gh0strat | 9e364ccf2384a19973de23c0b730e50a84a250f915e09253e77740baa69eb9bb

Analysis

max time kernel
99s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-11-2024 09:07

Target

Bin1799/Plugins/ShellCode.bat
Size

569B
MD5

8cd7ab4e93011f62c0ffb49550f953d2
SHA1

70aac31a1a5be483ec1a7909b5f50efaeee27bc1
SHA256

81e626258fdd763b3e2aa53d98070d7cbcba2e5ed80e0eb535d9707d8c9f7083
SHA512

90a458dafd2aa61dd3ab1ba9f6a0f653c52f5190755f17eebee70d5dec44081d417f1a32e35fb0ddae42afb7808da906b2dfdc0f84d89b90dbe477310dd08d86

Score

10^/10

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Bin1799\Plugins\2.dll	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

ShellCode.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ShellCode.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ShellCode.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 4640 wrote to memory of 320	4640	cmd.exe	ShellCode.exe
PID 4640 wrote to memory of 320	4640	cmd.exe	ShellCode.exe
PID 4640 wrote to memory of 320	4640	cmd.exe	ShellCode.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Bin1799\Plugins\ShellCode.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Users\Admin\AppData\Local\Temp\Bin1799\Plugins\ShellCode.exe
  ShellCode.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:320

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\Bin1799\Plugins\2.dll

Filesize
500KB

MD5
47b1c650018609f277dd9ef884bfe1fb

SHA1
16980e8384918f5eeb61e53be2d769bbd59a126e

SHA256
d3d8efeb396807430ffcd22281866126951a0542e921dd8d2da67fdf61634e33

SHA512
085a15f793543d814842e0aa81e0d7b983a6e3b7c370489fdd44bbde4dd07b09a93757686673f2d6cac3df2cccaf77b5c5b4b725774ad437de7d0476f6a9d9d9

Download Submit