gh0strat | 6436365efa1ab36dc47beace319b459cbcab79f7e240b7ec28f231d4f7511e1f

General

Target

6436365efa1ab36dc47beace319b459cbcab79f7e240b7ec28f231d4f7511e1f.exe
Size

488KB
MD5

08914d7ffb54610b54d8581efe9d9308
SHA1

9ede90413b76ff5f1963d1430158b7c11b099ab4
SHA256

6436365efa1ab36dc47beace319b459cbcab79f7e240b7ec28f231d4f7511e1f
SHA512

e9dc5f9d432730099ecf185e9f2b552cda22f5eadb8db3a0d3a9ba411d0c8482cdab208d9e40e1a2c36e4edb3bfedfa38b757c7fe0c75bbd9b47046e2475e997
SSDEEP

6144:s8xBmtd8k+c1Iu7mwVKMU1npAkzDUnB/pfeYN/51Ap4txQf5P+3Y1tMmbWsTaad:7xy6kthKX1pAfBVV1Ap4y+3Y12wWjad

Score

10^/10

Malware Config

Signatures

Gh0st RAT payload 2 IoCs

resource	yara_rule
behavioral2/memory/4936-3-0x0000000010000000-0x0000000010010000-memory.dmp	family_gh0strat
behavioral2/memory/3872-14-0x0000000010000000-0x0000000010010000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\QAssist.sys	Onzvei.exe

Executes dropped EXE 2 IoCs

pid	Process
3872	Onzvei.exe
1104	Onzvei.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\windows\Onzvei.exe	6436365efa1ab36dc47beace319b459cbcab79f7e240b7ec28f231d4f7511e1f.exe
File created	C:\windows\Onzvei.exe	6436365efa1ab36dc47beace319b459cbcab79f7e240b7ec28f231d4f7511e1f.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
3064	3872	WerFault.exe	88
2308	4936	WerFault.exe	87
4436	4936	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6436365efa1ab36dc47beace319b459cbcab79f7e240b7ec28f231d4f7511e1f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onzvei.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onzvei.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4936	6436365efa1ab36dc47beace319b459cbcab79f7e240b7ec28f231d4f7511e1f.exe
Token: 33	1104	Onzvei.exe
Token: SeIncBasePriorityPrivilege	1104	Onzvei.exe
Token: 33	1104	Onzvei.exe
Token: SeIncBasePriorityPrivilege	1104	Onzvei.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4936	6436365efa1ab36dc47beace319b459cbcab79f7e240b7ec28f231d4f7511e1f.exe
4936	6436365efa1ab36dc47beace319b459cbcab79f7e240b7ec28f231d4f7511e1f.exe
4936	6436365efa1ab36dc47beace319b459cbcab79f7e240b7ec28f231d4f7511e1f.exe
4936	6436365efa1ab36dc47beace319b459cbcab79f7e240b7ec28f231d4f7511e1f.exe
3872	Onzvei.exe
3872	Onzvei.exe
3872	Onzvei.exe
3872	Onzvei.exe
1104	Onzvei.exe
1104	Onzvei.exe
1104	Onzvei.exe
1104	Onzvei.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 2180	4936	6436365efa1ab36dc47beace319b459cbcab79f7e240b7ec28f231d4f7511e1f.exe	90
PID 4936 wrote to memory of 2180	4936	6436365efa1ab36dc47beace319b459cbcab79f7e240b7ec28f231d4f7511e1f.exe	90
PID 4936 wrote to memory of 2180	4936	6436365efa1ab36dc47beace319b459cbcab79f7e240b7ec28f231d4f7511e1f.exe	90
PID 3872 wrote to memory of 1104	3872	Onzvei.exe	91
PID 3872 wrote to memory of 1104	3872	Onzvei.exe	91
PID 3872 wrote to memory of 1104	3872	Onzvei.exe	91

C:\Users\Admin\AppData\Local\Temp\6436365efa1ab36dc47beace319b459cbcab79f7e240b7ec28f231d4f7511e1f.exe
"C:\Users\Admin\AppData\Local\Temp\6436365efa1ab36dc47beace319b459cbcab79f7e240b7ec28f231d4f7511e1f.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\643636~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2180
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 268
  2⤵
  - Program crash
  PID:2308
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 228
  2⤵
  - Program crash
  PID:4436

C:\windows\Onzvei.exe
C:\windows\Onzvei.exe -auto
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3872
- C:\windows\Onzvei.exe
  C:\windows\Onzvei.exe -acsi
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1104
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 240
  2⤵
  - Program crash
  PID:3064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4936 -ip 4936
1⤵
PID:860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3872 -ip 3872
1⤵
PID:1220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4936 -ip 4936
1⤵
PID:224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

1

T1070

File Deletion

1

T1070.004

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Onzvei.exe

Filesize
488KB

MD5
08914d7ffb54610b54d8581efe9d9308

SHA1
9ede90413b76ff5f1963d1430158b7c11b099ab4

SHA256
6436365efa1ab36dc47beace319b459cbcab79f7e240b7ec28f231d4f7511e1f

SHA512
e9dc5f9d432730099ecf185e9f2b552cda22f5eadb8db3a0d3a9ba411d0c8482cdab208d9e40e1a2c36e4edb3bfedfa38b757c7fe0c75bbd9b47046e2475e997

Download Submit
C:\input.txt

Filesize
5B

MD5
6dc4a31db60d3da6b1d477315619952e

SHA1
e881b0ec41bcc1ed53643c01c0a36bae66575477

SHA256
d5a5b182cd30db1d5d8c611de8d1764a8929186986b69eed8ae6760ebc48c0f6

SHA512
3b64e73503f964b932781732f81680ef51e2df64ebd171be58c40cdbbd36ec7d38c79863feba1fdc769d15de150af95840061f82cf626aa01556396d0712637d

Download Submit
memory/3872-14-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/4936-3-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing