gh0strat | c1da3965e1a475fb5595b88dc31c6494a14ae5b8c9d4344aa861da8f43dd5dd0

General

Target

c1da3965e1a475fb5595b88dc31c6494a14ae5b8c9d4344aa861da8f43dd5dd0.exe
Size

15.8MB
MD5

9c77a6f2db29a27a94c86e6e0287edff
SHA1

a0e214d451c674ae655686139acc90b41ace5688
SHA256

c1da3965e1a475fb5595b88dc31c6494a14ae5b8c9d4344aa861da8f43dd5dd0
SHA512

9a6cec14997f77ccfa4681e69686bf6c7aef6d062cc972988f168249a4f2fc15cdc68fac5ae3fa0a76fe5f346a9a0b246d2dda775eea4e92ff7dee62a48e7fb0
SSDEEP

196608:PpR42HdZR1KCRK1Fdbqj8c4nRNZsxHJ5ayTTkpcDDeEIZs:342HdZR1KCRK1LbqQdnRNSxH9nnKtZs

Score

10^/10

gh0strat persistence rat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
\Windows\SysWOW64\259391957.bat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

look2.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\svchcst\Parameters\ServiceDll = "C:\\Windows\\system32\\259391957.bat"	look2.exe

Executes dropped EXE 3 IoCs

Processes:

look2.exeHD_c1da3965e1a475fb5595b88dc31c6494a14ae5b8c9d4344aa861da8f43dd5dd0.exesvchcst.exe

pid process

2688 look2.exe
2552 HD_c1da3965e1a475fb5595b88dc31c6494a14ae5b8c9d4344aa861da8f43dd5dd0.exe
2636 svchcst.exe

pid	process
2688	look2.exe
2552	HD_c1da3965e1a475fb5595b88dc31c6494a14ae5b8c9d4344aa861da8f43dd5dd0.exe
2636	svchcst.exe

Loads dropped DLL 6 IoCs

Processes:

c1da3965e1a475fb5595b88dc31c6494a14ae5b8c9d4344aa861da8f43dd5dd0.exelook2.exesvchost.exesvchcst.exe

pid	process
2276	c1da3965e1a475fb5595b88dc31c6494a14ae5b8c9d4344aa861da8f43dd5dd0.exe
2688	look2.exe
2480	svchost.exe
2276	c1da3965e1a475fb5595b88dc31c6494a14ae5b8c9d4344aa861da8f43dd5dd0.exe
2480	svchost.exe
2636	svchcst.exe

Drops file in System32 directory 4 IoCs

Processes:

look2.exesvchost.exe

description	ioc	process
File created	C:\Windows\SysWOW64\259391957.bat	look2.exe
File opened for modification	C:\Windows\SysWOW64\ini.ini	look2.exe
File created	C:\Windows\SysWOW64\svchcst.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchcst.exe	svchost.exe

Drops file in Program Files directory 1 IoCs

Processes:

c1da3965e1a475fb5595b88dc31c6494a14ae5b8c9d4344aa861da8f43dd5dd0.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	c1da3965e1a475fb5595b88dc31c6494a14ae5b8c9d4344aa861da8f43dd5dd0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

c1da3965e1a475fb5595b88dc31c6494a14ae5b8c9d4344aa861da8f43dd5dd0.exe

pid process

2276 c1da3965e1a475fb5595b88dc31c6494a14ae5b8c9d4344aa861da8f43dd5dd0.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

c1da3965e1a475fb5595b88dc31c6494a14ae5b8c9d4344aa861da8f43dd5dd0.exe

pid	process
2276	c1da3965e1a475fb5595b88dc31c6494a14ae5b8c9d4344aa861da8f43dd5dd0.exe
2276	c1da3965e1a475fb5595b88dc31c6494a14ae5b8c9d4344aa861da8f43dd5dd0.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

c1da3965e1a475fb5595b88dc31c6494a14ae5b8c9d4344aa861da8f43dd5dd0.exesvchost.exe

description	pid	process	target process
PID 2276 wrote to memory of 2688	2276	c1da3965e1a475fb5595b88dc31c6494a14ae5b8c9d4344aa861da8f43dd5dd0.exe	look2.exe
PID 2276 wrote to memory of 2688	2276	c1da3965e1a475fb5595b88dc31c6494a14ae5b8c9d4344aa861da8f43dd5dd0.exe	look2.exe
PID 2276 wrote to memory of 2688	2276	c1da3965e1a475fb5595b88dc31c6494a14ae5b8c9d4344aa861da8f43dd5dd0.exe	look2.exe
PID 2276 wrote to memory of 2688	2276	c1da3965e1a475fb5595b88dc31c6494a14ae5b8c9d4344aa861da8f43dd5dd0.exe	look2.exe
PID 2276 wrote to memory of 2552	2276	c1da3965e1a475fb5595b88dc31c6494a14ae5b8c9d4344aa861da8f43dd5dd0.exe	HD_c1da3965e1a475fb5595b88dc31c6494a14ae5b8c9d4344aa861da8f43dd5dd0.exe
PID 2276 wrote to memory of 2552	2276	c1da3965e1a475fb5595b88dc31c6494a14ae5b8c9d4344aa861da8f43dd5dd0.exe	HD_c1da3965e1a475fb5595b88dc31c6494a14ae5b8c9d4344aa861da8f43dd5dd0.exe
PID 2276 wrote to memory of 2552	2276	c1da3965e1a475fb5595b88dc31c6494a14ae5b8c9d4344aa861da8f43dd5dd0.exe	HD_c1da3965e1a475fb5595b88dc31c6494a14ae5b8c9d4344aa861da8f43dd5dd0.exe
PID 2276 wrote to memory of 2552	2276	c1da3965e1a475fb5595b88dc31c6494a14ae5b8c9d4344aa861da8f43dd5dd0.exe	HD_c1da3965e1a475fb5595b88dc31c6494a14ae5b8c9d4344aa861da8f43dd5dd0.exe
PID 2480 wrote to memory of 2636	2480	svchost.exe	svchcst.exe
PID 2480 wrote to memory of 2636	2480	svchost.exe	svchcst.exe
PID 2480 wrote to memory of 2636	2480	svchost.exe	svchcst.exe
PID 2480 wrote to memory of 2636	2480	svchost.exe	svchcst.exe

C:\Users\Admin\AppData\Local\Temp\c1da3965e1a475fb5595b88dc31c6494a14ae5b8c9d4344aa861da8f43dd5dd0.exe
"C:\Users\Admin\AppData\Local\Temp\c1da3965e1a475fb5595b88dc31c6494a14ae5b8c9d4344aa861da8f43dd5dd0.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Users\Admin\AppData\Local\Temp\look2.exe
  C:\Users\Admin\AppData\Local\Temp\\look2.exe
  2⤵
  - Sets DLL path for service in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  PID:2688
- C:\Users\Admin\AppData\Local\Temp\HD_c1da3965e1a475fb5595b88dc31c6494a14ae5b8c9d4344aa861da8f43dd5dd0.exe
  C:\Users\Admin\AppData\Local\Temp\HD_c1da3965e1a475fb5595b88dc31c6494a14ae5b8c9d4344aa861da8f43dd5dd0.exe
  2⤵
  - Executes dropped EXE
  PID:2552

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "svchcst"
1⤵
PID:1936

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "svchcst"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\SysWOW64\svchcst.exe
  C:\Windows\system32\svchcst.exe "c:\windows\system32\259391957.bat",MainThread
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\HD_X.dat

Filesize
1.2MB

MD5
f34def4d397967618848f2722b0232e9

SHA1
a916aa31487bb8a3a14bce6c3f0ccfe14e30dc80

SHA256
a98dfa864f753685293c7e3365a4beec35046d878c65728ea3905e172fd17a22

SHA512
b4ab110ba41b6ff6ebd9845d1d916cd79b4a1666df40b8aa6fc011b74c8c337d89b538010438a7ce95bf2a2e62ded32a560a47731779f1a98d4c1c0d34ac427a

Download Submit
\Users\Admin\AppData\Local\Temp\HD_c1da3965e1a475fb5595b88dc31c6494a14ae5b8c9d4344aa861da8f43dd5dd0.exe

Filesize
14.7MB

MD5
ba711f573918fab161b00b6bb882a069

SHA1
40891d9daa23a48b00105af25df5ddeb5b1f93ea

SHA256
3383f24610d5ceb58d493a978da69c6b9882fab3ac59a802a965de91deaba767

SHA512
b0e7a1b058d21cd7a51d713fea3645d0df87e02ab0a2f3e756b82b03ff5a82cd8b5246685caddd6bac976ac96ba2f63f055b20735439d8eea03c3f6219ebe698

Download Submit
\Users\Admin\AppData\Local\Temp\look2.exe

Filesize
337KB

MD5
2f3b6f16e33e28ad75f3fdaef2567807

SHA1
85e907340faf1edfc9210db85a04abd43d21b741

SHA256
86492ebf2d6f471a5ee92977318d099b3ea86175b5b7ae522237ae01d07a4857

SHA512
db17e99e2df918cfc9ccbe934adfe73f0777ce1ce9f28b57a4b24ecd821efe2e0b976a634853247b77b16627d2bb3af4ba20306059d1d25ef38ffada7da3e3a4

Download Submit
\Windows\SysWOW64\259391957.bat

Filesize
51KB

MD5
befa20efe7ead8c5dd5b226cf1d9ad10

SHA1
7b878321fee5671ece43a67145f37bb3e14d3228

SHA256
8c591a1d16ee784e4055a4e6064af3c93e6259348ccbcea96e0a4291e406626b

SHA512
886618941a124305c1775dd7fdf2d57acdaab17c20e661a5f386d000e16236135510e88e53d72c6f7353bab4ec005b57f982f57f9f175297a8e011466c559c2a

Download Submit
\Windows\SysWOW64\svchcst.exe

Filesize
43KB

MD5
51138beea3e2c21ec44d0932c71762a8

SHA1
8939cf35447b22dd2c6e6f443446acc1bf986d58

SHA256
5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

SHA512
794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads