gh0strat | 04e5c9467245df7b1beb4a2646d038e2320147f035fc18629adfb32b4da76ef1

General

Target

04e5c9467245df7b1beb4a2646d038e2320147f035fc18629adfb32b4da76ef1.exe
Size

60KB
MD5

1adcf48a05e66c1102e4fb1974e9bbe4
SHA1

e0d9bebb3db9e22ef4693dfb2bc7f337fbbd1d59
SHA256

04e5c9467245df7b1beb4a2646d038e2320147f035fc18629adfb32b4da76ef1
SHA512

c55d3f78a26a3e7e20b5aa030ae64ba39c5dae77abd3b31d2a9374b8acfbbaf8ba5b52f43e250b595be16de5ca7568f160edcfcc15e5df3cfe0d4c6767fe11b3
SSDEEP

768:3e1iZNbQAKrWGOkGQeN70ZqL37JMKBBmbUt4i:36iZNer5GQvk+ath

Score

10^/10

Malware Config

Signatures

Gh0st RAT payload 9 IoCs

resource	yara_rule
behavioral1/memory/2312-8-0x0000000010000000-0x000000001034B000-memory.dmp	family_gh0strat
behavioral1/memory/2312-10-0x0000000010000000-0x000000001034B000-memory.dmp	family_gh0strat
behavioral1/memory/2312-9-0x0000000010000000-0x000000001034B000-memory.dmp	family_gh0strat
behavioral1/memory/2312-11-0x0000000010000000-0x000000001034B000-memory.dmp	family_gh0strat
behavioral1/memory/2900-27-0x0000000010000000-0x000000001034B000-memory.dmp	family_gh0strat
behavioral1/memory/2900-26-0x0000000010000000-0x000000001034B000-memory.dmp	family_gh0strat
behavioral1/memory/2900-25-0x0000000010000000-0x000000001034B000-memory.dmp	family_gh0strat
behavioral1/memory/2868-34-0x0000000010000000-0x000000001034B000-memory.dmp	family_gh0strat
behavioral1/memory/2868-45-0x0000000010000000-0x000000001034B000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Deletes itself 1 IoCs

pid	Process
2596	conhosstdhlvse.exe

Executes dropped EXE 3 IoCs

pid	Process
2900	conhosstdhlvse.exe
2868	conhosstdhlvse.exe
2596	conhosstdhlvse.exe

Loads dropped DLL 5 IoCs

pid	Process
2312	04e5c9467245df7b1beb4a2646d038e2320147f035fc18629adfb32b4da76ef1.exe
2312	04e5c9467245df7b1beb4a2646d038e2320147f035fc18629adfb32b4da76ef1.exe
2868	conhosstdhlvse.exe
2784	WerFault.exe
2784	WerFault.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2312-8-0x0000000010000000-0x000000001034B000-memory.dmp	upx
behavioral1/memory/2312-5-0x0000000010000000-0x000000001034B000-memory.dmp	upx
behavioral1/memory/2312-10-0x0000000010000000-0x000000001034B000-memory.dmp	upx
behavioral1/memory/2312-9-0x0000000010000000-0x000000001034B000-memory.dmp	upx
behavioral1/memory/2312-11-0x0000000010000000-0x000000001034B000-memory.dmp	upx
behavioral1/memory/2900-27-0x0000000010000000-0x000000001034B000-memory.dmp	upx
behavioral1/memory/2900-26-0x0000000010000000-0x000000001034B000-memory.dmp	upx
behavioral1/memory/2900-22-0x0000000010000000-0x000000001034B000-memory.dmp	upx
behavioral1/memory/2900-25-0x0000000010000000-0x000000001034B000-memory.dmp	upx
behavioral1/memory/2868-34-0x0000000010000000-0x000000001034B000-memory.dmp	upx
behavioral1/memory/2868-45-0x0000000010000000-0x000000001034B000-memory.dmp	upx

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\AppPatch\8.77.dll	04e5c9467245df7b1beb4a2646d038e2320147f035fc18629adfb32b4da76ef1.exe
File created	C:\Program Files (x86)\Windows NT\conhosstdhlvse.exe	04e5c9467245df7b1beb4a2646d038e2320147f035fc18629adfb32b4da76ef1.exe
File opened for modification	C:\Program Files (x86)\Windows NT\conhosstdhlvse.exe	04e5c9467245df7b1beb4a2646d038e2320147f035fc18629adfb32b4da76ef1.exe
File created	C:\Program Files\AppPatch\8.77.dll	04e5c9467245df7b1beb4a2646d038e2320147f035fc18629adfb32b4da76ef1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2784	2868	WerFault.exe	30

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2868	conhosstdhlvse.exe
Token: SeDebugPrivilege	2596	conhosstdhlvse.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 2900	2312	04e5c9467245df7b1beb4a2646d038e2320147f035fc18629adfb32b4da76ef1.exe	29
PID 2312 wrote to memory of 2900	2312	04e5c9467245df7b1beb4a2646d038e2320147f035fc18629adfb32b4da76ef1.exe	29
PID 2312 wrote to memory of 2900	2312	04e5c9467245df7b1beb4a2646d038e2320147f035fc18629adfb32b4da76ef1.exe	29
PID 2312 wrote to memory of 2900	2312	04e5c9467245df7b1beb4a2646d038e2320147f035fc18629adfb32b4da76ef1.exe	29
PID 2868 wrote to memory of 2596	2868	conhosstdhlvse.exe	31
PID 2868 wrote to memory of 2596	2868	conhosstdhlvse.exe	31
PID 2868 wrote to memory of 2596	2868	conhosstdhlvse.exe	31
PID 2868 wrote to memory of 2596	2868	conhosstdhlvse.exe	31
PID 2868 wrote to memory of 2784	2868	conhosstdhlvse.exe	32
PID 2868 wrote to memory of 2784	2868	conhosstdhlvse.exe	32
PID 2868 wrote to memory of 2784	2868	conhosstdhlvse.exe	32
PID 2868 wrote to memory of 2784	2868	conhosstdhlvse.exe	32

C:\Users\Admin\AppData\Local\Temp\04e5c9467245df7b1beb4a2646d038e2320147f035fc18629adfb32b4da76ef1.exe
"C:\Users\Admin\AppData\Local\Temp\04e5c9467245df7b1beb4a2646d038e2320147f035fc18629adfb32b4da76ef1.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Program Files (x86)\Windows NT\conhosstdhlvse.exe
  "C:\Program Files (x86)\Windows NT\conhosstdhlvse.exe"
  2⤵
  - Executes dropped EXE
  PID:2900

C:\Program Files (x86)\Windows NT\conhosstdhlvse.exe
"C:\Program Files (x86)\Windows NT\conhosstdhlvse.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Program Files (x86)\Windows NT\conhosstdhlvse.exe
  "C:\Program Files (x86)\Windows NT\conhosstdhlvse.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2596
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 344
  2⤵
  - Loads dropped DLL
  - Program crash
  PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\AppPatch\8.77.dll

Filesize
240KB

MD5
0a74e0bffbce3cc5466796739cfdeb44

SHA1
c3b50df0a1de18b7053bff1b0293f5512f824055

SHA256
cdabc33a27b23c2060637193a4cbad94e16d31e6a4df7d67bdc6b63c1d056b30

SHA512
9fb4f39d95820f63da2d8767b76f317c512a8db1b86428f04baf4b163d0deaee5c4726c9f66807a3b1c223d575557fabc88e0cde73a4561b304f6edd76b8cc36

Download Submit
\Program Files (x86)\Windows NT\conhosstdhlvse.exe

Filesize
60KB

MD5
1adcf48a05e66c1102e4fb1974e9bbe4

SHA1
e0d9bebb3db9e22ef4693dfb2bc7f337fbbd1d59

SHA256
04e5c9467245df7b1beb4a2646d038e2320147f035fc18629adfb32b4da76ef1

SHA512
c55d3f78a26a3e7e20b5aa030ae64ba39c5dae77abd3b31d2a9374b8acfbbaf8ba5b52f43e250b595be16de5ca7568f160edcfcc15e5df3cfe0d4c6767fe11b3

Download Submit
memory/2312-10-0x0000000010000000-0x000000001034B000-memory.dmp

Filesize
3.3MB

Download
memory/2312-5-0x0000000010000000-0x000000001034B000-memory.dmp

Filesize
3.3MB

Download
memory/2312-9-0x0000000010000000-0x000000001034B000-memory.dmp

Filesize
3.3MB

Download
memory/2312-11-0x0000000010000000-0x000000001034B000-memory.dmp

Filesize
3.3MB

Download
memory/2312-8-0x0000000010000000-0x000000001034B000-memory.dmp

Filesize
3.3MB

Download
memory/2868-34-0x0000000010000000-0x000000001034B000-memory.dmp

Filesize
3.3MB

Download
memory/2868-45-0x0000000010000000-0x000000001034B000-memory.dmp

Filesize
3.3MB

Download
memory/2900-27-0x0000000010000000-0x000000001034B000-memory.dmp

Filesize
3.3MB

Download
memory/2900-26-0x0000000010000000-0x000000001034B000-memory.dmp

Filesize
3.3MB

Download
memory/2900-22-0x0000000010000000-0x000000001034B000-memory.dmp

Filesize
3.3MB

Download
memory/2900-25-0x0000000010000000-0x000000001034B000-memory.dmp

Filesize
3.3MB

Download

Analysis

Sharing