gh0strat | b9767144bfdc0ceb2c21108beadc9fc3687c5db992a83e29d5fe805b24deda91

General

Target
b9767144bfdc0ceb2c21108beadc9fc3687c5db992a83e29d5fe805b24deda91.exe
Size 1.4MB
Sample240509-nc2dfahc68
SHA256 b9767144bfdc0ceb2c21108beadc9fc3687c5db992a83e29d5fe805b24deda91
MD5 c39085cae57ded896c20a9212774b2f5
SHA1 6efab020229c24cfdb6a973430b2405019a5e9d3
SHA512 5de1854e3559cf02769bb12b6d63d97759b30116a94e323e3e9d4c7c68e94ee87f6656ce78649862c3018d6491f6929b5f86ec76ee055898f8e52bd5f43ae64e
SSDEEP 24576:OYFbkIsaPiXSVnC7Yp9zkNmZG8RRlnVyzHj:OYREXSVMDi3+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023552-5.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\svchcst\Parameters\ServiceDll = "C:\\Windows\\system32\\240645265.bat"	look2.exe

Executes dropped EXE 2 IoCs

pid	Process
4924	look2.exe
1596	svchcst.exe

Loads dropped DLL 3 IoCs

pid	Process
4924	look2.exe
4980	svchost.exe
1596	svchcst.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\svchcst.exe	svchost.exe
File created	C:\Windows\SysWOW64\240645265.bat	look2.exe
File opened for modification	C:\Windows\SysWOW64\ini.ini	look2.exe
File created	C:\Windows\SysWOW64\svchcst.exe	svchost.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	b9767144bfdc0ceb2c21108beadc9fc3687c5db992a83e29d5fe805b24deda91.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1656	b9767144bfdc0ceb2c21108beadc9fc3687c5db992a83e29d5fe805b24deda91.exe
1656	b9767144bfdc0ceb2c21108beadc9fc3687c5db992a83e29d5fe805b24deda91.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 4924	1656	b9767144bfdc0ceb2c21108beadc9fc3687c5db992a83e29d5fe805b24deda91.exe	88
PID 1656 wrote to memory of 4924	1656	b9767144bfdc0ceb2c21108beadc9fc3687c5db992a83e29d5fe805b24deda91.exe	88
PID 1656 wrote to memory of 4924	1656	b9767144bfdc0ceb2c21108beadc9fc3687c5db992a83e29d5fe805b24deda91.exe	88
PID 4980 wrote to memory of 1596	4980	svchost.exe	94
PID 4980 wrote to memory of 1596	4980	svchost.exe	94
PID 4980 wrote to memory of 1596	4980	svchost.exe	94

C:\Users\Admin\AppData\Local\Temp\b9767144bfdc0ceb2c21108beadc9fc3687c5db992a83e29d5fe805b24deda91.exe
"C:\Users\Admin\AppData\Local\Temp\b9767144bfdc0ceb2c21108beadc9fc3687c5db992a83e29d5fe805b24deda91.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Users\Admin\AppData\Local\Temp\look2.exe
  C:\Users\Admin\AppData\Local\Temp\\look2.exe
  2⤵
  - Sets DLL path for service in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  PID:4924

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "svchcst"
1⤵
PID:884

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "svchcst"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Windows\SysWOW64\svchcst.exe
  C:\Windows\system32\svchcst.exe "c:\windows\system32\240645265.bat",MainThread
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4352,i,5047420736443372512,9747851268033796534,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:8
1⤵
PID:4860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCXF51E.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCXF51E.tmp
Size 1.4MB
SHA256 c692f8b97c80f9406361df79a2702345755caf9d100ddd1890a5f54b96e0a5dd
MD5 5449757f3a8f1d8da8ad7c9a7986d695
SHA1 085182ba87a2bd91ba85540790e30e1d394e0647
SHA512 e9f7d0262b85667fec2e204daf81b09682ca0ede9556aa7d4d212368bdc980447e2ddcb370c983b8a620ff56a12ce51bab2950a5425a829ab3a0ee425283988e
SSDEEP 24576:OYFbkIsaPiXSVnC7Yp9zkNmZG8RRlnVyzv:OYREXSVMDi3K
MD5 SHA1 SHA512 SSDEEP

Submit Download

look2.exe

Path C:\Users\Admin\AppData\Local\Temp\look2.exe
Size 337KB
SHA256 86492ebf2d6f471a5ee92977318d099b3ea86175b5b7ae522237ae01d07a4857
MD5 2f3b6f16e33e28ad75f3fdaef2567807
SHA1 85e907340faf1edfc9210db85a04abd43d21b741
SHA512 db17e99e2df918cfc9ccbe934adfe73f0777ce1ce9f28b57a4b24ecd821efe2e0b976a634853247b77b16627d2bb3af4ba20306059d1d25ef38ffada7da3e3a4
SSDEEP 6144:8IXwWcHnNmZEvB7csAPRZyfQjCfA3lMXm4Y+5bFnWBFopJOU:8IXwDNmZEvJcscRZzjCI1O5W
MD5 SHA1 SHA512 SSDEEP

Submit Download

240645265.bat

Path C:\Windows\SysWOW64\240645265.bat
Size 51KB
SHA256 3bd74d423ad107e073fba565f7355100edac28a70e0461e0954a1bfeb1fe93b1
MD5 ac63bba2d9223614c632e3ea6d30dc77
SHA1 129331320ec95dae7cb1176e149f280bb55e9e15
SHA512 ba2d13da173549b14f1a60e70da5f237da9e76b5a73d1e9dc09b8bf8512a3fbbafdd35b2a49ab5fe127e3f36a6ab8e2c4c8a85a2a540309e488b2c8e2edfdd83
SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLlJYH5:1dWubF3n9S91BF3fboxJYH5
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchcst.exe

Path C:\Windows\SysWOW64\svchcst.exe
Size 60KB
SHA256 6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
MD5 889b99c52a60dd49227c5e485a016679
SHA1 8fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA512 08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
SSDEEP 1536:H9ykYCTdiHQKrFXmw2RQln5IUmDjoX6+:HlMHprF2nRQln5I
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads