gh0strat | e19bd70b37b5f01b4ea4f5f2c035b863046af984c51778848e36e81426789b0b

General

Target
e19bd70b37b5f01b4ea4f5f2c035b863046af984c51778848e36e81426789b0b.exe
Size 1.9MB
Sample260730-erv1jabe46
SHA256 e19bd70b37b5f01b4ea4f5f2c035b863046af984c51778848e36e81426789b0b
MD5 44c0daa6a9719eb3b30442870c3574ff
SHA1 02f118737af562ac34c337bbe14d5dbbf1c1bf1f
SHA512 fb417a524fe78b99e3954899ebe58f1045c73ae6001c1e5ad7dc7e7ca0b7eb447303abf1f6dc1a12b337cee40f031d7ab7ae46bb3ec271c3b7a1104e0be0ac0e
SSDEEP 49152:hQZAdVyVT9n/Xg0P+WhompeEf6zqgmnpeapeT:CGdVyVT9nPgmhkheQvT
TLSH
T18995D002FA4180B1C54A20B0246E573BEA751E651B218FD7EBA8FE1D7D352C2993763F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery gh0strat rat upx

Malware Config

Signatures

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Gh0st RAT payload 2 IoCs

resource	yara_rule
behavioral1/memory/1460-6-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/files/0x000b000000024588-12.dat	family_gh0strat

Executes dropped EXE 3 IoCs

pid	Process
1460	svchost.exe
2508	svchos.exe
1572	HD_e19bd70b37b5f01b4ea4f5f2c035b863046af984c51778848e36e81426789b0b.exe

Loads dropped DLL 1 IoCs

pid	Process
2508	svchos.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\240668265.txt	svchos.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1460-5-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/1460-6-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	e19bd70b37b5f01b4ea4f5f2c035b863046af984c51778848e36e81426789b0b.exe
File created	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	e19bd70b37b5f01b4ea4f5f2c035b863046af984c51778848e36e81426789b0b.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	e19bd70b37b5f01b4ea4f5f2c035b863046af984c51778848e36e81426789b0b.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	e19bd70b37b5f01b4ea4f5f2c035b863046af984c51778848e36e81426789b0b.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	e19bd70b37b5f01b4ea4f5f2c035b863046af984c51778848e36e81426789b0b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3052	1460	WerFault.exe	86
5040	2508	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e19bd70b37b5f01b4ea4f5f2c035b863046af984c51778848e36e81426789b0b.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4648	e19bd70b37b5f01b4ea4f5f2c035b863046af984c51778848e36e81426789b0b.exe
4648	e19bd70b37b5f01b4ea4f5f2c035b863046af984c51778848e36e81426789b0b.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4648	e19bd70b37b5f01b4ea4f5f2c035b863046af984c51778848e36e81426789b0b.exe
4648	e19bd70b37b5f01b4ea4f5f2c035b863046af984c51778848e36e81426789b0b.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 1460	4648	e19bd70b37b5f01b4ea4f5f2c035b863046af984c51778848e36e81426789b0b.exe	86
PID 4648 wrote to memory of 2508	4648	e19bd70b37b5f01b4ea4f5f2c035b863046af984c51778848e36e81426789b0b.exe	90

C:\Users\Admin\AppData\Local\Temp\e19bd70b37b5f01b4ea4f5f2c035b863046af984c51778848e36e81426789b0b.exe
"C:\Users\Admin\AppData\Local\Temp\e19bd70b37b5f01b4ea4f5f2c035b863046af984c51778848e36e81426789b0b.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  C:\Users\Admin\AppData\Local\Temp\\svchost.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1460
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 516
    3⤵
    - Program crash
    PID:3052
- C:\Users\Admin\AppData\Local\Temp\svchos.exe
  C:\Users\Admin\AppData\Local\Temp\\svchos.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:2508
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 464
    3⤵
    - Program crash
    PID:5040
- C:\Users\Admin\AppData\Local\Temp\HD_e19bd70b37b5f01b4ea4f5f2c035b863046af984c51778848e36e81426789b0b.exe
  C:\Users\Admin\AppData\Local\Temp\HD_e19bd70b37b5f01b4ea4f5f2c035b863046af984c51778848e36e81426789b0b.exe
  2⤵
  - Executes dropped EXE
  PID:1572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1460 -ip 1460
1⤵
PID:2164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2508 -ip 2508
1⤵
PID:3572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HD_X.dat

Path C:\Users\Admin\AppData\Local\Temp\HD_X.dat
Size 1.4MB
SHA256 4a30237f213d0613cc85225b479ac95903831072129496837348a1f9fa1e83e7
MD5 91edfde4ac6ea90d1c98fed6395fc8f5
SHA1 bd17f816176364da1cdc7b7b2a468466f7d2d0c8
SHA512 f99e2911fee6af9701df464efc648c1eb484286b60710751c703e2bc47e9b9d1c6d46b35023f854c595eeedd04bd4c044ce98c56b63232271c3bbaa61725b6a2
SSDEEP 24576:hQZoidOTdVZinacCET9Ecl1eadg0MCiVWhFU7cVkwpeY:hQZAdVyVT9n/Xg0P+WhompeY
TLSH
T1FE65D052FA8280B2D208117018BA277ADA755E750B25CBD7A75CFE1E7D32681E83713F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HD_e19bd70b37b5f01b4ea4f5f2c035b863046af984c51778848e36e81426789b0b.exe

Path C:\Users\Admin\AppData\Local\Temp\HD_e19bd70b37b5f01b4ea4f5f2c035b863046af984c51778848e36e81426789b0b.exe
Size 502KB
SHA256 c4e94491a18c89c359863836973998598c3def27987243f9aee37d860f8da47e
MD5 e6172d8c04494833f5a7b79697c043ab
SHA1 3e52b78fcb7b27fdf30b96155da9f8de2654be68
SHA512 bb1ffabae142053eeb1d86b97b1b144a2826ec3bb37a7ab54916c201f9f70952e16c5271a46a1ecd5cdc7cd6da40a99a104d3adca73f413160049453d572588f
SSDEEP 12288:wbM0nr8NCBd4M3idzPBFq2/9PmEhNzwHJem7OzwHJeT:wbM0neCBd4q6zq2/1mEhBwpemIwpeT
TLSH
T130B49D00B61172B8D88725F0350E973BB53A1D0167155EE3AFB07D997EA82D31A3AB4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchos.exe

Path C:\Users\Admin\AppData\Local\Temp\svchos.exe
Size 93KB
SHA256 62954fdf65e629b39a29f539619d20691332184c6b6be5a826128a8e759bfa84
MD5 3b377ad877a942ec9f60ea285f7119a2
SHA1 60b23987b20d913982f723ab375eef50fafa6c70
SHA512 af3a71f867ad9d28772c48b521097f9bf8931eb89fd2974e8de10990241419a39ddc3c0b36dd38aac4fdf14e1f0c5e228692618e93adce958d5b5dab8940e46f
SSDEEP 1536:ktbE7m8nNEQ2O6ReWMWfPbp2WTrW9L3JPPgJ+o5FJYHvh/P6:Bm+2LReWjTrW9rNPgYoTJYHvh
TLSH
T1B1934A41BE8CC869D05C81B03D7BA6B58422BC553900277B6F8AFB4FD976350EC2A5DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost.exe
Size 377KB
SHA256 6e0b7d205a400cf28ae3faa5a0c4b35016c24a5d818d770e54e3342857eae35c
MD5 9b3f9dce6748ab71769198b5dd5320d1
SHA1 06c76c2c3e2ef607612e2fde18797b6223f2bfe3
SHA512 00e756cfb85d3bd448a630b3f7617531b894a0e4cbf1fba58cab0bc0169bb9dcf80041ebb0cdc6e248df5a41322ee919f1d3a412d4dc8600755d4cf7f6e0ec90
SSDEEP 6144:5UGp2l6zRmeVLNH3ozQTAygOcqAJwQZgb4YtjH6/MuQafORzEOmFfMzi71o+YgL7:HclcceB3lKwAg0Mja/UafOVwbhF
TLSH
T139841241FF520123C70A71758CD88A6A9F667B888E560C2B7F746F4F0A702DE583AD39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

240668265.txt

Path C:\Windows\SysWOW64\240668265.txt
Size 50KB
SHA256 70aa0509dce70455724c5bfe595b5753aa461f6969e3b75097e5d929d924c65b
MD5 551e5ffc60b0a9eb898368b684f94b38
SHA1 ba1eba39a2a8d23a9e732d44f856f7a065e47952
SHA512 ab4c687064a48b6887aea03716caf218df285ce1f4a05f0c5543b5d4b74803802d712bf7477694c8d3a3f127171f5563ff0447e566acadd9e9a38e0de6b691d6
SSDEEP 1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5fJYH:W5ReWjTrW9rNPgYoFJYH
TLSH
T166333902DD8D88F5E141177039AA77B7953ABCE07A8526634F63DE69C87B330F42D286
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1460-5-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/1460-6-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads