gh0strat | fed3e981fa5df7ac8734fae939e4009438d1da4bd6bac7ad2422a033908afd58

General

Target

fc6d30e57ccfd2db5e606eb1aa39e6ea_JaffaCakes118.exe
Size

252KB
MD5

fc6d30e57ccfd2db5e606eb1aa39e6ea
SHA1

02643940339c6507ca5772f801ea86ed12d3f2be
SHA256

fed3e981fa5df7ac8734fae939e4009438d1da4bd6bac7ad2422a033908afd58
SHA512

fdf007e72560b280c2a443e0d44b2dac796bb5af4742f3c7406fe5c15af6c31f06d8af37035dd27770690cb4169b188c4709d2444d592a912a0defe625801e69
SSDEEP

6144:07OgeNt0XPoBQfFMbE9XL4HE5kynHZ8uGjJZ9q624yIX6:qOgebeoiab8sNKotZ9q4y

Score

10^/10

gh0strat bootkit persistence rat

Malware Config

Signatures

Gh0st RAT payload 4 IoCs

Processes:

resource	yara_rule
C:\Program Files\Common Files\lanlam.dll	family_gh0strat
behavioral1/memory/2724-26-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral1/memory/1688-27-0x0000000000400000-0x0000000000476000-memory.dmp	family_gh0strat
behavioral1/memory/1688-43-0x0000000000400000-0x0000000000476000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2444 cmd.exe
Executes dropped EXE 2 IoCs

Processes:

lanlan.exelanlan.exe

pid process

2724 lanlan.exe
2800 lanlan.exe

pid	process
2444	cmd.exe

pid	process
2724	lanlan.exe
2800	lanlan.exe

Loads dropped DLL 11 IoCs

Processes:

fc6d30e57ccfd2db5e606eb1aa39e6ea_JaffaCakes118.exelanlan.exelanlan.exe

pid	process
1688	fc6d30e57ccfd2db5e606eb1aa39e6ea_JaffaCakes118.exe
2724	lanlan.exe
2724	lanlan.exe
2724	lanlan.exe
2724	lanlan.exe
2724	lanlan.exe
2724	lanlan.exe
1688	fc6d30e57ccfd2db5e606eb1aa39e6ea_JaffaCakes118.exe
2800	lanlan.exe
2800	lanlan.exe
2800	lanlan.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

lanlan.exe

description ioc process

File opened for modification \??\PhysicalDrive0 lanlan.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	lanlan.exe

Drops file in Program Files directory 5 IoCs

Processes:

fc6d30e57ccfd2db5e606eb1aa39e6ea_JaffaCakes118.exe

description	ioc	process
File created	C:\Program Files\Common Files\lanlan.bat	fc6d30e57ccfd2db5e606eb1aa39e6ea_JaffaCakes118.exe
File created	C:\Program Files\Common Files\lanlam.dll	fc6d30e57ccfd2db5e606eb1aa39e6ea_JaffaCakes118.exe
File created	C:\Program Files\Common Files\lanlan.dll	fc6d30e57ccfd2db5e606eb1aa39e6ea_JaffaCakes118.exe
File created	C:\Program Files\Common Files\lanlan.exe	fc6d30e57ccfd2db5e606eb1aa39e6ea_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\lanlan.exe	fc6d30e57ccfd2db5e606eb1aa39e6ea_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

lanlan.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	lanlan.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	lanlan.exe

Modifies registry class 4 IoCs

Processes:

lanlan.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{603D3801-BD81-11d0-A3A5-00C04FD706EC}\InProcServer32	lanlan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	lanlan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{603D3801-BD81-11d0-A3A5-00C04FD706EC}	lanlan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{603D3801-BD81-11D0-A3A5-00C04FD706EC}\InProcServer32	lanlan.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

lanlan.exe

pid process

2724 lanlan.exe
2724 lanlan.exe
2724 lanlan.exe

pid	process
2724	lanlan.exe
2724	lanlan.exe
2724	lanlan.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

fc6d30e57ccfd2db5e606eb1aa39e6ea_JaffaCakes118.exelanlan.exe

description	pid	process	target process
PID 1688 wrote to memory of 2724	1688	fc6d30e57ccfd2db5e606eb1aa39e6ea_JaffaCakes118.exe	lanlan.exe
PID 1688 wrote to memory of 2724	1688	fc6d30e57ccfd2db5e606eb1aa39e6ea_JaffaCakes118.exe	lanlan.exe
PID 1688 wrote to memory of 2724	1688	fc6d30e57ccfd2db5e606eb1aa39e6ea_JaffaCakes118.exe	lanlan.exe
PID 1688 wrote to memory of 2724	1688	fc6d30e57ccfd2db5e606eb1aa39e6ea_JaffaCakes118.exe	lanlan.exe
PID 1688 wrote to memory of 2724	1688	fc6d30e57ccfd2db5e606eb1aa39e6ea_JaffaCakes118.exe	lanlan.exe
PID 1688 wrote to memory of 2724	1688	fc6d30e57ccfd2db5e606eb1aa39e6ea_JaffaCakes118.exe	lanlan.exe
PID 1688 wrote to memory of 2724	1688	fc6d30e57ccfd2db5e606eb1aa39e6ea_JaffaCakes118.exe	lanlan.exe
PID 1688 wrote to memory of 2800	1688	fc6d30e57ccfd2db5e606eb1aa39e6ea_JaffaCakes118.exe	lanlan.exe
PID 1688 wrote to memory of 2800	1688	fc6d30e57ccfd2db5e606eb1aa39e6ea_JaffaCakes118.exe	lanlan.exe
PID 1688 wrote to memory of 2800	1688	fc6d30e57ccfd2db5e606eb1aa39e6ea_JaffaCakes118.exe	lanlan.exe
PID 1688 wrote to memory of 2800	1688	fc6d30e57ccfd2db5e606eb1aa39e6ea_JaffaCakes118.exe	lanlan.exe
PID 1688 wrote to memory of 2800	1688	fc6d30e57ccfd2db5e606eb1aa39e6ea_JaffaCakes118.exe	lanlan.exe
PID 1688 wrote to memory of 2800	1688	fc6d30e57ccfd2db5e606eb1aa39e6ea_JaffaCakes118.exe	lanlan.exe
PID 1688 wrote to memory of 2800	1688	fc6d30e57ccfd2db5e606eb1aa39e6ea_JaffaCakes118.exe	lanlan.exe
PID 2800 wrote to memory of 2500	2800	lanlan.exe	cmd.exe
PID 2800 wrote to memory of 2500	2800	lanlan.exe	cmd.exe
PID 2800 wrote to memory of 2500	2800	lanlan.exe	cmd.exe
PID 2800 wrote to memory of 2500	2800	lanlan.exe	cmd.exe
PID 2800 wrote to memory of 2500	2800	lanlan.exe	cmd.exe
PID 2800 wrote to memory of 2500	2800	lanlan.exe	cmd.exe
PID 2800 wrote to memory of 2500	2800	lanlan.exe	cmd.exe
PID 1688 wrote to memory of 2444	1688	fc6d30e57ccfd2db5e606eb1aa39e6ea_JaffaCakes118.exe	cmd.exe
PID 1688 wrote to memory of 2444	1688	fc6d30e57ccfd2db5e606eb1aa39e6ea_JaffaCakes118.exe	cmd.exe
PID 1688 wrote to memory of 2444	1688	fc6d30e57ccfd2db5e606eb1aa39e6ea_JaffaCakes118.exe	cmd.exe
PID 1688 wrote to memory of 2444	1688	fc6d30e57ccfd2db5e606eb1aa39e6ea_JaffaCakes118.exe	cmd.exe
PID 1688 wrote to memory of 2444	1688	fc6d30e57ccfd2db5e606eb1aa39e6ea_JaffaCakes118.exe	cmd.exe
PID 1688 wrote to memory of 2444	1688	fc6d30e57ccfd2db5e606eb1aa39e6ea_JaffaCakes118.exe	cmd.exe
PID 1688 wrote to memory of 2444	1688	fc6d30e57ccfd2db5e606eb1aa39e6ea_JaffaCakes118.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\fc6d30e57ccfd2db5e606eb1aa39e6ea_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fc6d30e57ccfd2db5e606eb1aa39e6ea_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1688

C:\Program Files\Common Files\lanlan.exe
"C:\Program Files\Common Files\lanlan.exe" "C:\Program Files\Common Files\lanlam.dll" ServiceMain
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2724

C:\Documents and Settings\lanlan.exe
"C:\Documents and Settings\lanlan.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2800

C:\Windows\SysWOW64\cmd.exe
cmd /c del C:\DOCUME~1\lanlan.exe
3⤵
PID:2500

C:\Windows\SysWOW64\cmd.exe
cmd /c del C:\Users\Admin\AppData\Local\Temp\FC6D30~1.EXE
2⤵
- Deletes itself
PID:2444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\lanlam.dll

Filesize
24.1MB

MD5
af56f5e09ec5c0c88f36dbcd0573e60b

SHA1
a19d780553f357d8726e6ec04e4e29b01259c494

SHA256
46c09db83751b130ad03e4fdaaa19cc35a8e9ef55cf1ab8ebcb03399634e4776

SHA512
0c76c819bfe28eb440b05531fb1be635e62949e4d6c92f55d7c9843595124ec99c3fa3740105d1e040c6c4360243b219d7e7d6eeef1e7e161d339aa0ccc60398

Download Submit
\Program Files\Common Files\lanlan.exe

Filesize
43KB

MD5
51138beea3e2c21ec44d0932c71762a8

SHA1
8939cf35447b22dd2c6e6f443446acc1bf986d58

SHA256
5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

SHA512
794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

Download Submit
\Users\lanlan.exe

Filesize
24.0MB

MD5
bd105728d451a8dc5f64a4fdc82d3141

SHA1
280135b79c3a052bba1441bdc793c4a63d4f87db

SHA256
cb61848152ab6c500b08004c6fe67375e4377e9f5d615349fdfdff718372d87e

SHA512
09b641749c35c1e8c57159aa269901512b0a3666302b4d6c7c1948b680efa335b9b17ce049a868c1f36e2bad33e0099a56a0e7cbd601cd2cb3225ea655daaef4

Download Submit
memory/1688-4-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/1688-43-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/1688-6-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/1688-5-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/1688-7-0x00000000002F0000-0x00000000002F2000-memory.dmp

Filesize
8KB

Download
memory/1688-3-0x0000000000320000-0x000000000035E000-memory.dmp

Filesize
248KB

Download
memory/1688-2-0x0000000000320000-0x000000000035E000-memory.dmp

Filesize
248KB

Download
memory/1688-0-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/1688-33-0x00000000003E0000-0x00000000003E6000-memory.dmp

Filesize
24KB

Download
memory/1688-27-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/1688-28-0x0000000000320000-0x000000000035E000-memory.dmp

Filesize
248KB

Download
memory/1688-1-0x00000000002E0000-0x0000000000356000-memory.dmp

Filesize
472KB

Download
memory/1688-42-0x0000000000320000-0x000000000035E000-memory.dmp

Filesize
248KB

Download
memory/2724-26-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/2724-24-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/2800-39-0x0000000000020000-0x0000000000026000-memory.dmp

Filesize
24KB

Download
memory/2800-41-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2800-40-0x0000000000020000-0x0000000000026000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads