gh0strat | f6ca654e7e1eeb23c06abe0da608a1239c35981bac1a4c32dfb5e3465f67074a

General

Target

f6ca654e7e1eeb23c06abe0da608a1239c35981bac1a4c32dfb5e3465f67074a.exe
Size

139KB
MD5

871b39db6a5a750aaaf6482fec0f1a0a
SHA1

6caf213743fb8b852a193b17da442dd28c3d1377
SHA256

f6ca654e7e1eeb23c06abe0da608a1239c35981bac1a4c32dfb5e3465f67074a
SHA512

11cf2644a17cc8c8f61d8e578ab500b7df63447f28b2246eb2fddeaa7ce961b9099e44932d50c360c91059b45f48e530042153e9f52c6cb7cb092f2c42773830
SSDEEP

3072:8yIpG2/iDbYZlT9VjTaeKAYbypHJHhlNTsME55m:hIpos/3jTXK1ypba

Score

10^/10

gh0strat discovery rat upx

Malware Config

Extracted

Family

gh0strat

C2

192.168.4.9

Signatures

Gh0st RAT payload 4 IoCs

resource	yara_rule
behavioral1/memory/2360-1-0x0000000010000000-0x0000000010015000-memory.dmp	family_gh0strat
behavioral1/memory/1788-16-0x0000000000400000-0x0000000000471000-memory.dmp	family_gh0strat
behavioral1/memory/2892-20-0x0000000000400000-0x0000000000471000-memory.dmp	family_gh0strat
behavioral1/memory/2360-21-0x0000000000400000-0x0000000000471000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Executes dropped EXE 2 IoCs

pid	Process
1788	Wussqcw.exe
2892	Wussqcw.exe

Loads dropped DLL 1 IoCs

pid	Process
1788	Wussqcw.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	Wussqcw.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	Wussqcw.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2360-0-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral1/files/0x00080000000120ff-7.dat	upx
behavioral1/memory/1788-8-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral1/memory/1788-16-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral1/memory/2892-20-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral1/memory/2360-21-0x0000000000400000-0x0000000000471000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Wussqcw.exe	f6ca654e7e1eeb23c06abe0da608a1239c35981bac1a4c32dfb5e3465f67074a.exe
File opened for modification	C:\Program Files (x86)\Wussqcw.exe	f6ca654e7e1eeb23c06abe0da608a1239c35981bac1a4c32dfb5e3465f67074a.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f6ca654e7e1eeb23c06abe0da608a1239c35981bac1a4c32dfb5e3465f67074a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Wussqcw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Wussqcw.exe

Modifies data under HKEY_USERS 25 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	Wussqcw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Wussqcw.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Wussqcw.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	Wussqcw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	Wussqcw.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Wussqcw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	Wussqcw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	Wussqcw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	Wussqcw.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	Wussqcw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	Wussqcw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Wussqcw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Wussqcw.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	Wussqcw.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	Wussqcw.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	Wussqcw.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	Wussqcw.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	Wussqcw.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	Wussqcw.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	Wussqcw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Wussqcw.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Wussqcw.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	Wussqcw.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	Wussqcw.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	Wussqcw.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2360	f6ca654e7e1eeb23c06abe0da608a1239c35981bac1a4c32dfb5e3465f67074a.exe
2360	f6ca654e7e1eeb23c06abe0da608a1239c35981bac1a4c32dfb5e3465f67074a.exe
2360	f6ca654e7e1eeb23c06abe0da608a1239c35981bac1a4c32dfb5e3465f67074a.exe
1788	Wussqcw.exe
1788	Wussqcw.exe
1788	Wussqcw.exe
2892	Wussqcw.exe
2892	Wussqcw.exe
2892	Wussqcw.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2360	f6ca654e7e1eeb23c06abe0da608a1239c35981bac1a4c32dfb5e3465f67074a.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 2892	1788	Wussqcw.exe	31
PID 1788 wrote to memory of 2892	1788	Wussqcw.exe	31
PID 1788 wrote to memory of 2892	1788	Wussqcw.exe	31
PID 1788 wrote to memory of 2892	1788	Wussqcw.exe	31

C:\Users\Admin\AppData\Local\Temp\f6ca654e7e1eeb23c06abe0da608a1239c35981bac1a4c32dfb5e3465f67074a.exe
"C:\Users\Admin\AppData\Local\Temp\f6ca654e7e1eeb23c06abe0da608a1239c35981bac1a4c32dfb5e3465f67074a.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:2360

C:\Program Files (x86)\Wussqcw.exe
"C:\Program Files (x86)\Wussqcw.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Program Files (x86)\Wussqcw.exe
  "C:\Program Files (x86)\Wussqcw.exe" Win7
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Wussqcw.exe

Filesize
139KB

MD5
871b39db6a5a750aaaf6482fec0f1a0a

SHA1
6caf213743fb8b852a193b17da442dd28c3d1377

SHA256
f6ca654e7e1eeb23c06abe0da608a1239c35981bac1a4c32dfb5e3465f67074a

SHA512
11cf2644a17cc8c8f61d8e578ab500b7df63447f28b2246eb2fddeaa7ce961b9099e44932d50c360c91059b45f48e530042153e9f52c6cb7cb092f2c42773830

Download Submit
memory/1788-8-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1788-16-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2360-0-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2360-1-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/2360-21-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2892-20-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download

Analysis

Sharing