gh0strat | 4541136faa3545a933c0e68bf80e7327111f6349010ed27223d33e7f1671752b

Analysis

max time kernel
138s
max time network
151s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
05-07-2024 05:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4541136faa3545a933c0e68bf80e7327111f6349010ed27223d33e7f1671752b.exe
Size

1.6MB
MD5

8c8ab0b2f34f9da2f6427b58d679164f
SHA1

d163b3f3e581ae84e4d68884208c58bd0b937693
SHA256

4541136faa3545a933c0e68bf80e7327111f6349010ed27223d33e7f1671752b
SHA512

059b54d49dfb4e3c21eeaf7d6803608d549be177a0e956cdbca02a3daae5e4ce8a0e8fe879fa0ce3cd9905053180a54a6c69fe8bc5833c2de0e1789488c38afe
SSDEEP

24576:FYFbkIsaPiXSVnC7Yp9zjNmZG8RRl9HvyzxWPY8sDrXjioG0X:FYREXSVMKi3LFsDrXjF

Score

10^/10

gh0strat persistence rat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

Processes:

resource yara_rule

\Windows\SysWOW64\259401488.bat family_gh0strat
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
persistence

Terminal Services DLL
T1505.005

Processes:

look2.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\svchcst\Parameters\ServiceDll = "C:\\Windows\\system32\\259401488.bat" look2.exe
Executes dropped EXE 2 IoCs

Processes:

look2.exesvchcst.exe

pid process

2132 look2.exe
2896 svchcst.exe
Loads dropped DLL 5 IoCs

Processes:

4541136faa3545a933c0e68bf80e7327111f6349010ed27223d33e7f1671752b.exelook2.exesvchost.exesvchcst.exe

pid process

2424 4541136faa3545a933c0e68bf80e7327111f6349010ed27223d33e7f1671752b.exe
2132 look2.exe
2116 svchost.exe
2116 svchost.exe
2896 svchcst.exe

resource	yara_rule
\Windows\SysWOW64\259401488.bat	family_gh0strat

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\svchcst\Parameters\ServiceDll = "C:\\Windows\\system32\\259401488.bat"	look2.exe

pid	process
2132	look2.exe
2896	svchcst.exe

pid	process
2424	4541136faa3545a933c0e68bf80e7327111f6349010ed27223d33e7f1671752b.exe
2132	look2.exe
2116	svchost.exe
2116	svchost.exe
2896	svchcst.exe

Drops file in System32 directory 4 IoCs

Processes:

look2.exesvchost.exe

description	ioc	process
File created	C:\Windows\SysWOW64\259401488.bat	look2.exe
File opened for modification	C:\Windows\SysWOW64\ini.ini	look2.exe
File created	C:\Windows\SysWOW64\svchcst.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchcst.exe	svchost.exe

Drops file in Program Files directory 1 IoCs

Processes:

4541136faa3545a933c0e68bf80e7327111f6349010ed27223d33e7f1671752b.exe

description ioc process

File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe 4541136faa3545a933c0e68bf80e7327111f6349010ed27223d33e7f1671752b.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

4541136faa3545a933c0e68bf80e7327111f6349010ed27223d33e7f1671752b.exe

pid process

2424 4541136faa3545a933c0e68bf80e7327111f6349010ed27223d33e7f1671752b.exe
2424 4541136faa3545a933c0e68bf80e7327111f6349010ed27223d33e7f1671752b.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	4541136faa3545a933c0e68bf80e7327111f6349010ed27223d33e7f1671752b.exe

pid	process
2424	4541136faa3545a933c0e68bf80e7327111f6349010ed27223d33e7f1671752b.exe
2424	4541136faa3545a933c0e68bf80e7327111f6349010ed27223d33e7f1671752b.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

4541136faa3545a933c0e68bf80e7327111f6349010ed27223d33e7f1671752b.exesvchost.exe

description	pid	process	target process
PID 2424 wrote to memory of 2132	2424	4541136faa3545a933c0e68bf80e7327111f6349010ed27223d33e7f1671752b.exe	look2.exe
PID 2424 wrote to memory of 2132	2424	4541136faa3545a933c0e68bf80e7327111f6349010ed27223d33e7f1671752b.exe	look2.exe
PID 2424 wrote to memory of 2132	2424	4541136faa3545a933c0e68bf80e7327111f6349010ed27223d33e7f1671752b.exe	look2.exe
PID 2424 wrote to memory of 2132	2424	4541136faa3545a933c0e68bf80e7327111f6349010ed27223d33e7f1671752b.exe	look2.exe
PID 2116 wrote to memory of 2896	2116	svchost.exe	svchcst.exe
PID 2116 wrote to memory of 2896	2116	svchost.exe	svchcst.exe
PID 2116 wrote to memory of 2896	2116	svchost.exe	svchcst.exe
PID 2116 wrote to memory of 2896	2116	svchost.exe	svchcst.exe

C:\Users\Admin\AppData\Local\Temp\4541136faa3545a933c0e68bf80e7327111f6349010ed27223d33e7f1671752b.exe
"C:\Users\Admin\AppData\Local\Temp\4541136faa3545a933c0e68bf80e7327111f6349010ed27223d33e7f1671752b.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2424

C:\Users\Admin\AppData\Local\Temp\look2.exe
C:\Users\Admin\AppData\Local\Temp\\look2.exe
2⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2132

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "svchcst"
1⤵
PID:1724

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "svchcst"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2116

C:\Windows\SysWOW64\svchcst.exe
C:\Windows\system32\svchcst.exe "c:\windows\system32\259401488.bat",MainThread
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\HD_X.dat
Filesize
1.6MB

MD5
8c8ab0b2f34f9da2f6427b58d679164f

SHA1
d163b3f3e581ae84e4d68884208c58bd0b937693

SHA256
4541136faa3545a933c0e68bf80e7327111f6349010ed27223d33e7f1671752b

SHA512
059b54d49dfb4e3c21eeaf7d6803608d549be177a0e956cdbca02a3daae5e4ce8a0e8fe879fa0ce3cd9905053180a54a6c69fe8bc5833c2de0e1789488c38afe

Download Submit
\Users\Admin\AppData\Local\Temp\look2.exe
Filesize
337KB

MD5
fb66e1e31fa1e6dfb21a50ccd11e0409

SHA1
6c45a0a115ec896eb14a531a44809b2a22cf8934

SHA256
5ea8c5455f0ebe884ed98834e78ead8b6c68814bbb1723370299fa44b88c0faa

SHA512
58ee149f70438296a67d5ae5cbd6cb9f5b2510a0381466b8f09eec3835be1ce7cad6903ca8fbc9273105132e85952208e78c59f776416c5449b86cc62111154b

Download Submit
\Windows\SysWOW64\259401488.bat
Filesize
51KB

MD5
2f72950317e7cd4fa5622beba87ecf9c

SHA1
2e03a75e6146bcfea007b52a00f24d0f571bb22a

SHA256
b3ca2518d6596f0322fc74fe3d16ca4b3efeb45e279b2e5d60e56ecbe0cde0a0

SHA512
91287a2a674c0f599438a9b505c4ccb5644c0161f6b94c7c032bd9e3d15e4c38547fe61f034493503aa57aae2c547b17bceab8c0c54fae2e675bb7f0ba0bb8f9

Download Submit
\Windows\SysWOW64\svchcst.exe
Filesize
43KB

MD5
51138beea3e2c21ec44d0932c71762a8

SHA1
8939cf35447b22dd2c6e6f443446acc1bf986d58

SHA256
5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

SHA512
794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

Download Submit