gh0strat | ebe5c1b1c1c0084004c92a3f5f70a88102c76477f218df4eec5cb4b451349e3a

General

Target

066e5193d94698b82034ea2149e55f89_JaffaCakes118.exe
Size

5.0MB
MD5

066e5193d94698b82034ea2149e55f89
SHA1

ba2907c9b72469afdd9e61d74a02000960d12371
SHA256

ebe5c1b1c1c0084004c92a3f5f70a88102c76477f218df4eec5cb4b451349e3a
SHA512

de63a58e4062c48fe3d7a05690f98c5fe40150c677a0bdbf1763c4e4f71bf1782927e67f0e37688760b598219681710d80d70220c29f7c54c82b5a168b5a77d8
SSDEEP

98304:jFXSKaSL7oqAJVARqbcmRnLdXKNjk57Xxm1L043b/imFAKzPq/3rybeRq:xXaSLTA00c4c1lL/rZWDbI

Score

10^/10

gh0strat runningrat persistence rat

Malware Config

Extracted

Family

gh0strat

C2

fwq.kuai-go.com

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023bba-80.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
RunningRat
RunningRat is a remote access trojan first seen in 2018.
rat runningrat

RunningRat payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023b9a-77.dat	family_runningrat

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\dmw\Parameters\ServiceDll = "C:\\ProgramData\\240598671.dll"	server.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation	066e5193d94698b82034ea2149e55f89_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation	server.exe

Executes dropped EXE 2 IoCs

pid	Process
5256	server.exe
4448	dmw.exe

Loads dropped DLL 3 IoCs

pid	Process
5256	server.exe
2496	svchost.exe
4448	dmw.exe

Creates a Windows Service
persistence

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dmw.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\dmw.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings	066e5193d94698b82034ea2149e55f89_JaffaCakes118.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2584	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5256	server.exe
5256	server.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	5256	server.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5256	server.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 5944 wrote to memory of 3812	5944	066e5193d94698b82034ea2149e55f89_JaffaCakes118.exe	84
PID 5944 wrote to memory of 3812	5944	066e5193d94698b82034ea2149e55f89_JaffaCakes118.exe	84
PID 5944 wrote to memory of 3812	5944	066e5193d94698b82034ea2149e55f89_JaffaCakes118.exe	84
PID 3812 wrote to memory of 5256	3812	WScript.exe	86
PID 3812 wrote to memory of 5256	3812	WScript.exe	86
PID 3812 wrote to memory of 5256	3812	WScript.exe	86
PID 5256 wrote to memory of 5444	5256	server.exe	89
PID 5256 wrote to memory of 5444	5256	server.exe	89
PID 5256 wrote to memory of 5444	5256	server.exe	89
PID 5444 wrote to memory of 2584	5444	cmd.exe	92
PID 5444 wrote to memory of 2584	5444	cmd.exe	92
PID 5444 wrote to memory of 2584	5444	cmd.exe	92
PID 2496 wrote to memory of 4448	2496	svchost.exe	93
PID 2496 wrote to memory of 4448	2496	svchost.exe	93
PID 2496 wrote to memory of 4448	2496	svchost.exe	93

C:\Users\Admin\AppData\Local\Temp\066e5193d94698b82034ea2149e55f89_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\066e5193d94698b82034ea2149e55f89_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5944
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\ProgramData\Temp\go.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3812
- - C:\ProgramData\Temp\server.exe
    "C:\ProgramData\Temp\server.exe"
    3⤵
    - Sets DLL path for service in the registry
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5256
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\ProgramData\Temp\server.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5444
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 1
        5⤵
        Runs ping.exe
        
        PID:2584

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "dmw"
1⤵
PID:2552

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "dmw"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\SysWOW64\dmw.exe
  C:\Windows\system32\dmw.exe "c:\programdata\240598671.dll",MainThread
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\240598671.dll

Filesize
37KB

MD5
07c9f184d5cf6709a94807845c7ab382

SHA1
280c71e47ffdf5584cdde0542ef63dba725bf66f

SHA256
57ab6db208a1f1431eec74ca7ee5098ca6173850973f88a3f50a1d55d99b1f52

SHA512
a7f3250f20c4fd523ebac921a99d675ecdebed962f0440ad813391dd6a7ba0d98e02427aa94f450be76c470ebb1ae51bd85fbbb19d74a9fb34de33524298408d

Download Submit
C:\ProgramData\Temp\go.vbs

Filesize
227B

MD5
aa45ad706b35f0b668e652eea1c3008d

SHA1
d030f0f092082207ed29edf59357e68aa6edd16a

SHA256
68dfc219e71088682df31b7bbee473460568db4b271177efea94a4e37994ebad

SHA512
434bacb3d7ed0b010b622b0a6c102026afb89d0c020d86427ebd870620ed6f51307dd30df0df41c27e95fd6b40d707a8a19ff75f33e37cd29f75a73bee473b4b

Download Submit
C:\ProgramData\Temp\server.exe

Filesize
112KB

MD5
6956eb1809100333db43f8fe2048c7c9

SHA1
72912f8b315c033a643deaeea62a519f3d2d328c

SHA256
ab3de86d2546c26ed84e499adcb6d8880b1e872d38b3790a6ba04c3f9bb3a381

SHA512
0532cc6b549d540293d92749da7bdd970a430fe2893cb97042c4b01e4a23a35c09549cacc0feb2979d7e0fd8f38f00f30b5f9e0c295cd8305daefcfa8dacc3a0

Download Submit
C:\Windows\SysWOW64\dmw.exe

Filesize
60KB

MD5
889b99c52a60dd49227c5e485a016679

SHA1
8fa889e456aa646a4d0a4349977430ce5fa5e2d7

SHA256
6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910

SHA512
08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads