gh0strat | 00838dbd77a882db994d926715acd95382284fcc3bbbeea76e8e9fce930c9b30

Analysis

max time kernel
140s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
15-03-2024 09:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cb0a5fdb343dca01c21291a4bb71fcc6.exe
Size

110KB
MD5

cb0a5fdb343dca01c21291a4bb71fcc6
SHA1

81dd131126883ad2ad19854998860fe6c72d5894
SHA256

00838dbd77a882db994d926715acd95382284fcc3bbbeea76e8e9fce930c9b30
SHA512

afb17b50a9613f1d53ef92316724bf3040c88b3cf9b68a42f4c74876675f0309d4550ec9bd96b5f5611cc91033028445f0ff57a284c7af4afc1d68f37730b53b
SSDEEP

3072:2U2bqGSyBeA/Cg676EWlrwoBAKWXmuYwbWLydWq5ee:2rbqGSyB1/P676Go6FGwbqydWLe

Score

10^/10

gh0strat persistence rat

Malware Config

Signatures

Gh0st RAT payload 3 IoCs

resource	yara_rule
behavioral2/memory/4536-0-0x0000000000400000-0x000000000041D000-memory.dmp	family_gh0strat
behavioral2/files/0x0008000000023213-4.dat	family_gh0strat
behavioral2/memory/4536-5-0x0000000000400000-0x000000000041D000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibilityno.dll"	cb0a5fdb343dca01c21291a4bb71fcc6.exe

Deletes itself 1 IoCs

pid	Process
752	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
752	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\FastUserSwitchingCompatibilityno.dll	cb0a5fdb343dca01c21291a4bb71fcc6.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4536	cb0a5fdb343dca01c21291a4bb71fcc6.exe
4536	cb0a5fdb343dca01c21291a4bb71fcc6.exe

C:\Users\Admin\AppData\Local\Temp\cb0a5fdb343dca01c21291a4bb71fcc6.exe
"C:\Users\Admin\AppData\Local\Temp\cb0a5fdb343dca01c21291a4bb71fcc6.exe"
1⤵
- Sets DLL path for service in the registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:4536

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s FastUserSwitchingCompatibility
1⤵
- Deletes itself
- Loads dropped DLL
- Checks processor information in registry
PID:752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\fastuserswitchingcompatibilityno.dll

Filesize
95KB

MD5
fff25ec444b7849f2715e384983be7a6

SHA1
df33a0a7d4478c227c281e51f9797a8635907a57

SHA256
a4ca2f39372f94e2843cd485d7caa3a2a130ea7e7d2a46eb357d852542f7353d

SHA512
ea413051939a68e5189fd242d92563bdff5c3fdd545628a7f899b0f8637049989c4a5ec1526b838df6426e39fa16b66767b3cf797d658ed3a903b4768701a9c3

Download Submit
memory/4536-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4536-5-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download