gh0strat | 19a8d873a5f184d1ed79696e87e2a7bbaf30a093850cab2c6e0e4d15bb2744f5

General

Target

19a8d873a5f184d1ed79696e87e2a7bbaf30a093850cab2c6e0e4d15bb2744f5.exe
Size

12.5MB
MD5

7c0d680b9af6aee635f73e6934663f5f
SHA1

63fe70455e5d5a61154f3043552ff53771b28cb9
SHA256

19a8d873a5f184d1ed79696e87e2a7bbaf30a093850cab2c6e0e4d15bb2744f5
SHA512

2a5e0cfd7a764f5eb7799469aa12d7ea5d3bb93755da3a621acde4aecb1e0c7d0330f2e97a6b85cb59192f466dd4207e20fca539d93460999f8f12b0a2a410fd
SSDEEP

196608:7dS+p4QZqMFGkcNYuwPZ/bpo6kxYKURFqIhmdL1qo:ZS+TtGt0zcmKURFq2m

Score

10^/10

gh0strat evasion persistence rat themida trojan

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
C:\Windows\SysWOW64\240612953.bat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

HD_19a8d873a5f184d1ed79696e87e2a7bbaf30a093850cab2c6e0e4d15bb2744f5.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ HD_19a8d873a5f184d1ed79696e87e2a7bbaf30a093850cab2c6e0e4d15bb2744f5.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	HD_19a8d873a5f184d1ed79696e87e2a7bbaf30a093850cab2c6e0e4d15bb2744f5.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

look2.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\svchcst\Parameters\ServiceDll = "C:\\Windows\\system32\\240612953.bat"	look2.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

HD_19a8d873a5f184d1ed79696e87e2a7bbaf30a093850cab2c6e0e4d15bb2744f5.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	HD_19a8d873a5f184d1ed79696e87e2a7bbaf30a093850cab2c6e0e4d15bb2744f5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	HD_19a8d873a5f184d1ed79696e87e2a7bbaf30a093850cab2c6e0e4d15bb2744f5.exe

Executes dropped EXE 3 IoCs

Processes:

look2.exeHD_19a8d873a5f184d1ed79696e87e2a7bbaf30a093850cab2c6e0e4d15bb2744f5.exesvchcst.exe

pid process

2924 look2.exe
740 HD_19a8d873a5f184d1ed79696e87e2a7bbaf30a093850cab2c6e0e4d15bb2744f5.exe
4836 svchcst.exe
Loads dropped DLL 3 IoCs

Processes:

look2.exesvchost.exesvchcst.exe

pid process

2924 look2.exe
1512 svchost.exe
4836 svchcst.exe

pid	process
2924	look2.exe
740	HD_19a8d873a5f184d1ed79696e87e2a7bbaf30a093850cab2c6e0e4d15bb2744f5.exe
4836	svchcst.exe

pid	process
2924	look2.exe
1512	svchost.exe
4836	svchcst.exe

Themida packer 11 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\HD_19a8d873a5f184d1ed79696e87e2a7bbaf30a093850cab2c6e0e4d15bb2744f5.exe	themida
behavioral2/memory/740-19-0x00007FF6F1C20000-0x00007FF6F3329000-memory.dmp	themida
behavioral2/memory/740-18-0x00007FF6F1C20000-0x00007FF6F3329000-memory.dmp	themida
behavioral2/memory/740-21-0x00007FF6F1C20000-0x00007FF6F3329000-memory.dmp	themida
behavioral2/memory/740-20-0x00007FF6F1C20000-0x00007FF6F3329000-memory.dmp	themida
behavioral2/memory/740-22-0x00007FF6F1C20000-0x00007FF6F3329000-memory.dmp	themida
behavioral2/memory/740-23-0x00007FF6F1C20000-0x00007FF6F3329000-memory.dmp	themida
behavioral2/memory/740-24-0x00007FF6F1C20000-0x00007FF6F3329000-memory.dmp	themida
behavioral2/memory/740-25-0x00007FF6F1C20000-0x00007FF6F3329000-memory.dmp	themida
behavioral2/memory/740-26-0x00007FF6F1C20000-0x00007FF6F3329000-memory.dmp	themida
behavioral2/memory/740-43-0x00007FF6F1C20000-0x00007FF6F3329000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

HD_19a8d873a5f184d1ed79696e87e2a7bbaf30a093850cab2c6e0e4d15bb2744f5.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	HD_19a8d873a5f184d1ed79696e87e2a7bbaf30a093850cab2c6e0e4d15bb2744f5.exe

Drops file in System32 directory 4 IoCs

Processes:

svchost.exelook2.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\svchcst.exe	svchost.exe
File created	C:\Windows\SysWOW64\240612953.bat	look2.exe
File opened for modification	C:\Windows\SysWOW64\ini.ini	look2.exe
File created	C:\Windows\SysWOW64\svchcst.exe	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

HD_19a8d873a5f184d1ed79696e87e2a7bbaf30a093850cab2c6e0e4d15bb2744f5.exe

pid process

740 HD_19a8d873a5f184d1ed79696e87e2a7bbaf30a093850cab2c6e0e4d15bb2744f5.exe

pid	process
740	HD_19a8d873a5f184d1ed79696e87e2a7bbaf30a093850cab2c6e0e4d15bb2744f5.exe

Drops file in Program Files directory 1 IoCs

Processes:

19a8d873a5f184d1ed79696e87e2a7bbaf30a093850cab2c6e0e4d15bb2744f5.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	19a8d873a5f184d1ed79696e87e2a7bbaf30a093850cab2c6e0e4d15bb2744f5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

19a8d873a5f184d1ed79696e87e2a7bbaf30a093850cab2c6e0e4d15bb2744f5.exe

pid	process
4268	19a8d873a5f184d1ed79696e87e2a7bbaf30a093850cab2c6e0e4d15bb2744f5.exe
4268	19a8d873a5f184d1ed79696e87e2a7bbaf30a093850cab2c6e0e4d15bb2744f5.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

HD_19a8d873a5f184d1ed79696e87e2a7bbaf30a093850cab2c6e0e4d15bb2744f5.exe

description	pid	process
Token: SeDebugPrivilege	740	HD_19a8d873a5f184d1ed79696e87e2a7bbaf30a093850cab2c6e0e4d15bb2744f5.exe
Token: SeDebugPrivilege	740	HD_19a8d873a5f184d1ed79696e87e2a7bbaf30a093850cab2c6e0e4d15bb2744f5.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

19a8d873a5f184d1ed79696e87e2a7bbaf30a093850cab2c6e0e4d15bb2744f5.exe

pid	process
4268	19a8d873a5f184d1ed79696e87e2a7bbaf30a093850cab2c6e0e4d15bb2744f5.exe
4268	19a8d873a5f184d1ed79696e87e2a7bbaf30a093850cab2c6e0e4d15bb2744f5.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

19a8d873a5f184d1ed79696e87e2a7bbaf30a093850cab2c6e0e4d15bb2744f5.exesvchost.exe

description	pid	process	target process
PID 4268 wrote to memory of 2924	4268	19a8d873a5f184d1ed79696e87e2a7bbaf30a093850cab2c6e0e4d15bb2744f5.exe	look2.exe
PID 4268 wrote to memory of 2924	4268	19a8d873a5f184d1ed79696e87e2a7bbaf30a093850cab2c6e0e4d15bb2744f5.exe	look2.exe
PID 4268 wrote to memory of 2924	4268	19a8d873a5f184d1ed79696e87e2a7bbaf30a093850cab2c6e0e4d15bb2744f5.exe	look2.exe
PID 4268 wrote to memory of 740	4268	19a8d873a5f184d1ed79696e87e2a7bbaf30a093850cab2c6e0e4d15bb2744f5.exe	HD_19a8d873a5f184d1ed79696e87e2a7bbaf30a093850cab2c6e0e4d15bb2744f5.exe
PID 4268 wrote to memory of 740	4268	19a8d873a5f184d1ed79696e87e2a7bbaf30a093850cab2c6e0e4d15bb2744f5.exe	HD_19a8d873a5f184d1ed79696e87e2a7bbaf30a093850cab2c6e0e4d15bb2744f5.exe
PID 1512 wrote to memory of 4836	1512	svchost.exe	svchcst.exe
PID 1512 wrote to memory of 4836	1512	svchost.exe	svchcst.exe
PID 1512 wrote to memory of 4836	1512	svchost.exe	svchcst.exe

C:\Users\Admin\AppData\Local\Temp\19a8d873a5f184d1ed79696e87e2a7bbaf30a093850cab2c6e0e4d15bb2744f5.exe
"C:\Users\Admin\AppData\Local\Temp\19a8d873a5f184d1ed79696e87e2a7bbaf30a093850cab2c6e0e4d15bb2744f5.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4268

C:\Users\Admin\AppData\Local\Temp\look2.exe
C:\Users\Admin\AppData\Local\Temp\\look2.exe
2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2924

C:\Users\Admin\AppData\Local\Temp\HD_19a8d873a5f184d1ed79696e87e2a7bbaf30a093850cab2c6e0e4d15bb2744f5.exe
C:\Users\Admin\AppData\Local\Temp\HD_19a8d873a5f184d1ed79696e87e2a7bbaf30a093850cab2c6e0e4d15bb2744f5.exe
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:740

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "svchcst"
1⤵
PID:4600

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "svchcst"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1512

C:\Windows\SysWOW64\svchcst.exe
C:\Windows\system32\svchcst.exe "c:\windows\system32\240612953.bat",MainThread
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\HD_19a8d873a5f184d1ed79696e87e2a7bbaf30a093850cab2c6e0e4d15bb2744f5.exe
Filesize
11.2MB

MD5
9d61a1123b883ec9ec99f964a3c65894

SHA1
5b1cdbd922a0228a5730c014cee5e6e2bf0bfb9d

SHA256
866a939d49076745564be9138dfb4eef9117e615b36d3381d63258c142f32e0e

SHA512
b7fbc2c827ee9e9631859f94247d46ec2ef739157d2bd67c0272d9061f5ac2e9fe2123158447a9b73f8f7bd21696573b9488c4cda941775331e2aa1db694a2aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\HD_X.dat
Filesize
1.3MB

MD5
55e982207fbdaf7adc0abd88ae6374a3

SHA1
c2a19282affac38663120b0737361943792cf0b8

SHA256
93aab9b8915062b7485e525f3a1dde095cb9ecde795bbb5cadeacc0678305518

SHA512
d24a869abb15653e26bc0ed76befd9b84b7700b0949ef2cf8997f661fc6e7f83c9ad468c70bc5069bcecfb36a4ce5d9dfaab4b75ab1327e6ecbaddb279c308e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\look2.exe
Filesize
337KB

MD5
fb66e1e31fa1e6dfb21a50ccd11e0409

SHA1
6c45a0a115ec896eb14a531a44809b2a22cf8934

SHA256
5ea8c5455f0ebe884ed98834e78ead8b6c68814bbb1723370299fa44b88c0faa

SHA512
58ee149f70438296a67d5ae5cbd6cb9f5b2510a0381466b8f09eec3835be1ce7cad6903ca8fbc9273105132e85952208e78c59f776416c5449b86cc62111154b

Download Submit
C:\Windows\SysWOW64\240612953.bat
Filesize
51KB

MD5
3b2a14629805646b26cfe13552fde8b8

SHA1
186f7bf20483854d1bd56cca470385cd0ca14c4c

SHA256
3e108aa0d6491c729db7fc5438d2fb8f443c72e3ba5bd8f71f73681a1f3e27ff

SHA512
706f1a14aea0c1b4c8f8ee79c7fb5c74d8800665dc87192295c47b252cb359dae4a9e9b9c2ce0af7da722c5f557bafdd1c6207a67d0cdebd74add7e25a02b6b1

Download Submit
C:\Windows\SysWOW64\svchcst.exe
Filesize
60KB

MD5
889b99c52a60dd49227c5e485a016679

SHA1
8fa889e456aa646a4d0a4349977430ce5fa5e2d7

SHA256
6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910

SHA512
08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641

Download Submit
memory/740-20-0x00007FF6F1C20000-0x00007FF6F3329000-memory.dmp

Filesize
23.0MB

Download
memory/740-21-0x00007FF6F1C20000-0x00007FF6F3329000-memory.dmp

Filesize
23.0MB

Download
memory/740-22-0x00007FF6F1C20000-0x00007FF6F3329000-memory.dmp

Filesize
23.0MB

Download
memory/740-23-0x00007FF6F1C20000-0x00007FF6F3329000-memory.dmp

Filesize
23.0MB

Download
memory/740-24-0x00007FF6F1C20000-0x00007FF6F3329000-memory.dmp

Filesize
23.0MB

Download
memory/740-25-0x00007FF6F1C20000-0x00007FF6F3329000-memory.dmp

Filesize
23.0MB

Download
memory/740-26-0x00007FF6F1C20000-0x00007FF6F3329000-memory.dmp

Filesize
23.0MB

Download
memory/740-18-0x00007FF6F1C20000-0x00007FF6F3329000-memory.dmp

Filesize
23.0MB

Download
memory/740-19-0x00007FF6F1C20000-0x00007FF6F3329000-memory.dmp

Filesize
23.0MB

Download
memory/740-43-0x00007FF6F1C20000-0x00007FF6F3329000-memory.dmp

Filesize
23.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads