

2a65aa6d4f6dc657594333416d8299f9d8ca3c50
SHA256

299dc24f6f47135fdf42ecffca90150c8fdce331788b055b722f3bb0c4f5ba31
SHA512

a295db249838701bb30b954317f1f90a98ebfbe6d45d7a9ebd2fe10ff312a63e8af1e9d33b38b3161c7d3e61d78481c174142fca3f846a2f260d713a89033887
SSDEEP

1536:hqMveY/ksWg6zqGcFclnOO8N4fT1TnvyvjTJKIlGgimtG6su5:sMGY/LWg6/cC4CpnvCJKJJmtH5

Score

10^/10

gh0strat persistence rat

Malware Config

Signatures

Gh0st RAT payload 2 IoCs

resource	yara_rule
behavioral1/memory/2876-4-0x0000000000400000-0x0000000000425000-memory.dmp	family_gh0strat
behavioral1/files/0x00070000000120e4-5.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\1.dll"	b99b23c5f74702fd4a09a69d69d209b0.exe

Deletes itself 1 IoCs

pid	Process
3016	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
3016	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\1.dll	b99b23c5f74702fd4a09a69d69d209b0.exe

C:\Users\Admin\AppData\Local\Temp\b99b23c5f74702fd4a09a69d69d209b0.exe
"C:\Users\Admin\AppData\Local\Temp\b99b23c5f74702fd4a09a69d69d209b0.exe"
1⤵
- Sets DLL path for service in the registry
- Drops file in System32 directory
PID:2876

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Deletes itself
- Loads dropped DLL
PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\1.dll

Filesize
115KB

MD5
e1e04e600ca80454e0654cf5a3dac5b4

SHA1
8591b9198273311edaa1cb1e20287375258ce281

SHA256
dafa3a83062bd11327076ca47fda247e797bc0bb1b0f93b7a2d9c7651afb6785

SHA512
acfc4f28cf3a1c125f60e3af2c3c794a77e6a02f8c174b41dbf44fe7d1cbeff4321267766f063cd08248a1f8622cf352a3e058b3c32624597bf8a3bfb3b40666

Download Submit
memory/2876-4-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads