gh0strat | a9005337ee42d933713cdb8fe8a777d36403b37649676ceb2d2c2417a8e91a04

General

Target

fbce6a70198854557fbeca0f09587758_JaffaCakes118.exe
Size

371KB
MD5

fbce6a70198854557fbeca0f09587758
SHA1

0b913a3dbfe070b927b197462eba5033ab88dd4b
SHA256

a9005337ee42d933713cdb8fe8a777d36403b37649676ceb2d2c2417a8e91a04
SHA512

487a428dad968f6b13e9964e7c30bbcdc1c8254d41188a9d28dd51b78d396974c65df3aac2d69cf50994c23c9a598649e5f0b4d3709c28b586531f969ba40e5e
SSDEEP

6144:cQqek/BOtrgHyI/cXqUul/R0dPE1Nxw6sLcWaWPve1BQ4rO4Xc6dzO3cAO/mQ:8Vy5hWRecPxw6icWaWPvenAqD7

Score

10^/10

gh0strat persistence rat

Malware Config

Signatures

Gh0st RAT payload 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1192-24-0x0000000010000000-0x0000000010121000-memory.dmp	family_gh0strat
behavioral2/memory/1192-23-0x0000000010000000-0x0000000010121000-memory.dmp	family_gh0strat
behavioral2/memory/1192-25-0x0000000010000000-0x0000000010121000-memory.dmp	family_gh0strat
behavioral2/memory/1192-29-0x0000000010000000-0x0000000010121000-memory.dmp	family_gh0strat
behavioral2/memory/1192-31-0x0000000010000000-0x0000000010121000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

fbce6a70198854557fbeca0f09587758_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation	fbce6a70198854557fbeca0f09587758_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

Processes:

Seel.exenw_elf.exe

pid process

1192 Seel.exe
1492 nw_elf.exe

pid	process
1192	Seel.exe
1492	nw_elf.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Seel.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XXXXXXFF947DFE = "C:\\Windows\\XXXXXXFF947DFE\\svchsot.exe"	Seel.exe

Drops file in Windows directory 2 IoCs

Processes:

Seel.exe

description	ioc	process
File created	C:\Windows\XXXXXXFF947DFE\svchsot.exe	Seel.exe
File opened for modification	C:\Windows\XXXXXXFF947DFE\svchsot.exe	Seel.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

Seel.exe

pid process

1192 Seel.exe
1192 Seel.exe
1192 Seel.exe
1192 Seel.exe
1192 Seel.exe
1192 Seel.exe

pid	process
1192	Seel.exe
1192	Seel.exe
1192	Seel.exe
1192	Seel.exe
1192	Seel.exe
1192	Seel.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

fbce6a70198854557fbeca0f09587758_JaffaCakes118.exe

description	pid	process	target process
PID 2152 wrote to memory of 1192	2152	fbce6a70198854557fbeca0f09587758_JaffaCakes118.exe	Seel.exe
PID 2152 wrote to memory of 1192	2152	fbce6a70198854557fbeca0f09587758_JaffaCakes118.exe	Seel.exe
PID 2152 wrote to memory of 1192	2152	fbce6a70198854557fbeca0f09587758_JaffaCakes118.exe	Seel.exe
PID 2152 wrote to memory of 1492	2152	fbce6a70198854557fbeca0f09587758_JaffaCakes118.exe	nw_elf.exe
PID 2152 wrote to memory of 1492	2152	fbce6a70198854557fbeca0f09587758_JaffaCakes118.exe	nw_elf.exe
PID 2152 wrote to memory of 1492	2152	fbce6a70198854557fbeca0f09587758_JaffaCakes118.exe	nw_elf.exe

C:\Users\Admin\AppData\Local\Temp\fbce6a70198854557fbeca0f09587758_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fbce6a70198854557fbeca0f09587758_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2152

C:\Windows\temp\Seel.exe
"C:\Windows\temp\Seel.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1192

C:\Windows\temp\nw_elf.exe
"C:\Windows\temp\nw_elf.exe"
2⤵
- Executes dropped EXE
PID:1492

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Temp\Seel.exe
Filesize
192KB

MD5
5b14b65e3d82b9105a6716d57c94b2ab

SHA1
ebdff3e9b9b9ff4d1b62fd0d66238ac76923d6f4

SHA256
907197572441adc0d0f205079b80005e5f484bee40dbdbd25abd65e157b4942b

SHA512
2204a82c2c896c446f4488b536d1606195112b3ed98c3af52acb7895101ddf8241a7266a35388fb841827d3b5444d567e8711392ba9d62079bb8d0eadee44b78

Download Submit
C:\Windows\Temp\nw_elf.exe
Filesize
573KB

MD5
b51f17be01243934bd9b507bb3082498

SHA1
9cd50f951518c4ab68d6140663c80d4688849823

SHA256
c286536081ae21b1210e9b2d44cad98ba7849dcfcc1e3c864e9e60216682bd27

SHA512
68e801a23508d0e30975df618b15840ee588b4ffa5ce2a8ca1a710886559e45a7e37b25d5626d802fb5434820992f362815e335123352aab8867dad44732f2ab

Download Submit
memory/1192-19-0x0000000010000000-0x0000000010121000-memory.dmp

Filesize
1.1MB

Download
memory/1192-24-0x0000000010000000-0x0000000010121000-memory.dmp

Filesize
1.1MB

Download
memory/1192-23-0x0000000010000000-0x0000000010121000-memory.dmp

Filesize
1.1MB

Download
memory/1192-25-0x0000000010000000-0x0000000010121000-memory.dmp

Filesize
1.1MB

Download
memory/1192-26-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/1192-29-0x0000000010000000-0x0000000010121000-memory.dmp

Filesize
1.1MB

Download
memory/1192-31-0x0000000010000000-0x0000000010121000-memory.dmp

Filesize
1.1MB

Download
memory/1192-34-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/1492-21-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads