gh0strat | 00838dbd77a882db994d926715acd95382284fcc3bbbeea76e8e9fce930c9b30

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
15-03-2024 09:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cb0a5fdb343dca01c21291a4bb71fcc6.exe
Size

110KB
MD5

cb0a5fdb343dca01c21291a4bb71fcc6
SHA1

81dd131126883ad2ad19854998860fe6c72d5894
SHA256

00838dbd77a882db994d926715acd95382284fcc3bbbeea76e8e9fce930c9b30
SHA512

afb17b50a9613f1d53ef92316724bf3040c88b3cf9b68a42f4c74876675f0309d4550ec9bd96b5f5611cc91033028445f0ff57a284c7af4afc1d68f37730b53b
SSDEEP

3072:2U2bqGSyBeA/Cg676EWlrwoBAKWXmuYwbWLydWq5ee:2rbqGSyB1/P676Go6FGwbqydWLe

Score

10^/10

gh0strat persistence rat

Malware Config

Signatures

Gh0st RAT payload 3 IoCs

resource	yara_rule
behavioral1/memory/2360-0-0x0000000000400000-0x000000000041D000-memory.dmp	family_gh0strat
behavioral1/files/0x000900000001447e-4.dat	family_gh0strat
behavioral1/memory/2360-6-0x0000000000400000-0x000000000041D000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibilityno.dll"	cb0a5fdb343dca01c21291a4bb71fcc6.exe

Deletes itself 1 IoCs

pid	Process
2936	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
2936	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\FastUserSwitchingCompatibilityno.dll	cb0a5fdb343dca01c21291a4bb71fcc6.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2360	cb0a5fdb343dca01c21291a4bb71fcc6.exe

C:\Users\Admin\AppData\Local\Temp\cb0a5fdb343dca01c21291a4bb71fcc6.exe
"C:\Users\Admin\AppData\Local\Temp\cb0a5fdb343dca01c21291a4bb71fcc6.exe"
1⤵
- Sets DLL path for service in the registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2360

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Deletes itself
- Loads dropped DLL
- Checks processor information in registry
PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\fastuserswitchingcompatibilityno.dll

Filesize
95KB

MD5
99d38eaad4fa6f9d8da7868544c1ebca

SHA1
3125b1c73514498cae536037194873a64b11df79

SHA256
d5f8eba0335700b7d779d6b27de511a866b4bb6ead8b0cd536d1a23ec5ae1ea0

SHA512
2e86a3def728bd4120b54318726a91944ab6e74655db59baffcd38c14cf02afdfb97606a736ddb6ad7bca36f23f4bb12f937d42b093d0bb842575946cc3aa23f

Download Submit
memory/2360-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2360-6-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download