gh0strat | 257b1130666e0dfb13e326ed6c390816b0d891093e3817f1d994cf5b42a5b0ab

General

Target

257b1130666e0dfb13e326ed6c390816b0d891093e3817f1d994cf5b42a5b0ab.exe
Size

2.4MB
MD5

12401422f17474568a97ad7cf387d7d2
SHA1

9f815c5dbe67e1ab23e5cc2bfd10031af8615961
SHA256

257b1130666e0dfb13e326ed6c390816b0d891093e3817f1d994cf5b42a5b0ab
SHA512

7e0c61820ce6314b6cdf9ab188fbbf87595619489d00a53a4928f5172462b0b4a09aaf794056e7c52955f9bf65cdb4fca11b096a8646534cae5995b6165fdd95
SSDEEP

49152:J5OWSx+u+yOBa6mKcsdonzjcmp207yWNAJHmIcm1zCDts883iah6oasKx4e:zOnGaqdozjcmQHWNYmIcm1zC83ia0x

Score

10^/10

Malware Config

Signatures

Gh0st RAT payload 3 IoCs

resource	yara_rule
behavioral2/memory/2424-8-0x0000000000400000-0x0000000000DD9000-memory.dmp	family_gh0strat
behavioral2/files/0x000d0000000230fc-13.dat	family_gh0strat
behavioral2/memory/3464-15-0x0000000000400000-0x0000000000DD9000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Deletes itself 1 IoCs

pid	Process
3464	nuxjgj

Executes dropped EXE 1 IoCs

pid	Process
3464	nuxjgj

Loads dropped DLL 1 IoCs

pid	Process
4100	svchost.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\glwcuftqqs	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2424	257b1130666e0dfb13e326ed6c390816b0d891093e3817f1d994cf5b42a5b0ab.exe
3464	nuxjgj

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\Google\bstot.biz	nuxjgj

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	svchost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2424	257b1130666e0dfb13e326ed6c390816b0d891093e3817f1d994cf5b42a5b0ab.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeRestorePrivilege	3464	nuxjgj
Token: SeBackupPrivilege	3464	nuxjgj
Token: SeBackupPrivilege	3464	nuxjgj
Token: SeRestorePrivilege	3464	nuxjgj
Token: SeBackupPrivilege	4100	svchost.exe
Token: SeRestorePrivilege	4100	svchost.exe
Token: SeBackupPrivilege	4100	svchost.exe
Token: SeBackupPrivilege	4100	svchost.exe
Token: SeSecurityPrivilege	4100	svchost.exe
Token: SeSecurityPrivilege	4100	svchost.exe
Token: SeBackupPrivilege	4100	svchost.exe
Token: SeBackupPrivilege	4100	svchost.exe
Token: SeSecurityPrivilege	4100	svchost.exe
Token: SeBackupPrivilege	4100	svchost.exe
Token: SeBackupPrivilege	4100	svchost.exe
Token: SeSecurityPrivilege	4100	svchost.exe
Token: SeBackupPrivilege	4100	svchost.exe
Token: SeRestorePrivilege	4100	svchost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2424	257b1130666e0dfb13e326ed6c390816b0d891093e3817f1d994cf5b42a5b0ab.exe
3464	nuxjgj

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 3464	2424	257b1130666e0dfb13e326ed6c390816b0d891093e3817f1d994cf5b42a5b0ab.exe	88
PID 2424 wrote to memory of 3464	2424	257b1130666e0dfb13e326ed6c390816b0d891093e3817f1d994cf5b42a5b0ab.exe	88
PID 2424 wrote to memory of 3464	2424	257b1130666e0dfb13e326ed6c390816b0d891093e3817f1d994cf5b42a5b0ab.exe	88

C:\Users\Admin\AppData\Local\Temp\257b1130666e0dfb13e326ed6c390816b0d891093e3817f1d994cf5b42a5b0ab.exe
"C:\Users\Admin\AppData\Local\Temp\257b1130666e0dfb13e326ed6c390816b0d891093e3817f1d994cf5b42a5b0ab.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2424
- \??\c:\users\admin\appdata\local\nuxjgj
  "C:\Users\Admin\AppData\Local\Temp\257b1130666e0dfb13e326ed6c390816b0d891093e3817f1d994cf5b42a5b0ab.exe"a -s
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3464

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "netsvcs" -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\nuxjgj

Filesize
1.2MB

MD5
2563d0294ed91eba96f09e084cb709e2

SHA1
af3d373d7288b37f053f0e69e59080dbbec7e321

SHA256
ff0f6e05fc7e9feb383ddb3a696545f18b88437852d840932c4ffe22748bd4b4

SHA512
8aa3e3b0eb0f0da9aa9a87898daaf1b331ebae1be2ebf17325ff90c8c9255afa00515b4778d1a3cd4edaa27e6dfdd57cd3a2ad4cd09dcdce887978721010c2f9

Download Submit
\??\c:\progra~2\google\bstot.biz

Filesize
1.4MB

MD5
75ed470265a01f5b4df4c75d3d22995e

SHA1
ef1ea172a377b0d8b539945cdd062cbb07eef757

SHA256
790a36f469b0cb824f9f69feda414e3ae751399f4b599f65b1c1c08752fc527b

SHA512
9fa26efa9fa4da27ef55bc08dd260df4041e605da45901734a4ab54dad67d1a42aed86d65a78973cccdecbaafc2baee8f9afd2939f164bdd12f3baa89ae0919b

Download Submit
\??\c:\users\admin\appdata\local\nuxjgj

Filesize
128KB

MD5
7328fc6e5b1a95df064735fd6d8c8865

SHA1
bed8b629e3d9d63143d18535ea5832470236fc56

SHA256
f6c0d3967601369adbf74e236617a9f304135289a49b5c33bbfaca2c280366b4

SHA512
99adc3cbe2ac9f1b5883196721b7a09742791ce376bfc540a943276297065fcb1724a5e08455556a9b30b7a360061a25baf7987e1eab2bfc45fce9be3ce4624a

Download Submit
memory/2424-0-0x0000000000400000-0x0000000000DD9000-memory.dmp

Filesize
9.8MB

Download
memory/2424-1-0x000000007FA70000-0x000000007FE41000-memory.dmp

Filesize
3.8MB

Download
memory/2424-8-0x0000000000400000-0x0000000000DD9000-memory.dmp

Filesize
9.8MB

Download
memory/2424-10-0x000000007FA70000-0x000000007FE41000-memory.dmp

Filesize
3.8MB

Download
memory/3464-7-0x0000000000400000-0x0000000000DD9000-memory.dmp

Filesize
9.8MB

Download
memory/3464-9-0x000000007FA70000-0x000000007FE41000-memory.dmp

Filesize
3.8MB

Download
memory/3464-15-0x0000000000400000-0x0000000000DD9000-memory.dmp

Filesize
9.8MB

Download
memory/3464-16-0x000000007FA70000-0x000000007FE41000-memory.dmp

Filesize
3.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads