gh0strat | 257b1130666e0dfb13e326ed6c390816b0d891093e3817f1d994cf5b42a5b0ab

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27-03-2024 18:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

257b1130666e0dfb13e326ed6c390816b0d891093e3817f1d994cf5b42a5b0ab.exe
Size

2.4MB
MD5

12401422f17474568a97ad7cf387d7d2
SHA1

9f815c5dbe67e1ab23e5cc2bfd10031af8615961
SHA256

257b1130666e0dfb13e326ed6c390816b0d891093e3817f1d994cf5b42a5b0ab
SHA512

7e0c61820ce6314b6cdf9ab188fbbf87595619489d00a53a4928f5172462b0b4a09aaf794056e7c52955f9bf65cdb4fca11b096a8646534cae5995b6165fdd95
SSDEEP

49152:J5OWSx+u+yOBa6mKcsdonzjcmp207yWNAJHmIcm1zCDts883iah6oasKx4e:zOnGaqdozjcmQHWNYmIcm1zC83ia0x

Score

10^/10

gh0strat bootkit persistence rat

Malware Config

Signatures

Gh0st RAT payload 3 IoCs

resource	yara_rule
behavioral1/memory/2412-11-0x0000000000400000-0x0000000000DD9000-memory.dmp	family_gh0strat
behavioral1/files/0x000b0000000126e1-18.dat	family_gh0strat
behavioral1/memory/1184-20-0x0000000000400000-0x0000000000DD9000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Deletes itself 1 IoCs

pid	Process
1184	gswhpg

Executes dropped EXE 1 IoCs

pid	Process
1184	gswhpg

Loads dropped DLL 3 IoCs

pid	Process
2412	257b1130666e0dfb13e326ed6c390816b0d891093e3817f1d994cf5b42a5b0ab.exe
2412	257b1130666e0dfb13e326ed6c390816b0d891093e3817f1d994cf5b42a5b0ab.exe
2840	svchost.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\gdjimcqsdx	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2412	257b1130666e0dfb13e326ed6c390816b0d891093e3817f1d994cf5b42a5b0ab.exe
1184	gswhpg

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\Google\hfmtv.biz	gswhpg

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Modifies data under HKEY_USERS 30 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3b-bb-b0-8e-62\WpadDecisionReason = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3b-bb-b0-8e-62\WpadDecision = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum\Version = "7"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7AB79480-A348-4231-A1D0-1A790C64C596}\WpadDecisionTime = a0866cca7280da01	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7AB79480-A348-4231-A1D0-1A790C64C596}\WpadDecision = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f004e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7AB79480-A348-4231-A1D0-1A790C64C596}\WpadNetworkName = "Network 3"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7AB79480-A348-4231-A1D0-1A790C64C596}	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7AB79480-A348-4231-A1D0-1A790C64C596}\WpadDecisionReason = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3b-bb-b0-8e-62	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3b-bb-b0-8e-62\WpadDecisionTime = a0866cca7280da01	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7AB79480-A348-4231-A1D0-1A790C64C596}\0e-3b-bb-b0-8e-62	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2840	svchost.exe
2840	svchost.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2412	257b1130666e0dfb13e326ed6c390816b0d891093e3817f1d994cf5b42a5b0ab.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeRestorePrivilege	1184	gswhpg
Token: SeBackupPrivilege	1184	gswhpg
Token: SeBackupPrivilege	1184	gswhpg
Token: SeRestorePrivilege	1184	gswhpg
Token: SeBackupPrivilege	2840	svchost.exe
Token: SeRestorePrivilege	2840	svchost.exe
Token: SeBackupPrivilege	2840	svchost.exe
Token: SeBackupPrivilege	2840	svchost.exe
Token: SeSecurityPrivilege	2840	svchost.exe
Token: SeSecurityPrivilege	2840	svchost.exe
Token: SeBackupPrivilege	2840	svchost.exe
Token: SeBackupPrivilege	2840	svchost.exe
Token: SeSecurityPrivilege	2840	svchost.exe
Token: SeBackupPrivilege	2840	svchost.exe
Token: SeBackupPrivilege	2840	svchost.exe
Token: SeSecurityPrivilege	2840	svchost.exe
Token: SeBackupPrivilege	2840	svchost.exe
Token: SeRestorePrivilege	2840	svchost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2412	257b1130666e0dfb13e326ed6c390816b0d891093e3817f1d994cf5b42a5b0ab.exe
1184	gswhpg

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 1184	2412	257b1130666e0dfb13e326ed6c390816b0d891093e3817f1d994cf5b42a5b0ab.exe	28
PID 2412 wrote to memory of 1184	2412	257b1130666e0dfb13e326ed6c390816b0d891093e3817f1d994cf5b42a5b0ab.exe	28
PID 2412 wrote to memory of 1184	2412	257b1130666e0dfb13e326ed6c390816b0d891093e3817f1d994cf5b42a5b0ab.exe	28
PID 2412 wrote to memory of 1184	2412	257b1130666e0dfb13e326ed6c390816b0d891093e3817f1d994cf5b42a5b0ab.exe	28

C:\Users\Admin\AppData\Local\Temp\257b1130666e0dfb13e326ed6c390816b0d891093e3817f1d994cf5b42a5b0ab.exe
"C:\Users\Admin\AppData\Local\Temp\257b1130666e0dfb13e326ed6c390816b0d891093e3817f1d994cf5b42a5b0ab.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412
- \??\c:\users\admin\appdata\local\gswhpg
  "C:\Users\Admin\AppData\Local\Temp\257b1130666e0dfb13e326ed6c390816b0d891093e3817f1d994cf5b42a5b0ab.exe"a -s
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1184

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "netsvcs"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\progra~2\google\hfmtv.biz

Filesize
616KB

MD5
7ebf5991c5d8210d7eac6f17abcd0f99

SHA1
f729d735631f1797b62bfa6f0653a2d23a7697b4

SHA256
db9755ad96838585d039b62cc07ffd48e2576e30015f4b4d74c8179dee168fb8

SHA512
ffb2f703d2e27c09b08bd2317a53a6ed2d18ed29d382ae89427da029688b243a9485f5658524a5b3fa7b0f7922f9e6a2680c33dcd4334b299aabec19cc90e72d

Download Submit
\Users\Admin\AppData\Local\gswhpg

Filesize
2.4MB

MD5
429e602526fef2e0bd57b2a9dcb02056

SHA1
cc6dc88a24a82b8aa5186c77b2628d070424dfd3

SHA256
6fd2622152a9185d09d66d49b4c426a0f8a50a85eee4cc1ecdb4db6c92d93944

SHA512
52c30c16edba4ad197de8842da2c43480c934bf69f5d6ecb461113f729e06437d7273bc49ee61bcf28ed9909f536431b8d94af649b53badd233032c7469dce25

Download Submit
memory/1184-13-0x0000000000400000-0x0000000000DD9000-memory.dmp

Filesize
9.8MB

Download
memory/1184-15-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

Filesize
3.8MB

Download
memory/1184-20-0x0000000000400000-0x0000000000DD9000-memory.dmp

Filesize
9.8MB

Download
memory/1184-21-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

Filesize
3.8MB

Download
memory/2412-0-0x0000000000400000-0x0000000000DD9000-memory.dmp

Filesize
9.8MB

Download
memory/2412-1-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

Filesize
3.8MB

Download
memory/2412-11-0x0000000000400000-0x0000000000DD9000-memory.dmp

Filesize
9.8MB

Download
memory/2412-12-0x0000000003AA0000-0x0000000004479000-memory.dmp

Filesize
9.8MB

Download