gh0strat | e19bd70b37b5f01b4ea4f5f2c035b863046af984c51778848e36e81426789b0b

General

Target
e19bd70b37b5f01b4ea4f5f2c035b863046af984c51778848e36e81426789b0b.exe
Size 1.9MB
Sample260730-erv1jabe46
SHA256 e19bd70b37b5f01b4ea4f5f2c035b863046af984c51778848e36e81426789b0b
MD5 44c0daa6a9719eb3b30442870c3574ff
SHA1 02f118737af562ac34c337bbe14d5dbbf1c1bf1f
SHA512 fb417a524fe78b99e3954899ebe58f1045c73ae6001c1e5ad7dc7e7ca0b7eb447303abf1f6dc1a12b337cee40f031d7ab7ae46bb3ec271c3b7a1104e0be0ac0e
SSDEEP 49152:hQZAdVyVT9n/Xg0P+WhompeEf6zqgmnpeapeT:CGdVyVT9nPgmhkheQvT
TLSH
T18995D002FA4180B1C54A20B0246E573BEA751E651B218FD7EBA8FE1D7D352C2993763F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery gh0strat persistence rat upx

Malware Config

Signatures

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Gh0st RAT payload 2 IoCs

resource	yara_rule
behavioral2/memory/4820-7-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/files/0x000e00000001c564-14.dat	family_gh0strat

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ö÷¶¯·ÀÓù·þÎñÄ£¿é\Parameters\ServiceDll = "C:\\Windows\\system32\\240758500.txt"	svchos.exe

Executes dropped EXE 4 IoCs

pid	Process
4820	svchost.exe
996	svchos.exe
2904	HD_e19bd70b37b5f01b4ea4f5f2c035b863046af984c51778848e36e81426789b0b.exe
596	Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe

Loads dropped DLL 3 IoCs

pid	Process
996	svchos.exe
6060	svchost.exe
596	Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe	svchost.exe
File created	C:\Windows\SysWOW64\240758500.txt	svchos.exe
File opened for modification	C:\Windows\SysWOW64\ini.ini	svchos.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4820-5-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4820-7-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	e19bd70b37b5f01b4ea4f5f2c035b863046af984c51778848e36e81426789b0b.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	e19bd70b37b5f01b4ea4f5f2c035b863046af984c51778848e36e81426789b0b.exe
File created	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	e19bd70b37b5f01b4ea4f5f2c035b863046af984c51778848e36e81426789b0b.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	e19bd70b37b5f01b4ea4f5f2c035b863046af984c51778848e36e81426789b0b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2272	4820	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e19bd70b37b5f01b4ea4f5f2c035b863046af984c51778848e36e81426789b0b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2184	e19bd70b37b5f01b4ea4f5f2c035b863046af984c51778848e36e81426789b0b.exe
2184	e19bd70b37b5f01b4ea4f5f2c035b863046af984c51778848e36e81426789b0b.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2184	e19bd70b37b5f01b4ea4f5f2c035b863046af984c51778848e36e81426789b0b.exe
2184	e19bd70b37b5f01b4ea4f5f2c035b863046af984c51778848e36e81426789b0b.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 4820	2184	e19bd70b37b5f01b4ea4f5f2c035b863046af984c51778848e36e81426789b0b.exe	88
PID 2184 wrote to memory of 996	2184	e19bd70b37b5f01b4ea4f5f2c035b863046af984c51778848e36e81426789b0b.exe	92
PID 6060 wrote to memory of 596	6060	svchost.exe	98

C:\Users\Admin\AppData\Local\Temp\e19bd70b37b5f01b4ea4f5f2c035b863046af984c51778848e36e81426789b0b.exe
"C:\Users\Admin\AppData\Local\Temp\e19bd70b37b5f01b4ea4f5f2c035b863046af984c51778848e36e81426789b0b.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  C:\Users\Admin\AppData\Local\Temp\\svchost.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4820
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 576
    3⤵
    - Program crash
    PID:2272
- C:\Users\Admin\AppData\Local\Temp\svchos.exe
  C:\Users\Admin\AppData\Local\Temp\\svchos.exe
  2⤵
  - Server Software Component: Terminal Services DLL
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:996
- C:\Users\Admin\AppData\Local\Temp\HD_e19bd70b37b5f01b4ea4f5f2c035b863046af984c51778848e36e81426789b0b.exe
  C:\Users\Admin\AppData\Local\Temp\HD_e19bd70b37b5f01b4ea4f5f2c035b863046af984c51778848e36e81426789b0b.exe
  2⤵
  - Executes dropped EXE
  PID:2904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4820 -ip 4820
1⤵
PID:1484

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"
1⤵
PID:5356

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6060
- C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
  C:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\240758500.txt",MainThread
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:596

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k "╓≈╢»╖└╙∙╖■╬±─ú┐Θ"
1⤵
PID:5536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

1

T1505

Terminal Services DLL

1

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AcroRd32.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Size 3.8MB
SHA256 38b944e2e42c651cd779d02af160f689a321f6bf150e82e9c2e9ef1145013943
MD5 42bda73f8207ddfa633360326654cbb9
SHA1 8d1138b2ed303d36ce8e1ae74d0831fd8c0ea600
SHA512 d94ac28609b17055bd3e3d40c1a3f41bcf71a6a97ae094a9d9d8a88a21b92e5b8c609ccb3e8388a3c28aa99c6c0fb9d7131f96b4f17c8c648ed9219631617485
SSDEEP 49152:hQZAdVyVT9n/Xg0P+WhompeYTfiUEWo6zuEz439z99akTBc4O8b8ITDnlT4NvJS:CGdVyVT9nPgmhkYTfiG/nzU90m
TLSH
T10E060616A6C8C0EBD5642070CC69BBF940546D78DBA2CED7BE44BE0679307D29533A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HD_e19bd70b37b5f01b4ea4f5f2c035b863046af984c51778848e36e81426789b0b.exe

Path C:\Users\Admin\AppData\Local\Temp\HD_e19bd70b37b5f01b4ea4f5f2c035b863046af984c51778848e36e81426789b0b.exe
Size 502KB
SHA256 c4e94491a18c89c359863836973998598c3def27987243f9aee37d860f8da47e
MD5 e6172d8c04494833f5a7b79697c043ab
SHA1 3e52b78fcb7b27fdf30b96155da9f8de2654be68
SHA512 bb1ffabae142053eeb1d86b97b1b144a2826ec3bb37a7ab54916c201f9f70952e16c5271a46a1ecd5cdc7cd6da40a99a104d3adca73f413160049453d572588f
SSDEEP 12288:wbM0nr8NCBd4M3idzPBFq2/9PmEhNzwHJem7OzwHJeT:wbM0neCBd4q6zq2/1mEhBwpemIwpeT
TLSH
T130B49D00B61172B8D88725F0350E973BB53A1D0167155EE3AFB07D997EA82D31A3AB4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchos.exe

Path C:\Users\Admin\AppData\Local\Temp\svchos.exe
Size 93KB
SHA256 62954fdf65e629b39a29f539619d20691332184c6b6be5a826128a8e759bfa84
MD5 3b377ad877a942ec9f60ea285f7119a2
SHA1 60b23987b20d913982f723ab375eef50fafa6c70
SHA512 af3a71f867ad9d28772c48b521097f9bf8931eb89fd2974e8de10990241419a39ddc3c0b36dd38aac4fdf14e1f0c5e228692618e93adce958d5b5dab8940e46f
SSDEEP 1536:ktbE7m8nNEQ2O6ReWMWfPbp2WTrW9L3JPPgJ+o5FJYHvh/P6:Bm+2LReWjTrW9rNPgYoTJYHvh
TLSH
T1B1934A41BE8CC869D05C81B03D7BA6B58422BC553900277B6F8AFB4FD976350EC2A5DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost.exe
Size 377KB
SHA256 6e0b7d205a400cf28ae3faa5a0c4b35016c24a5d818d770e54e3342857eae35c
MD5 9b3f9dce6748ab71769198b5dd5320d1
SHA1 06c76c2c3e2ef607612e2fde18797b6223f2bfe3
SHA512 00e756cfb85d3bd448a630b3f7617531b894a0e4cbf1fba58cab0bc0169bb9dcf80041ebb0cdc6e248df5a41322ee919f1d3a412d4dc8600755d4cf7f6e0ec90
SSDEEP 6144:5UGp2l6zRmeVLNH3ozQTAygOcqAJwQZgb4YtjH6/MuQafORzEOmFfMzi71o+YgL7:HclcceB3lKwAg0Mja/UafOVwbhF
TLSH
T139841241FF520123C70A71758CD88A6A9F667B888E560C2B7F746F4F0A702DE583AD39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

240758500.txt

Path C:\Windows\SysWOW64\240758500.txt
Size 50KB
SHA256 70aa0509dce70455724c5bfe595b5753aa461f6969e3b75097e5d929d924c65b
MD5 551e5ffc60b0a9eb898368b684f94b38
SHA1 ba1eba39a2a8d23a9e732d44f856f7a065e47952
SHA512 ab4c687064a48b6887aea03716caf218df285ce1f4a05f0c5543b5d4b74803802d712bf7477694c8d3a3f127171f5563ff0447e566acadd9e9a38e0de6b691d6
SSDEEP 1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5fJYH:W5ReWjTrW9rNPgYoFJYH
TLSH
T166333902DD8D88F5E141177039AA77B7953ABCE07A8526634F63DE69C87B330F42D286
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe

Path C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
Size 51KB
SHA256 ce6bb7eddc83762c708d4a41709ae00371dbdc09b2a380f28fa60b1edf917473
MD5 2e068ce2770fde8d1af4cb114b98df1f
SHA1 b6f9c2775babb025b22f915c3047aa627d07c312
SHA512 998d695eb56375e63df7db16740b89deb2cf630ccbead8bcf84a921ec6f4a4f9aef2755b703f7190f332b2008ebcc949363bcf8f392d7d07246c255b5073ed35
SSDEEP 1536:6G9yoVEpHP29I3fbcJboSUge5N+CnC/maz9Rh:8pv2mbcJboce58wvOR
TLSH
T137336C236A0A49B3DFE231780A9D7232526DD862075541F7A61057EAFD243E2EE743CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4820-5-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4820-7-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads