gh0strat | ebe5c1b1c1c0084004c92a3f5f70a88102c76477f218df4eec5cb4b451349e3a

General

Target

066e5193d94698b82034ea2149e55f89_JaffaCakes118.exe
Size

5.0MB
MD5

066e5193d94698b82034ea2149e55f89
SHA1

ba2907c9b72469afdd9e61d74a02000960d12371
SHA256

ebe5c1b1c1c0084004c92a3f5f70a88102c76477f218df4eec5cb4b451349e3a
SHA512

de63a58e4062c48fe3d7a05690f98c5fe40150c677a0bdbf1763c4e4f71bf1782927e67f0e37688760b598219681710d80d70220c29f7c54c82b5a168b5a77d8
SSDEEP

98304:jFXSKaSL7oqAJVARqbcmRnLdXKNjk57Xxm1L043b/imFAKzPq/3rybeRq:xXaSLTA00c4c1lL/rZWDbI

Score

10^/10

gh0strat runningrat persistence rat

Malware Config

Extracted

Family

gh0strat

C2

fwq.kuai-go.com

Signatures

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
\ProgramData\259404702.dll	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
RunningRat
RunningRat is a remote access trojan first seen in 2018.
rat runningrat

RunningRat payload 1 IoCs

Processes:

resource	yara_rule
C:\ProgramData\Temp\server.exe	family_runningrat

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

server.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\dmw\Parameters\ServiceDll = "C:\\ProgramData\\259404702.dll"	server.exe

Executes dropped EXE 2 IoCs

Processes:

server.exedmw.exe

pid process

1560 server.exe
1412 dmw.exe
Loads dropped DLL 9 IoCs

Processes:

WScript.exeserver.exesvchost.exedmw.exe

pid process

1632 WScript.exe
1632 WScript.exe
1560 server.exe
2296 svchost.exe
2296 svchost.exe
1412 dmw.exe
1412 dmw.exe
1412 dmw.exe
1412 dmw.exe
Creates a Windows Service
persistence
Drops file in System32 directory 2 IoCs

Processes:

svchost.exe

description ioc process

File created C:\Windows\SysWOW64\dmw.exe svchost.exe
File opened for modification C:\Windows\SysWOW64\dmw.exe svchost.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

620 PING.EXE
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

server.exe

pid process

1560 server.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

server.exe

description pid process

Token: SeIncBasePriorityPrivilege 1560 server.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

server.exe

pid process

1560 server.exe

pid	process
1560	server.exe
1412	dmw.exe

pid	process
1632	WScript.exe
1632	WScript.exe
1560	server.exe
2296	svchost.exe
2296	svchost.exe
1412	dmw.exe
1412	dmw.exe
1412	dmw.exe
1412	dmw.exe

description	ioc	process
File created	C:\Windows\SysWOW64\dmw.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\dmw.exe	svchost.exe

pid	process
620	PING.EXE

pid	process
1560	server.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	1560	server.exe

pid	process
1560	server.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

066e5193d94698b82034ea2149e55f89_JaffaCakes118.exeWScript.exeserver.execmd.exesvchost.exe

description	pid	process	target process
PID 2664 wrote to memory of 1632	2664	066e5193d94698b82034ea2149e55f89_JaffaCakes118.exe	WScript.exe
PID 2664 wrote to memory of 1632	2664	066e5193d94698b82034ea2149e55f89_JaffaCakes118.exe	WScript.exe
PID 2664 wrote to memory of 1632	2664	066e5193d94698b82034ea2149e55f89_JaffaCakes118.exe	WScript.exe
PID 2664 wrote to memory of 1632	2664	066e5193d94698b82034ea2149e55f89_JaffaCakes118.exe	WScript.exe
PID 1632 wrote to memory of 1560	1632	WScript.exe	server.exe
PID 1632 wrote to memory of 1560	1632	WScript.exe	server.exe
PID 1632 wrote to memory of 1560	1632	WScript.exe	server.exe
PID 1632 wrote to memory of 1560	1632	WScript.exe	server.exe
PID 1560 wrote to memory of 1836	1560	server.exe	cmd.exe
PID 1560 wrote to memory of 1836	1560	server.exe	cmd.exe
PID 1560 wrote to memory of 1836	1560	server.exe	cmd.exe
PID 1560 wrote to memory of 1836	1560	server.exe	cmd.exe
PID 1836 wrote to memory of 620	1836	cmd.exe	PING.EXE
PID 1836 wrote to memory of 620	1836	cmd.exe	PING.EXE
PID 1836 wrote to memory of 620	1836	cmd.exe	PING.EXE
PID 1836 wrote to memory of 620	1836	cmd.exe	PING.EXE
PID 2296 wrote to memory of 1412	2296	svchost.exe	dmw.exe
PID 2296 wrote to memory of 1412	2296	svchost.exe	dmw.exe
PID 2296 wrote to memory of 1412	2296	svchost.exe	dmw.exe
PID 2296 wrote to memory of 1412	2296	svchost.exe	dmw.exe

C:\Users\Admin\AppData\Local\Temp\066e5193d94698b82034ea2149e55f89_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\066e5193d94698b82034ea2149e55f89_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\ProgramData\Temp\go.vbs"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\ProgramData\Temp\server.exe
    "C:\ProgramData\Temp\server.exe"
    3⤵
    - Sets DLL path for service in the registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1560
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\ProgramData\Temp\server.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1836
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 1
        5⤵
        Runs ping.exe
        
        PID:620

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "dmw"
1⤵
PID:2064

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "dmw"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Windows\SysWOW64\dmw.exe
  C:\Windows\system32\dmw.exe "c:\programdata\259404702.dll",MainThread
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Temp\go.vbs

Filesize
227B

MD5
aa45ad706b35f0b668e652eea1c3008d

SHA1
d030f0f092082207ed29edf59357e68aa6edd16a

SHA256
68dfc219e71088682df31b7bbee473460568db4b271177efea94a4e37994ebad

SHA512
434bacb3d7ed0b010b622b0a6c102026afb89d0c020d86427ebd870620ed6f51307dd30df0df41c27e95fd6b40d707a8a19ff75f33e37cd29f75a73bee473b4b

Download Submit
C:\ProgramData\Temp\server.exe

Filesize
112KB

MD5
6956eb1809100333db43f8fe2048c7c9

SHA1
72912f8b315c033a643deaeea62a519f3d2d328c

SHA256
ab3de86d2546c26ed84e499adcb6d8880b1e872d38b3790a6ba04c3f9bb3a381

SHA512
0532cc6b549d540293d92749da7bdd970a430fe2893cb97042c4b01e4a23a35c09549cacc0feb2979d7e0fd8f38f00f30b5f9e0c295cd8305daefcfa8dacc3a0

Download Submit
\ProgramData\259404702.dll

Filesize
37KB

MD5
07c9f184d5cf6709a94807845c7ab382

SHA1
280c71e47ffdf5584cdde0542ef63dba725bf66f

SHA256
57ab6db208a1f1431eec74ca7ee5098ca6173850973f88a3f50a1d55d99b1f52

SHA512
a7f3250f20c4fd523ebac921a99d675ecdebed962f0440ad813391dd6a7ba0d98e02427aa94f450be76c470ebb1ae51bd85fbbb19d74a9fb34de33524298408d

Download Submit
\Windows\SysWOW64\dmw.exe

Filesize
43KB

MD5
51138beea3e2c21ec44d0932c71762a8

SHA1
8939cf35447b22dd2c6e6f443446acc1bf986d58

SHA256
5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

SHA512
794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads