gh0strat | 1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6

General

Target
1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe
Size 2.8MB
Sample260730-ers6yabe44
SHA256 1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6
MD5 c1313947ee1a51fb5b85f85dd771c3c5
SHA1 deb2976105e1e2efb67d795b0b64598642c3d37d
SHA512 8cdd6fe380666ddb165fd170d1b5d3fa125f98de98aeb98032c77b3940824c8c743d6e3942929a9f28a4aba77982eb42272cc4ba0641d6866b42c88c8f866c52
SSDEEP 49152:BQZAdVyVT9n/Xg0P+WhoD+XGwv2tP1zTPADnWPMklKu8bi4O8b8ITDnl13S:iGdVyVT9nPgmhc+Wwv2tP1PPknK
TLSH
T10AD5AF30FA418036E452217189796F7EAC79AD3007A549C7A394EF5D6E306E2EE32377
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery gh0strat rat upx

Malware Config

Signatures

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Gh0st RAT payload 2 IoCs

resource	yara_rule
behavioral1/memory/5024-6-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/files/0x000b00000002455d-12.dat	family_gh0strat

Executes dropped EXE 4 IoCs

pid	Process
5024	svchost.exe
2228	svchos.exe
3928	HD_1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe
2096	HD_1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe

Loads dropped DLL 1 IoCs

pid	Process
2228	svchos.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\240680531.txt	svchos.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/5024-5-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/5024-6-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe
File created	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
992	5024	WerFault.exe	85
3116	2228	WerFault.exe	89
3528	2228	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HD_1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HD_1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\	HD_1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\	HD_1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3864	1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe
3864	1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3864	1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe
3864	1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3864 wrote to memory of 5024	3864	1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe	85
PID 3864 wrote to memory of 2228	3864	1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe	89
PID 3864 wrote to memory of 3928	3864	1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe	94
PID 3928 wrote to memory of 2096	3928	HD_1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe	95
PID 3928 wrote to memory of 2096	3928	HD_1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe	95
PID 3928 wrote to memory of 2096	3928	HD_1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe	95

C:\Users\Admin\AppData\Local\Temp\1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe
"C:\Users\Admin\AppData\Local\Temp\1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3864
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  C:\Users\Admin\AppData\Local\Temp\\svchost.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5024
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 508
    3⤵
    - Program crash
    PID:992
- C:\Users\Admin\AppData\Local\Temp\svchos.exe
  C:\Users\Admin\AppData\Local\Temp\\svchos.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:2228
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 452
    3⤵
    - Program crash
    PID:3116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 444
    3⤵
    - Program crash
    PID:3528
- C:\Users\Admin\AppData\Local\Temp\HD_1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe
  C:\Users\Admin\AppData\Local\Temp\HD_1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3928
- - C:\Users\Admin\AppData\Local\Temp\HD_1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe
    "C:\Users\Admin\AppData\Local\Temp\HD_1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe" --channel=3928.0.1001357620 --type=renderer
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5024 -ip 5024
1⤵
PID:1684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2228 -ip 2228
1⤵
PID:4948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2228 -ip 2228
1⤵
PID:3204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HD_1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe

Path C:\Users\Admin\AppData\Local\Temp\HD_1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe
Size 1.5MB
SHA256 00d2ce2c35e8f2d31c2a8778c6e8846be3d1467cd1e66aa494571a14dea0e4d1
MD5 7a97aa40d8a3da4a9095873c72d524c5
SHA1 d219db66995e0548ea1226cb1806388b1ac718f7
SHA512 16de6e0fdda9ebd7de996e97f73d9fad661c947320b604e5aafdcde50ee4582b1b07da98233b12dc76c464abe2104323c056b1ab477532ee10f5117cb03aa90c
SSDEEP 24576:8fJVAXknwvrPymlvoCO1kCjTPADOwWPg9kl0nE58bi4O8b8ITDnlLGk3S:M+XGwv2tP1zTPADnWPMklKu8bi4O8b81
TLSH
T177657C30F6418136E8A23172DE796F6E6C6AA93013E504C762841F6D9F706F2EE36357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HD_X.dat

Path C:\Users\Admin\AppData\Local\Temp\HD_X.dat
Size 1.3MB
SHA256 3766103e37600d9f3e0f787444572245ddbf7b791f6b86e0c89f70c716296462
MD5 1c08ec38913ac46ad3fee730690cba71
SHA1 1911985f4fe8678a5fc859f019faa66cc69d51e2
SHA512 dc31f9d8267e054f81d4d2c503a5fdc5a9e478ed9371b19ea661586204c3cac6c299b959cafb0797a62a0c3e6a02c68b2f43c121e9ca70b3f2c21fcea407e832
SSDEEP 24576:BQZoidOTdVZinacCET9Ecl1eadg0MCiVWhFU7cVu:BQZAdVyVT9n/Xg0P+WhoB
TLSH
T12B55D052FA8280B2D209107018BA2739DA756E754B21CBD7A75CFE1E7D36681E83713F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchos.exe

Path C:\Users\Admin\AppData\Local\Temp\svchos.exe
Size 93KB
SHA256 62954fdf65e629b39a29f539619d20691332184c6b6be5a826128a8e759bfa84
MD5 3b377ad877a942ec9f60ea285f7119a2
SHA1 60b23987b20d913982f723ab375eef50fafa6c70
SHA512 af3a71f867ad9d28772c48b521097f9bf8931eb89fd2974e8de10990241419a39ddc3c0b36dd38aac4fdf14e1f0c5e228692618e93adce958d5b5dab8940e46f
SSDEEP 1536:ktbE7m8nNEQ2O6ReWMWfPbp2WTrW9L3JPPgJ+o5FJYHvh/P6:Bm+2LReWjTrW9rNPgYoTJYHvh
TLSH
T1B1934A41BE8CC869D05C81B03D7BA6B58422BC553900277B6F8AFB4FD976350EC2A5DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost.exe
Size 377KB
SHA256 6e0b7d205a400cf28ae3faa5a0c4b35016c24a5d818d770e54e3342857eae35c
MD5 9b3f9dce6748ab71769198b5dd5320d1
SHA1 06c76c2c3e2ef607612e2fde18797b6223f2bfe3
SHA512 00e756cfb85d3bd448a630b3f7617531b894a0e4cbf1fba58cab0bc0169bb9dcf80041ebb0cdc6e248df5a41322ee919f1d3a412d4dc8600755d4cf7f6e0ec90
SSDEEP 6144:5UGp2l6zRmeVLNH3ozQTAygOcqAJwQZgb4YtjH6/MuQafORzEOmFfMzi71o+YgL7:HclcceB3lKwAg0Mja/UafOVwbhF
TLSH
T139841241FF520123C70A71758CD88A6A9F667B888E560C2B7F746F4F0A702DE583AD39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

240680531.txt

Path C:\Windows\SysWOW64\240680531.txt
Size 50KB
SHA256 70aa0509dce70455724c5bfe595b5753aa461f6969e3b75097e5d929d924c65b
MD5 551e5ffc60b0a9eb898368b684f94b38
SHA1 ba1eba39a2a8d23a9e732d44f856f7a065e47952
SHA512 ab4c687064a48b6887aea03716caf218df285ce1f4a05f0c5543b5d4b74803802d712bf7477694c8d3a3f127171f5563ff0447e566acadd9e9a38e0de6b691d6
SSDEEP 1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5fJYH:W5ReWjTrW9rNPgYoFJYH
TLSH
T166333902DD8D88F5E141177039AA77B7953ABCE07A8526634F63DE69C87B330F42D286
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2096-28-0x0000000076150000-0x0000000076174000-memory.dmp

Download

memory/5024-5-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/5024-6-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads