gh0strat | c77b75d8513cd52150726733203b610b4d92706ed3d23023595a646ba97d7b6e

General

Target

c77b75d8513cd52150726733203b610b4d92706ed3d23023595a646ba97d7b6e.exe
Size

2.7MB
MD5

c40474fe985e470add46ab591f5bd293
SHA1

3f6b90f23abc02df259d39ad3b6a5ae5e1e6b51d
SHA256

c77b75d8513cd52150726733203b610b4d92706ed3d23023595a646ba97d7b6e
SHA512

3ed54e6dbf6306205b30278d97db8144b7888a0ceed96628611a790bc59cadd6408d13d9491e3c669c57cb41618970cdc511bd5f73bfcc59d9ccb914e2f06db5
SSDEEP

24576:9YFbkIsaPiXSVnC7Yp9zkNmZG8RRlnsyzeokoliKXL1r2fsnDy2a4b+mL4IoS/bR:9YREXSVMDi3WBob12fp4bSO/mW

Score

10^/10

gh0strat persistence rat upx

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
\Windows\SysWOW64\259402768.bat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

look2.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\svchcst\Parameters\ServiceDll = "C:\\Windows\\system32\\259402768.bat"	look2.exe

Executes dropped EXE 3 IoCs

Processes:

look2.exeHD_c77b75d8513cd52150726733203b610b4d92706ed3d23023595a646ba97d7b6e.exesvchcst.exe

pid process

1916 look2.exe
2704 HD_c77b75d8513cd52150726733203b610b4d92706ed3d23023595a646ba97d7b6e.exe
1020 svchcst.exe

pid	process
1916	look2.exe
2704	HD_c77b75d8513cd52150726733203b610b4d92706ed3d23023595a646ba97d7b6e.exe
1020	svchcst.exe

Loads dropped DLL 7 IoCs

Processes:

c77b75d8513cd52150726733203b610b4d92706ed3d23023595a646ba97d7b6e.exelook2.exesvchost.exesvchcst.exe

pid	process
1832	c77b75d8513cd52150726733203b610b4d92706ed3d23023595a646ba97d7b6e.exe
1916	look2.exe
2568	svchost.exe
1832	c77b75d8513cd52150726733203b610b4d92706ed3d23023595a646ba97d7b6e.exe
1832	c77b75d8513cd52150726733203b610b4d92706ed3d23023595a646ba97d7b6e.exe
2568	svchost.exe
1020	svchcst.exe

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2704-22-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2704-25-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2704-24-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2704-30-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2704-36-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2704-52-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2704-42-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2704-40-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2704-38-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2704-44-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2704-64-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2704-68-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2704-66-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2704-62-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2704-60-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2704-58-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2704-56-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2704-54-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2704-50-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2704-48-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2704-46-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2704-34-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2704-32-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2704-28-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2704-27-0x0000000010000000-0x000000001003E000-memory.dmp	upx

Drops file in System32 directory 4 IoCs

Processes:

look2.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\ini.ini	look2.exe
File created	C:\Windows\SysWOW64\svchcst.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchcst.exe	svchost.exe
File created	C:\Windows\SysWOW64\259402768.bat	look2.exe

Drops file in Program Files directory 1 IoCs

Processes:

c77b75d8513cd52150726733203b610b4d92706ed3d23023595a646ba97d7b6e.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	c77b75d8513cd52150726733203b610b4d92706ed3d23023595a646ba97d7b6e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

c77b75d8513cd52150726733203b610b4d92706ed3d23023595a646ba97d7b6e.exe

pid process

1832 c77b75d8513cd52150726733203b610b4d92706ed3d23023595a646ba97d7b6e.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

HD_c77b75d8513cd52150726733203b610b4d92706ed3d23023595a646ba97d7b6e.exe

pid process

2704 HD_c77b75d8513cd52150726733203b610b4d92706ed3d23023595a646ba97d7b6e.exe

pid	process
2704	HD_c77b75d8513cd52150726733203b610b4d92706ed3d23023595a646ba97d7b6e.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

c77b75d8513cd52150726733203b610b4d92706ed3d23023595a646ba97d7b6e.exeHD_c77b75d8513cd52150726733203b610b4d92706ed3d23023595a646ba97d7b6e.exe

pid	process
1832	c77b75d8513cd52150726733203b610b4d92706ed3d23023595a646ba97d7b6e.exe
1832	c77b75d8513cd52150726733203b610b4d92706ed3d23023595a646ba97d7b6e.exe
2704	HD_c77b75d8513cd52150726733203b610b4d92706ed3d23023595a646ba97d7b6e.exe
2704	HD_c77b75d8513cd52150726733203b610b4d92706ed3d23023595a646ba97d7b6e.exe
2704	HD_c77b75d8513cd52150726733203b610b4d92706ed3d23023595a646ba97d7b6e.exe
2704	HD_c77b75d8513cd52150726733203b610b4d92706ed3d23023595a646ba97d7b6e.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

c77b75d8513cd52150726733203b610b4d92706ed3d23023595a646ba97d7b6e.exesvchost.exe

description	pid	process	target process
PID 1832 wrote to memory of 1916	1832	c77b75d8513cd52150726733203b610b4d92706ed3d23023595a646ba97d7b6e.exe	look2.exe
PID 1832 wrote to memory of 1916	1832	c77b75d8513cd52150726733203b610b4d92706ed3d23023595a646ba97d7b6e.exe	look2.exe
PID 1832 wrote to memory of 1916	1832	c77b75d8513cd52150726733203b610b4d92706ed3d23023595a646ba97d7b6e.exe	look2.exe
PID 1832 wrote to memory of 1916	1832	c77b75d8513cd52150726733203b610b4d92706ed3d23023595a646ba97d7b6e.exe	look2.exe
PID 1832 wrote to memory of 2704	1832	c77b75d8513cd52150726733203b610b4d92706ed3d23023595a646ba97d7b6e.exe	HD_c77b75d8513cd52150726733203b610b4d92706ed3d23023595a646ba97d7b6e.exe
PID 1832 wrote to memory of 2704	1832	c77b75d8513cd52150726733203b610b4d92706ed3d23023595a646ba97d7b6e.exe	HD_c77b75d8513cd52150726733203b610b4d92706ed3d23023595a646ba97d7b6e.exe
PID 1832 wrote to memory of 2704	1832	c77b75d8513cd52150726733203b610b4d92706ed3d23023595a646ba97d7b6e.exe	HD_c77b75d8513cd52150726733203b610b4d92706ed3d23023595a646ba97d7b6e.exe
PID 1832 wrote to memory of 2704	1832	c77b75d8513cd52150726733203b610b4d92706ed3d23023595a646ba97d7b6e.exe	HD_c77b75d8513cd52150726733203b610b4d92706ed3d23023595a646ba97d7b6e.exe
PID 2568 wrote to memory of 1020	2568	svchost.exe	svchcst.exe
PID 2568 wrote to memory of 1020	2568	svchost.exe	svchcst.exe
PID 2568 wrote to memory of 1020	2568	svchost.exe	svchcst.exe
PID 2568 wrote to memory of 1020	2568	svchost.exe	svchcst.exe

C:\Users\Admin\AppData\Local\Temp\c77b75d8513cd52150726733203b610b4d92706ed3d23023595a646ba97d7b6e.exe
"C:\Users\Admin\AppData\Local\Temp\c77b75d8513cd52150726733203b610b4d92706ed3d23023595a646ba97d7b6e.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1832

C:\Users\Admin\AppData\Local\Temp\look2.exe
C:\Users\Admin\AppData\Local\Temp\\look2.exe
2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1916

C:\Users\Admin\AppData\Local\Temp\HD_c77b75d8513cd52150726733203b610b4d92706ed3d23023595a646ba97d7b6e.exe
C:\Users\Admin\AppData\Local\Temp\HD_c77b75d8513cd52150726733203b610b4d92706ed3d23023595a646ba97d7b6e.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2704

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "svchcst"
1⤵
PID:1936

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "svchcst"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2568

C:\Windows\SysWOW64\svchcst.exe
C:\Windows\system32\svchcst.exe "c:\windows\system32\259402768.bat",MainThread
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\HD_X.dat

Filesize
1.2MB

MD5
b3b3547b912cdb3a1b08409090748090

SHA1
3336a4da1c806d77964aa8e772c47758c9cf14ac

SHA256
8dbffef4fd45f4b4a275520a207dc4ec6a8cfc97e4a4ab998340ad9333a133c7

SHA512
34d2c440c71bba09b906193533b366950da3f3a173042a3c033b75c44fef86ecbffc93934490147cece7284730fddb227add47d2a657d8587ff4ee7e195fc880

Download Submit
\Users\Admin\AppData\Local\Temp\HD_c77b75d8513cd52150726733203b610b4d92706ed3d23023595a646ba97d7b6e.exe

Filesize
1.5MB

MD5
5455abc9d60c49810a52eefcb0cb3450

SHA1
7c6f066ade863d6a18434fd297cd0fbd11b5de55

SHA256
f6371554ba97830ba0bb9acd1c3767e681b73cbbbc01c4fe459c2dd8d19a37b9

SHA512
72ea2772a5ab3fc3cfdc8d16926347021dae09bc0aaf77552f4981c1714020c77d31910ee5d298d373e30d7b8c4155117c174f050a4a188b3a9133655e1231a5

Download Submit
\Users\Admin\AppData\Local\Temp\look2.exe

Filesize
337KB

MD5
2f3b6f16e33e28ad75f3fdaef2567807

SHA1
85e907340faf1edfc9210db85a04abd43d21b741

SHA256
86492ebf2d6f471a5ee92977318d099b3ea86175b5b7ae522237ae01d07a4857

SHA512
db17e99e2df918cfc9ccbe934adfe73f0777ce1ce9f28b57a4b24ecd821efe2e0b976a634853247b77b16627d2bb3af4ba20306059d1d25ef38ffada7da3e3a4

Download Submit
\Windows\SysWOW64\259402768.bat

Filesize
51KB

MD5
1e9501d6cf3f7c8b8a268ea299bcd93d

SHA1
3d7e4d9d15926ac77ad459b82ed3de8fe40f6d79

SHA256
9e655cc06a6c8242b174fa9a4b004b95732170452402ee961e4dc09bc6df0406

SHA512
49525813cfdcd47f3ea8da30c2a32468661e5aa01a43de5f71a0d45ef599104956bb47dc7eb0ea7e114c3fcb5aa1d40e0c37051d8e67ff7df70d889ab51e0af5

Download Submit
\Windows\SysWOW64\svchcst.exe

Filesize
43KB

MD5
51138beea3e2c21ec44d0932c71762a8

SHA1
8939cf35447b22dd2c6e6f443446acc1bf986d58

SHA256
5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

SHA512
794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

Download Submit
memory/2704-68-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2704-58-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2704-36-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2704-52-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2704-42-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2704-40-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2704-38-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2704-44-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2704-64-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2704-24-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2704-66-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2704-62-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2704-60-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2704-30-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2704-56-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2704-54-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2704-50-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2704-48-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2704-46-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2704-34-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2704-32-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2704-28-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2704-27-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2704-25-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2704-22-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads