gh0strat | a0d89a8cb7cc1539cae2e1c6e7dee4835506179deab6e5183000ffe30e5f9005

Resubmissions

01/05/2024, 15:02

240501-sewm7ahf3v 10

19/03/2024, 11:01

240319-m4tl8sad46 10

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 11:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a0d89a8cb7cc1539cae2e1c6e7dee4835506179deab6e5183000ffe30e5f9005.exe
Size

1.0MB
MD5

4531c46b0844e49db3b482ab0a8aaa99
SHA1

8bafe779083ca8a8c1edd9dc7995b1aaec75ccdb
SHA256

a0d89a8cb7cc1539cae2e1c6e7dee4835506179deab6e5183000ffe30e5f9005
SHA512

a9671f57c624d73266f36449bada1be9fe51e138a35d941ec725f628584fb72961ca5b6ea1e3c943baa3e0f492a56859fe8dd661c7d61309fa9e5dd0c96f0c55
SSDEEP

12288:M+UsITPsJnAyGnAMmyZE+qwc1/ConIsrwk9:M+fITPTywNi+qksi

Score

10^/10

gh0strat persistence rat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/3308-3-0x0000000010000000-0x000000001008E000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\QAssist.sys	Ogqgwg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	a0d89a8cb7cc1539cae2e1c6e7dee4835506179deab6e5183000ffe30e5f9005.exe

Executes dropped EXE 1 IoCs

pid	Process
1644	Ogqgwg.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rsaalc oxprrxfg = "C:\\windows\\Ogqgwg.exe"	a0d89a8cb7cc1539cae2e1c6e7dee4835506179deab6e5183000ffe30e5f9005.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ini.ini	a0d89a8cb7cc1539cae2e1c6e7dee4835506179deab6e5183000ffe30e5f9005.exe
File opened for modification	C:\Windows\SysWOW64\ini.ini	Ogqgwg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\windows\Ogqgwg.exe	a0d89a8cb7cc1539cae2e1c6e7dee4835506179deab6e5183000ffe30e5f9005.exe
File opened for modification	C:\windows\Ogqgwg.exe	a0d89a8cb7cc1539cae2e1c6e7dee4835506179deab6e5183000ffe30e5f9005.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1644	Ogqgwg.exe
Token: SeIncBasePriorityPrivilege	1644	Ogqgwg.exe
Token: 33	1644	Ogqgwg.exe
Token: SeIncBasePriorityPrivilege	1644	Ogqgwg.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3308 wrote to memory of 1644	3308	a0d89a8cb7cc1539cae2e1c6e7dee4835506179deab6e5183000ffe30e5f9005.exe	92
PID 3308 wrote to memory of 1644	3308	a0d89a8cb7cc1539cae2e1c6e7dee4835506179deab6e5183000ffe30e5f9005.exe	92
PID 3308 wrote to memory of 1644	3308	a0d89a8cb7cc1539cae2e1c6e7dee4835506179deab6e5183000ffe30e5f9005.exe	92

C:\Users\Admin\AppData\Local\Temp\a0d89a8cb7cc1539cae2e1c6e7dee4835506179deab6e5183000ffe30e5f9005.exe
"C:\Users\Admin\AppData\Local\Temp\a0d89a8cb7cc1539cae2e1c6e7dee4835506179deab6e5183000ffe30e5f9005.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3308
- C:\windows\Ogqgwg.exe
  "C:\windows\Ogqgwg.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  PID:1644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Ogqgwg.exe

Filesize
519KB

MD5
641d0092c70bfb2d4d2a2b1c773463a6

SHA1
92398f8365901d11559fe8e426fb9a70281689b3

SHA256
a074fcdc95dd153a5f2c5dc06461142fb3aa2faf43a54d3cb7873b91c3046fa5

SHA512
644e381bb90ba8162bd949acc34c736ab26a0f68a0d9d5f59379a069083e44fbc8dec310f4a28afb621ba5dc588e5c577af0f8764b61ac5251efc858bf57e2f4

Download Submit
C:\Windows\Ogqgwg.exe

Filesize
121KB

MD5
a7098f496513ba8a16f2c3892aa20a34

SHA1
88979a6c62b39db36d8058b0d2ec1e4f2bc6963b

SHA256
4b4053edf5bd05aa6bf7585b097db52d166dfb7be25eabe4c6a050f91af56f9c

SHA512
8cf1df4b2c56ae671cb0d4b6ca49377105b310f2f0d0a2eec27d987c84670fb741d4c9ad6d2da721b634f148587eb80d400ab6200c84e64050b8638dcf19b1e2

Download Submit
C:\Windows\SysWOW64\ini.ini

Filesize
19B

MD5
fe9af7587d65300338177538aa72f924

SHA1
c8ae231d3ae13f9db8b9f16e188e951e7cb76377

SHA256
556243e27a369fbdff1ecfb413b7540f1eb4e6becba03b76d221443b0d022351

SHA512
3bffe70c5daea4d6be501278be067bbc02e7ac211fef33629b5447ef498d49af7cbe25f994e33c2835bd9963749c07edc789fddd918e1c7739b77422ff57cf3e

Download Submit
C:\windows\Ogqgwg.exe

Filesize
98KB

MD5
a8bcd2c87c2c3bb4618354b9dbe7e0e0

SHA1
54ac23ae069bbfa53501d648e18aa1a92b731af3

SHA256
d57160366c9d4f701af31b50041e0e150926a099e315af8bbd4ec504291baec9

SHA512
1288e7feca9b763e13d3c7de5ada5944f047f54b0932dc18496137a9642f354cec7a31561906d97fd2ff7082fac57a52d06f34a759ab4fb8b1b588c61a182609

Download Submit
memory/3308-3-0x0000000010000000-0x000000001008E000-memory.dmp

Filesize
568KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads