gh0strat | 1ffbab182888cc88fb717457e47a6733ceb621558b79d86408e68da8111c7a99

General

Target
1ffbab182888cc88fb717457e47a6733ceb621558b79d86408e68da8111c7a99.exe
Size 11.9MB
Sample260730-ervd1abe45
SHA256 1ffbab182888cc88fb717457e47a6733ceb621558b79d86408e68da8111c7a99
MD5 00df96d40d8e21079dafb9d8377866e3
SHA1 974240517428de8efd05a91418feb3fcd1af22e6
SHA512 c9a3e8dc6e5ab28d841dbc1072cb17fe1237ca5c1c43b1408b017548ee6492b9bbfd0f6f144dd4670826cb097c588099e784d1cf9c49dd650b2e9ccaa5dcf433
SSDEEP 196608:hWT9nP7L4adWhxSd/FUpoWyKAozKY4TPLKAouKn:q7LjdWxu/mpodKACXCzKATY
TLSH
T15BC69496D633D46ADCD3A57821A60872FA057D26ACD468AC61D0B723E8702634CF7CDF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery gh0strat persistence rat upx

Malware Config

Signatures

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Gh0st RAT payload 2 IoCs

resource	yara_rule
behavioral2/memory/5616-7-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/files/0x001100000001c505-14.dat	family_gh0strat

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ö÷¶¯·ÀÓù·þÎñÄ£¿é\Parameters\ServiceDll = "C:\\Windows\\system32\\240731781.txt"	svchos.exe

Executes dropped EXE 4 IoCs

pid	Process
5616	svchost.exe
3472	svchos.exe
4084	HD_1ffbab182888cc88fb717457e47a6733ceb621558b79d86408e68da8111c7a99.exe
4088	Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe

Loads dropped DLL 3 IoCs

pid	Process
3472	svchos.exe
2432	svchost.exe
4088	Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\240731781.txt	svchos.exe
File opened for modification	C:\Windows\SysWOW64\ini.ini	svchos.exe
File created	C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe	svchost.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5616-5-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/5616-7-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	1ffbab182888cc88fb717457e47a6733ceb621558b79d86408e68da8111c7a99.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	1ffbab182888cc88fb717457e47a6733ceb621558b79d86408e68da8111c7a99.exe
File created	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	1ffbab182888cc88fb717457e47a6733ceb621558b79d86408e68da8111c7a99.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	1ffbab182888cc88fb717457e47a6733ceb621558b79d86408e68da8111c7a99.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4404	5616	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HD_1ffbab182888cc88fb717457e47a6733ceb621558b79d86408e68da8111c7a99.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1ffbab182888cc88fb717457e47a6733ceb621558b79d86408e68da8111c7a99.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1188	1ffbab182888cc88fb717457e47a6733ceb621558b79d86408e68da8111c7a99.exe
1188	1ffbab182888cc88fb717457e47a6733ceb621558b79d86408e68da8111c7a99.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1188	1ffbab182888cc88fb717457e47a6733ceb621558b79d86408e68da8111c7a99.exe
1188	1ffbab182888cc88fb717457e47a6733ceb621558b79d86408e68da8111c7a99.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 5616	1188	1ffbab182888cc88fb717457e47a6733ceb621558b79d86408e68da8111c7a99.exe	89
PID 1188 wrote to memory of 3472	1188	1ffbab182888cc88fb717457e47a6733ceb621558b79d86408e68da8111c7a99.exe	93
PID 1188 wrote to memory of 4084	1188	1ffbab182888cc88fb717457e47a6733ceb621558b79d86408e68da8111c7a99.exe	98
PID 2432 wrote to memory of 4088	2432	svchost.exe	100

C:\Users\Admin\AppData\Local\Temp\1ffbab182888cc88fb717457e47a6733ceb621558b79d86408e68da8111c7a99.exe
"C:\Users\Admin\AppData\Local\Temp\1ffbab182888cc88fb717457e47a6733ceb621558b79d86408e68da8111c7a99.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  C:\Users\Admin\AppData\Local\Temp\\svchost.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5616
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5616 -s 580
    3⤵
    - Program crash
    PID:4404
- C:\Users\Admin\AppData\Local\Temp\svchos.exe
  C:\Users\Admin\AppData\Local\Temp\\svchos.exe
  2⤵
  - Server Software Component: Terminal Services DLL
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:3472
- C:\Users\Admin\AppData\Local\Temp\HD_1ffbab182888cc88fb717457e47a6733ceb621558b79d86408e68da8111c7a99.exe
  C:\Users\Admin\AppData\Local\Temp\HD_1ffbab182888cc88fb717457e47a6733ceb621558b79d86408e68da8111c7a99.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5616 -ip 5616
1⤵
PID:1376

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"
1⤵
PID:2792

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
  C:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\240731781.txt",MainThread
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4088

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k "╓≈╢»╖└╙∙╖■╬±─ú┐Θ"
1⤵
PID:1832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

1

T1505

Terminal Services DLL

1

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HD_1ffbab182888cc88fb717457e47a6733ceb621558b79d86408e68da8111c7a99.exe

Path C:\Users\Admin\AppData\Local\Temp\HD_1ffbab182888cc88fb717457e47a6733ceb621558b79d86408e68da8111c7a99.exe
Size 10.5MB
SHA256 a9a4a6422aea5c2eb914a45c56f02e59fa3142e04f9ab36d623c240f5c3765c1
MD5 3db529e99290bb576f42d9031fca7054
SHA1 651a3190ccaa05a44f34e90bc6cd814315e2aad1
SHA512 ae74e499a0b55f9bec1c2580788eda058fcf1eed5de96cecc50fa2206951319052e56429dd79240d7aa667e86c79a08757fe26841b88f220c0470322d10ddecf
SSDEEP 196608:84adWhxSd/FUpoWyKAozKY4TPLKAouKn:8jdWxu/mpodKACXCzKATY
TLSH
T161B64296D637D46ADCD3A57821A60872FA057D26ACD428AC61D0B723E8702634CF7CDF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HD_X.dat

Path C:\Users\Admin\AppData\Local\Temp\HD_X.dat
Size 1.3MB
SHA256 3542249c9ccccde19348b625744bbe8166f483a411f003b049114685f8d92503
MD5 c1480fb8ac0a520040d7d3454f0ee7df
SHA1 54c328740a8415240c580c671da0bb68db2a76c6
SHA512 e4cbb17e58d00a9b1a3e51149f52feef95c884408d3eeece6e89af8460e06d4d7f2f78779a95789847625f7523cfba294565bc27e1d1bd501e79d8352b54efe3
SSDEEP 24576:hQZoidOTdVZinacCET9Ecl1eadg0MCiVWhFU7cVF:hQZAdVyVT9n/Xg0P+WhoW
TLSH
T1FC55C012B98280B2D208307008BE2779DE755E752B21CBD7A758FE1D7D36681EA3717B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchos.exe

Path C:\Users\Admin\AppData\Local\Temp\svchos.exe
Size 93KB
SHA256 62954fdf65e629b39a29f539619d20691332184c6b6be5a826128a8e759bfa84
MD5 3b377ad877a942ec9f60ea285f7119a2
SHA1 60b23987b20d913982f723ab375eef50fafa6c70
SHA512 af3a71f867ad9d28772c48b521097f9bf8931eb89fd2974e8de10990241419a39ddc3c0b36dd38aac4fdf14e1f0c5e228692618e93adce958d5b5dab8940e46f
SSDEEP 1536:ktbE7m8nNEQ2O6ReWMWfPbp2WTrW9L3JPPgJ+o5FJYHvh/P6:Bm+2LReWjTrW9rNPgYoTJYHvh
TLSH
T1B1934A41BE8CC869D05C81B03D7BA6B58422BC553900277B6F8AFB4FD976350EC2A5DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost.exe
Size 377KB
SHA256 6e0b7d205a400cf28ae3faa5a0c4b35016c24a5d818d770e54e3342857eae35c
MD5 9b3f9dce6748ab71769198b5dd5320d1
SHA1 06c76c2c3e2ef607612e2fde18797b6223f2bfe3
SHA512 00e756cfb85d3bd448a630b3f7617531b894a0e4cbf1fba58cab0bc0169bb9dcf80041ebb0cdc6e248df5a41322ee919f1d3a412d4dc8600755d4cf7f6e0ec90
SSDEEP 6144:5UGp2l6zRmeVLNH3ozQTAygOcqAJwQZgb4YtjH6/MuQafORzEOmFfMzi71o+YgL7:HclcceB3lKwAg0Mja/UafOVwbhF
TLSH
T139841241FF520123C70A71758CD88A6A9F667B888E560C2B7F746F4F0A702DE583AD39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

240731781.txt

Path C:\Windows\SysWOW64\240731781.txt
Size 50KB
SHA256 70aa0509dce70455724c5bfe595b5753aa461f6969e3b75097e5d929d924c65b
MD5 551e5ffc60b0a9eb898368b684f94b38
SHA1 ba1eba39a2a8d23a9e732d44f856f7a065e47952
SHA512 ab4c687064a48b6887aea03716caf218df285ce1f4a05f0c5543b5d4b74803802d712bf7477694c8d3a3f127171f5563ff0447e566acadd9e9a38e0de6b691d6
SSDEEP 1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5fJYH:W5ReWjTrW9rNPgYoFJYH
TLSH
T166333902DD8D88F5E141177039AA77B7953ABCE07A8526634F63DE69C87B330F42D286
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe

Path C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
Size 51KB
SHA256 ce6bb7eddc83762c708d4a41709ae00371dbdc09b2a380f28fa60b1edf917473
MD5 2e068ce2770fde8d1af4cb114b98df1f
SHA1 b6f9c2775babb025b22f915c3047aa627d07c312
SHA512 998d695eb56375e63df7db16740b89deb2cf630ccbead8bcf84a921ec6f4a4f9aef2755b703f7190f332b2008ebcc949363bcf8f392d7d07246c255b5073ed35
SSDEEP 1536:6G9yoVEpHP29I3fbcJboSUge5N+CnC/maz9Rh:8pv2mbcJboce58wvOR
TLSH
T137336C236A0A49B3DFE231780A9D7232526DD862075541F7A61057EAFD243E2EE743CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5616-5-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/5616-7-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads