gh0strat | 400c21db6ff02e528660b5c5e2b033468df4ec1a68f76c6da8619fe063de8569

General

Target

400c21db6ff02e528660b5c5e2b033468df4ec1a68f76c6da8619fe063de8569.exe
Size

1.5MB
MD5

a4b652bb19b8c64bce97d0c118656017
SHA1

1e8c7e0814d5d6a9e3bfc2d80eff6eb30bddff0a
SHA256

400c21db6ff02e528660b5c5e2b033468df4ec1a68f76c6da8619fe063de8569
SHA512

c62bc076b86a14dde2c295ee1af948141371b57cc7b6d9727bd351f05d4f42f3e52ea8ee7b4bd9435deed52c5054b32c20654bac8ce85a613ecb85e0609b3764
SSDEEP

49152:KYREXSVMDi3OgEnoSE5SavrtMgEnoSE5:/2SVMD8OgEnoSE5Sa5MgEnoSE5

Score

10^/10

gh0strat persistence rat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
C:\Windows\SysWOW64\240631453.bat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

look2.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\svchcst\Parameters\ServiceDll = "C:\\Windows\\system32\\240631453.bat"	look2.exe

Executes dropped EXE 3 IoCs

Processes:

look2.exeHD_400c21db6ff02e528660b5c5e2b033468df4ec1a68f76c6da8619fe063de8569.exesvchcst.exe

pid process

2360 look2.exe
2152 HD_400c21db6ff02e528660b5c5e2b033468df4ec1a68f76c6da8619fe063de8569.exe
2460 svchcst.exe
Loads dropped DLL 3 IoCs

Processes:

look2.exesvchost.exesvchcst.exe

pid process

2360 look2.exe
1652 svchost.exe
2460 svchcst.exe

pid	process
2360	look2.exe
2152	HD_400c21db6ff02e528660b5c5e2b033468df4ec1a68f76c6da8619fe063de8569.exe
2460	svchcst.exe

pid	process
2360	look2.exe
1652	svchost.exe
2460	svchcst.exe

Drops file in System32 directory 4 IoCs

Processes:

look2.exesvchost.exe

description	ioc	process
File created	C:\Windows\SysWOW64\240631453.bat	look2.exe
File opened for modification	C:\Windows\SysWOW64\ini.ini	look2.exe
File created	C:\Windows\SysWOW64\svchcst.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchcst.exe	svchost.exe

Drops file in Program Files directory 1 IoCs

Processes:

400c21db6ff02e528660b5c5e2b033468df4ec1a68f76c6da8619fe063de8569.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	400c21db6ff02e528660b5c5e2b033468df4ec1a68f76c6da8619fe063de8569.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

400c21db6ff02e528660b5c5e2b033468df4ec1a68f76c6da8619fe063de8569.exe

pid	process
4060	400c21db6ff02e528660b5c5e2b033468df4ec1a68f76c6da8619fe063de8569.exe
4060	400c21db6ff02e528660b5c5e2b033468df4ec1a68f76c6da8619fe063de8569.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

400c21db6ff02e528660b5c5e2b033468df4ec1a68f76c6da8619fe063de8569.exe

pid	process
4060	400c21db6ff02e528660b5c5e2b033468df4ec1a68f76c6da8619fe063de8569.exe
4060	400c21db6ff02e528660b5c5e2b033468df4ec1a68f76c6da8619fe063de8569.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

400c21db6ff02e528660b5c5e2b033468df4ec1a68f76c6da8619fe063de8569.exesvchost.exe

description	pid	process	target process
PID 4060 wrote to memory of 2360	4060	400c21db6ff02e528660b5c5e2b033468df4ec1a68f76c6da8619fe063de8569.exe	look2.exe
PID 4060 wrote to memory of 2360	4060	400c21db6ff02e528660b5c5e2b033468df4ec1a68f76c6da8619fe063de8569.exe	look2.exe
PID 4060 wrote to memory of 2360	4060	400c21db6ff02e528660b5c5e2b033468df4ec1a68f76c6da8619fe063de8569.exe	look2.exe
PID 4060 wrote to memory of 2152	4060	400c21db6ff02e528660b5c5e2b033468df4ec1a68f76c6da8619fe063de8569.exe	HD_400c21db6ff02e528660b5c5e2b033468df4ec1a68f76c6da8619fe063de8569.exe
PID 4060 wrote to memory of 2152	4060	400c21db6ff02e528660b5c5e2b033468df4ec1a68f76c6da8619fe063de8569.exe	HD_400c21db6ff02e528660b5c5e2b033468df4ec1a68f76c6da8619fe063de8569.exe
PID 4060 wrote to memory of 2152	4060	400c21db6ff02e528660b5c5e2b033468df4ec1a68f76c6da8619fe063de8569.exe	HD_400c21db6ff02e528660b5c5e2b033468df4ec1a68f76c6da8619fe063de8569.exe
PID 1652 wrote to memory of 2460	1652	svchost.exe	svchcst.exe
PID 1652 wrote to memory of 2460	1652	svchost.exe	svchcst.exe
PID 1652 wrote to memory of 2460	1652	svchost.exe	svchcst.exe

C:\Users\Admin\AppData\Local\Temp\400c21db6ff02e528660b5c5e2b033468df4ec1a68f76c6da8619fe063de8569.exe
"C:\Users\Admin\AppData\Local\Temp\400c21db6ff02e528660b5c5e2b033468df4ec1a68f76c6da8619fe063de8569.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4060

C:\Users\Admin\AppData\Local\Temp\look2.exe
C:\Users\Admin\AppData\Local\Temp\\look2.exe
2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2360

C:\Users\Admin\AppData\Local\Temp\HD_400c21db6ff02e528660b5c5e2b033468df4ec1a68f76c6da8619fe063de8569.exe
C:\Users\Admin\AppData\Local\Temp\HD_400c21db6ff02e528660b5c5e2b033468df4ec1a68f76c6da8619fe063de8569.exe
2⤵
- Executes dropped EXE
PID:2152

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "svchcst"
1⤵
PID:3768

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "svchcst"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1652

C:\Windows\SysWOW64\svchcst.exe
C:\Windows\system32\svchcst.exe "c:\windows\system32\240631453.bat",MainThread
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
1⤵
PID:4228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\HD_400c21db6ff02e528660b5c5e2b033468df4ec1a68f76c6da8619fe063de8569.exe
Filesize
363KB

MD5
0fa859e1b115bb88ea35bf65077e97af

SHA1
75f2f3e46b059f5f4bfefb62970e6c6a9c91075f

SHA256
37bb7ba2590773884017988b6a0eb3ebb1a24f2add9781805af98699d3d0c50a

SHA512
31956e2c7bd08dd5804b3267f58336881fbdabe8b778c63d4a8d7a144b08465560d755838638ea46cd5378a1e97ca85ba3d56d5dafe0445c27dd97e8d26b4761

Download Submit
C:\Users\Admin\AppData\Local\Temp\HD_X.dat
Filesize
1.2MB

MD5
ee541b99f9f160d2714f39db2a39ee21

SHA1
be1dadc562831116701174b586524beb63b44c04

SHA256
23049cfdc6c0256c7637001634a3635b583a3a34c08491c3d65083b98aac05fd

SHA512
187476add0620994594d5419f728b9278eb561a0b4d7f762edfd254bb02d5d47e8ef8a2efc77c13ad5de267bee46cf62d9f335a04a8ef861b7b390a470c30d87

Download Submit
C:\Users\Admin\AppData\Local\Temp\look2.exe
Filesize
337KB

MD5
2f3b6f16e33e28ad75f3fdaef2567807

SHA1
85e907340faf1edfc9210db85a04abd43d21b741

SHA256
86492ebf2d6f471a5ee92977318d099b3ea86175b5b7ae522237ae01d07a4857

SHA512
db17e99e2df918cfc9ccbe934adfe73f0777ce1ce9f28b57a4b24ecd821efe2e0b976a634853247b77b16627d2bb3af4ba20306059d1d25ef38ffada7da3e3a4

Download Submit
C:\Windows\SysWOW64\240631453.bat
Filesize
51KB

MD5
ac0eead69d82bf2a697ca41d66590721

SHA1
c3ce96e3fa0d0f3e5801a83aa3c15e6a9974718e

SHA256
e3d8cca7d295092183ceb58c0dacc4ba3147b690578999b2233c908a2a61e1c4

SHA512
09275de5dba6c641b9f4c0570edf26ce311798b0ea6071f34ee4990d613818beffdffdfc780bf7f7aae4e473345166d654c3828d9d6edfc18811accc626065a4

Download Submit
C:\Windows\SysWOW64\svchcst.exe
Filesize
60KB

MD5
889b99c52a60dd49227c5e485a016679

SHA1
8fa889e456aa646a4d0a4349977430ce5fa5e2d7

SHA256
6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910

SHA512
08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads