gh0strat | ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83

General

Target

ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe
Size

2.0MB
MD5

faf7531daa171ca31f2502e994266f13
SHA1

89e44b9ea36229c7e52964647eea067f38b2745f
SHA256

ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83
SHA512

8a741d93b5b59262570c33ef4852e670566b726074111a9b7edbf55d83f2abb9693627eba99892c9dea260727338c604ab0efcf1ca0a548181260357ad06afb6
SSDEEP

49152:rYREXSVMDi36dWDPmBmx6++Y0NQ3dvIsagdF:E2SVMD86dju7l0mqjgdF

Score

10^/10

gh0strat bootkit discovery persistence rat spyware stealer upx

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
\Windows\SysWOW64\259488584.bat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

Processes:

look2.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\svchcst\Parameters\ServiceDll = "C:\\Windows\\system32\\259488584.bat"	look2.exe

Executes dropped EXE 3 IoCs

Processes:

look2.exeHD_ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exesvchcst.exe

pid process

2540 look2.exe
2900 HD_ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe
1668 svchcst.exe

pid	process
2540	look2.exe
2900	HD_ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe
1668	svchcst.exe

Loads dropped DLL 6 IoCs

Processes:

ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exelook2.exesvchost.exesvchcst.exe

pid	process
2744	ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe
2540	look2.exe
1780	svchost.exe
2744	ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe
1780	svchost.exe
1668	svchcst.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

HD_ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe

description ioc process

File opened for modification \??\PhysicalDrive0 HD_ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	HD_ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe

Drops file in System32 directory 4 IoCs

Processes:

look2.exesvchost.exe

description	ioc	process
File created	C:\Windows\SysWOW64\259488584.bat	look2.exe
File opened for modification	C:\Windows\SysWOW64\ini.ini	look2.exe
File created	C:\Windows\SysWOW64\svchcst.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchcst.exe	svchost.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\HD_ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe	upx
behavioral1/memory/2900-34-0x0000000000400000-0x00000000005AC000-memory.dmp	upx
behavioral1/memory/2900-214-0x0000000000400000-0x00000000005AC000-memory.dmp	upx
behavioral1/memory/2900-226-0x0000000000400000-0x00000000005AC000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

Processes:

ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

HD_ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exesvchcst.exeae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exelook2.exesvchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HD_ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	look2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

HD_ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	HD_ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exeHD_ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe

pid	process
2744	ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe
2900	HD_ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe
2900	HD_ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe
2900	HD_ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe
2900	HD_ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe
2900	HD_ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe
2900	HD_ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe
2900	HD_ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe
2900	HD_ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe
2900	HD_ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe
2900	HD_ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe
2900	HD_ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe
2900	HD_ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

HD_ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe

description	pid	process
Token: 33	2900	HD_ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe
Token: SeIncBasePriorityPrivilege	2900	HD_ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exeHD_ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe

pid	process
2744	ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe
2744	ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe
2900	HD_ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe
2900	HD_ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe
2900	HD_ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe
2900	HD_ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exesvchost.exe

description	pid	process	target process
PID 2744 wrote to memory of 2540	2744	ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe	look2.exe
PID 2744 wrote to memory of 2540	2744	ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe	look2.exe
PID 2744 wrote to memory of 2540	2744	ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe	look2.exe
PID 2744 wrote to memory of 2540	2744	ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe	look2.exe
PID 2744 wrote to memory of 2900	2744	ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe	HD_ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe
PID 2744 wrote to memory of 2900	2744	ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe	HD_ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe
PID 2744 wrote to memory of 2900	2744	ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe	HD_ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe
PID 2744 wrote to memory of 2900	2744	ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe	HD_ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe
PID 1780 wrote to memory of 1668	1780	svchost.exe	svchcst.exe
PID 1780 wrote to memory of 1668	1780	svchost.exe	svchcst.exe
PID 1780 wrote to memory of 1668	1780	svchost.exe	svchcst.exe
PID 1780 wrote to memory of 1668	1780	svchost.exe	svchcst.exe

C:\Users\Admin\AppData\Local\Temp\ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe
"C:\Users\Admin\AppData\Local\Temp\ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Users\Admin\AppData\Local\Temp\look2.exe
  C:\Users\Admin\AppData\Local\Temp\\look2.exe
  2⤵
  - Server Software Component: Terminal Services DLL
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:2540
- C:\Users\Admin\AppData\Local\Temp\HD_ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe
  C:\Users\Admin\AppData\Local\Temp\HD_ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2900

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "svchcst"
1⤵
PID:2124

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "svchcst"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Windows\SysWOW64\svchcst.exe
  C:\Windows\system32\svchcst.exe "c:\windows\system32\259488584.bat",MainThread
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Server Software Component

1

T1505

Terminal Services DLL

1

T1505.005

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Cab7F21.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\HD_X.dat

Filesize
1.4MB

MD5
5f98b947333f18509cb1f51b3a92af6e

SHA1
47bb87c67a8c3ff2298afe5d791259f7273056bd

SHA256
c4b8a8fb9126dadad42f3a01266e50e89d0d32b80a8dbd60f78b793f335e0860

SHA512
995733d2fb57d1d4b5e834f972aea17ba0575419561c19db256675b5a1526569961c1767d2536bb7bc65d70c2507af480d4e483267898c283b3be12eebb7df38

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7F43.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\look2.exe

Filesize
337KB

MD5
2f3b6f16e33e28ad75f3fdaef2567807

SHA1
85e907340faf1edfc9210db85a04abd43d21b741

SHA256
86492ebf2d6f471a5ee92977318d099b3ea86175b5b7ae522237ae01d07a4857

SHA512
db17e99e2df918cfc9ccbe934adfe73f0777ce1ce9f28b57a4b24ecd821efe2e0b976a634853247b77b16627d2bb3af4ba20306059d1d25ef38ffada7da3e3a4

Download Submit
\Users\Admin\AppData\Local\Temp\HD_ae4a7c463e19469cc8ea19569a682cd036f25d4e1904888effa6275f0b4e4f83.exe

Filesize
641KB

MD5
d4a38bbb599347a38abe51708ebc1fb4

SHA1
82837e477be35081dc9c4552ed1c4019c2ebc3eb

SHA256
4fdff06f5d722f23b63ea3a962a2024ab708c4f8d7b215224c43de2eb87ad3a9

SHA512
abf59d2461ff774bd0892cbc542c039790cb70540702fa0672238fbfedd4c370398c33040a07b450a4eaee638248a456c50945ca2a62443d4bc7adf04121e3d3

Download Submit
\Windows\SysWOW64\259488584.bat

Filesize
51KB

MD5
c8fde85c44eda0453746bfd9b3aadec5

SHA1
8a113344ca66ef701aebf474a94126d9970bb759

SHA256
f0d87391de3718888df00949415a58a06dd581c7ff7d928f2b2f378b6815f2af

SHA512
74ffad83453f5a77ae491f163f8fefc838eee974947645fd4935deb4b1c7c2e1c4e84e3c24229e69f4061ec87bee71e226285294ce8f668f79a698eca90dd644

Download Submit
\Windows\SysWOW64\svchcst.exe

Filesize
43KB

MD5
51138beea3e2c21ec44d0932c71762a8

SHA1
8939cf35447b22dd2c6e6f443446acc1bf986d58

SHA256
5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

SHA512
794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

Download Submit
memory/2744-213-0x00000000027D0000-0x000000000297C000-memory.dmp

Filesize
1.7MB

Download
memory/2744-19-0x00000000027D0000-0x000000000297C000-memory.dmp

Filesize
1.7MB

Download
memory/2900-37-0x000000006E360000-0x000000006E370000-memory.dmp

Filesize
64KB

Download
memory/2900-36-0x0000000003D70000-0x0000000003D7A000-memory.dmp

Filesize
40KB

Download
memory/2900-35-0x0000000003D70000-0x0000000003D7A000-memory.dmp

Filesize
40KB

Download
memory/2900-34-0x0000000000400000-0x00000000005AC000-memory.dmp

Filesize
1.7MB

Download
memory/2900-214-0x0000000000400000-0x00000000005AC000-memory.dmp

Filesize
1.7MB

Download
memory/2900-215-0x0000000003D70000-0x0000000003D7A000-memory.dmp

Filesize
40KB

Download
memory/2900-217-0x0000000003D70000-0x0000000003D7A000-memory.dmp

Filesize
40KB

Download
memory/2900-226-0x0000000000400000-0x00000000005AC000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads