gh0strat | d086fbf17a14ccd60367e3666dc2ba0b394d9001463332aa2ebbe9a4feebb48c

General

Target
d086fbf17a14ccd60367e3666dc2ba0b394d9001463332aa2ebbe9a4feebb48c.exe
Size 1.4MB
Sample260819-xf5pps1bpc
SHA256 d086fbf17a14ccd60367e3666dc2ba0b394d9001463332aa2ebbe9a4feebb48c
MD5 5951dd8fdde04e6f8ef0569305aa9983
SHA1 f92ffbef890f31edb5a8364c1dd4416603ee525e
SHA512 d1ade5ed63e60b3bcc3fac6be02e76d4f980d8d942718d02f04c6b5df169bbec25904745fd334365f6b07b93559d6bfdb6b3f63433549ad4d2d9199557a8e601
SSDEEP 24576:BEdksIGN71VVbzYEL+5dNmZG8RRl9T7tqA8rvD+IKpSHFi:BEywVVvUji3TIA8rvD+IKpSHFi
TLSH
T17B65BE52B880C4F9D5192031D8A7DB3255B6AF560A21469BB3EDFF2C7873B42113F62B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery gh0strat persistence rat

Malware Config

Signatures

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/files/0x0005000000016b3f-6.dat	family_gh0strat

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\svchist\Parameters\ServiceDll = "C:\\Windows\\system32\\240747937.bat"	GLk.exe

Executes dropped EXE 2 IoCs

pid	Process
4984	GLk.exe
5484	svchist.exe

Loads dropped DLL 3 IoCs

pid	Process
4984	GLk.exe
3716	svchost.exe
5484	svchist.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\svchist.exe	svchost.exe
File created	C:\Windows\SysWOW64\240747937.bat	GLk.exe
File opened for modification	C:\Windows\SysWOW64\ini.ini	GLk.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d086fbf17a14ccd60367e3666dc2ba0b394d9001463332aa2ebbe9a4feebb48c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GLk.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
796	d086fbf17a14ccd60367e3666dc2ba0b394d9001463332aa2ebbe9a4feebb48c.exe
796	d086fbf17a14ccd60367e3666dc2ba0b394d9001463332aa2ebbe9a4feebb48c.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 796 wrote to memory of 4984	796	d086fbf17a14ccd60367e3666dc2ba0b394d9001463332aa2ebbe9a4feebb48c.exe	89
PID 3716 wrote to memory of 5484	3716	svchost.exe	95

C:\Users\Admin\AppData\Local\Temp\d086fbf17a14ccd60367e3666dc2ba0b394d9001463332aa2ebbe9a4feebb48c.exe
"C:\Users\Admin\AppData\Local\Temp\d086fbf17a14ccd60367e3666dc2ba0b394d9001463332aa2ebbe9a4feebb48c.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:796
- C:\Users\Admin\AppData\Local\Temp\GLk.exe
  C:\Users\Admin\AppData\Local\Temp\\GLk.exe
  2⤵
  - Server Software Component: Terminal Services DLL
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:4984

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "svchist"
1⤵
PID:2788

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "svchist"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Windows\SysWOW64\svchist.exe
  C:\Windows\system32\svchist.exe "c:\windows\system32\240747937.bat",MainThread
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5484

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k "svchist"
1⤵
PID:2012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

1

T1505

Terminal Services DLL

1

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GLk.exe

Path C:\Users\Admin\AppData\Local\Temp\GLk.exe
Size 337KB
SHA256 334e8e7c65b087985766d652f70b710bdba6aea55a2fa17b97ba2961e8eee9df
MD5 b8e58a96761799f4ad0548dba39d650c
SHA1 c00032d40cfbe4ccfd3ce3e4c8defb2a2ef9fc1f
SHA512 1cd94994ed3f6594e37e6cd1d266ff96bb37c5e99d9ce6fd4637ed615ee8c6496b54a025fdccced6fca200f8f2da8011177c67c943676b30bfb0655393765fe3
SSDEEP 6144:8IXwWcHnNmZEvB7csAPRZyfQjCfA3lMXm4Y+5bFnWBFopJO4:8IXwDNmZEvJcscRZzjCI1O5W
TLSH
T16E74BF137FE4C8B6C59351324EE25F7AA1F6FE902E224A4323956F0CDD32791963A316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HD_X.dat

Path C:\Users\Admin\AppData\Local\Temp\HD_X.dat
Size 1.4MB
SHA256 d086fbf17a14ccd60367e3666dc2ba0b394d9001463332aa2ebbe9a4feebb48c
MD5 5951dd8fdde04e6f8ef0569305aa9983
SHA1 f92ffbef890f31edb5a8364c1dd4416603ee525e
SHA512 d1ade5ed63e60b3bcc3fac6be02e76d4f980d8d942718d02f04c6b5df169bbec25904745fd334365f6b07b93559d6bfdb6b3f63433549ad4d2d9199557a8e601
SSDEEP 24576:BEdksIGN71VVbzYEL+5dNmZG8RRl9T7tqA8rvD+IKpSHFi:BEywVVvUji3TIA8rvD+IKpSHFi
TLSH
T17B65BE52B880C4F9D5192031D8A7DB3255B6AF560A21469BB3EDFF2C7873B42113F62B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

240747937.bat

Path C:\Windows\SysWOW64\240747937.bat
Size 51KB
SHA256 a0dfc7740b42f21c8b51f679ccea51d9144e44e410eb8ecefe50b0882385bbaf
MD5 3f1ed7e9c32d3f4248a774847177d028
SHA1 81a69e8113b64f5c8e1a42a778fedf60f781e5c7
SHA512 4a209ddd14053a32655c2a66e67c751402def169a6e9faf8c4f9cc9609781a9de70d5110f72f758e72a7b274d6fbdcbc53250ba957214c53f34c4f0bc5b1de3b
SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL+5JYH5:1dWubF3n9S91BF3fbo+JYH5
TLSH
T19D334A02EE8D88F5F145177038AA33B6953ABDE036996A931F53DDA5C87B370F12D242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchist.exe

Path C:\Windows\SysWOW64\svchist.exe
Size 51KB
SHA256 ce6bb7eddc83762c708d4a41709ae00371dbdc09b2a380f28fa60b1edf917473
MD5 2e068ce2770fde8d1af4cb114b98df1f
SHA1 b6f9c2775babb025b22f915c3047aa627d07c312
SHA512 998d695eb56375e63df7db16740b89deb2cf630ccbead8bcf84a921ec6f4a4f9aef2755b703f7190f332b2008ebcc949363bcf8f392d7d07246c255b5073ed35
SSDEEP 1536:6G9yoVEpHP29I3fbcJboSUge5N+CnC/maz9Rh:8pv2mbcJboce58wvOR
TLSH
T137336C236A0A49B3DFE231780A9D7232526DD862075541F7A61057EAFD243E2EE743CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads