gh0strat | 86798e6b7a8168e80bb276180f5cc6ccc21aa74c0b0af8fe2abfc053aab7555c

General

Target

72bb10e6bc89abba6b92d8026bbdf681_JaffaCakes118.exe
Size

431KB
MD5

72bb10e6bc89abba6b92d8026bbdf681
SHA1

9fed316956c7de6c705d1045b657cd68d58b1cd3
SHA256

86798e6b7a8168e80bb276180f5cc6ccc21aa74c0b0af8fe2abfc053aab7555c
SHA512

4715148e91af54aafeb035c950df050da3588e6908505f1634576291597945afcb0c3db958bbe4e4063587a581df03fd025204ebd8602b0e2937cb34355d0724
SSDEEP

6144:h9aip6KVakpKvPkejAcCOrxsn6eUo8w8PSXVJR8m8V0h87rb28xbk9a+0:TakA6Orxsn6m98PSXVJRw7f

Score

10^/10

gh0strat rat

Malware Config

Signatures

Gh0st RAT payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2980-0-0x0000000010000000-0x000000001002C000-memory.dmp	family_gh0strat
behavioral1/memory/2740-18-0x0000000010000000-0x000000001002C000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Deletes itself 1 IoCs

Processes:

WScript.exe

pid process

2648 WScript.exe
Executes dropped EXE 6 IoCs

Processes:

Systemb2.exeSystemb2.exeSystemb2.exeSystemb2.exeSystemb2.exeSystemb2.exe

pid process

2792 Systemb2.exe
2740 Systemb2.exe
2556 Systemb2.exe
2656 Systemb2.exe
2576 Systemb2.exe
3016 Systemb2.exe
Loads dropped DLL 6 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid process

2708 WerFault.exe
2708 WerFault.exe
2684 WerFault.exe
2684 WerFault.exe
3020 WerFault.exe
3020 WerFault.exe

pid	process
2648	WScript.exe

pid	process
2792	Systemb2.exe
2740	Systemb2.exe
2556	Systemb2.exe
2656	Systemb2.exe
2576	Systemb2.exe
3016	Systemb2.exe

pid	process
2708	WerFault.exe
2708	WerFault.exe
2684	WerFault.exe
2684	WerFault.exe
3020	WerFault.exe
3020	WerFault.exe

Drops file in System32 directory 2 IoCs

Processes:

72bb10e6bc89abba6b92d8026bbdf681_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\Com\Systemb2.exe	72bb10e6bc89abba6b92d8026bbdf681_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Com\Systemb2.exe	72bb10e6bc89abba6b92d8026bbdf681_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

2708 2792 WerFault.exe Systemb2.exe
2684 2556 WerFault.exe Systemb2.exe
3020 2656 WerFault.exe Systemb2.exe

pid	pid_target	process	target process
2708	2792	WerFault.exe	Systemb2.exe
2684	2556	WerFault.exe	Systemb2.exe
3020	2656	WerFault.exe	Systemb2.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

72bb10e6bc89abba6b92d8026bbdf681_JaffaCakes118.exeSystemb2.exeSystemb2.exeSystemb2.exeSystemb2.exeSystemb2.exeSystemb2.exe

pid	process
2980	72bb10e6bc89abba6b92d8026bbdf681_JaffaCakes118.exe
2792	Systemb2.exe
2740	Systemb2.exe
2556	Systemb2.exe
2656	Systemb2.exe
2576	Systemb2.exe
3016	Systemb2.exe

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

72bb10e6bc89abba6b92d8026bbdf681_JaffaCakes118.exeSystemb2.exeSystemb2.exeSystemb2.exeSystemb2.exeSystemb2.exeSystemb2.exe

pid	process
2980	72bb10e6bc89abba6b92d8026bbdf681_JaffaCakes118.exe
2792	Systemb2.exe
2740	Systemb2.exe
2556	Systemb2.exe
2656	Systemb2.exe
2576	Systemb2.exe
3016	Systemb2.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

72bb10e6bc89abba6b92d8026bbdf681_JaffaCakes118.exeSystemb2.exeSystemb2.exeSystemb2.exe

description	pid	process	target process
PID 2980 wrote to memory of 2648	2980	72bb10e6bc89abba6b92d8026bbdf681_JaffaCakes118.exe	WScript.exe
PID 2980 wrote to memory of 2648	2980	72bb10e6bc89abba6b92d8026bbdf681_JaffaCakes118.exe	WScript.exe
PID 2980 wrote to memory of 2648	2980	72bb10e6bc89abba6b92d8026bbdf681_JaffaCakes118.exe	WScript.exe
PID 2980 wrote to memory of 2648	2980	72bb10e6bc89abba6b92d8026bbdf681_JaffaCakes118.exe	WScript.exe
PID 2792 wrote to memory of 2740	2792	Systemb2.exe	Systemb2.exe
PID 2792 wrote to memory of 2740	2792	Systemb2.exe	Systemb2.exe
PID 2792 wrote to memory of 2740	2792	Systemb2.exe	Systemb2.exe
PID 2792 wrote to memory of 2740	2792	Systemb2.exe	Systemb2.exe
PID 2792 wrote to memory of 2708	2792	Systemb2.exe	WerFault.exe
PID 2792 wrote to memory of 2708	2792	Systemb2.exe	WerFault.exe
PID 2792 wrote to memory of 2708	2792	Systemb2.exe	WerFault.exe
PID 2792 wrote to memory of 2708	2792	Systemb2.exe	WerFault.exe
PID 2556 wrote to memory of 2656	2556	Systemb2.exe	Systemb2.exe
PID 2556 wrote to memory of 2656	2556	Systemb2.exe	Systemb2.exe
PID 2556 wrote to memory of 2656	2556	Systemb2.exe	Systemb2.exe
PID 2556 wrote to memory of 2656	2556	Systemb2.exe	Systemb2.exe
PID 2556 wrote to memory of 2684	2556	Systemb2.exe	WerFault.exe
PID 2556 wrote to memory of 2684	2556	Systemb2.exe	WerFault.exe
PID 2556 wrote to memory of 2684	2556	Systemb2.exe	WerFault.exe
PID 2556 wrote to memory of 2684	2556	Systemb2.exe	WerFault.exe
PID 2656 wrote to memory of 3016	2656	Systemb2.exe	Systemb2.exe
PID 2656 wrote to memory of 3016	2656	Systemb2.exe	Systemb2.exe
PID 2656 wrote to memory of 3016	2656	Systemb2.exe	Systemb2.exe
PID 2656 wrote to memory of 3016	2656	Systemb2.exe	Systemb2.exe
PID 2656 wrote to memory of 3020	2656	Systemb2.exe	WerFault.exe
PID 2656 wrote to memory of 3020	2656	Systemb2.exe	WerFault.exe
PID 2656 wrote to memory of 3020	2656	Systemb2.exe	WerFault.exe
PID 2656 wrote to memory of 3020	2656	Systemb2.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\72bb10e6bc89abba6b92d8026bbdf681_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\72bb10e6bc89abba6b92d8026bbdf681_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\8632.vbs"
2⤵
- Deletes itself
PID:2648

C:\Windows\SysWOW64\Com\Systemb2.exe
C:\Windows\SysWOW64\Com\Systemb2.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2792

C:\Windows\SysWOW64\Com\Systemb2.exe
C:\Windows\SysWOW64\Com\Systemb2.exe Win7
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2792 -s 340
2⤵
- Loads dropped DLL
- Program crash
PID:2708

C:\Windows\SysWOW64\Com\Systemb2.exe
C:\Windows\SysWOW64\Com\Systemb2.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2556

C:\Windows\SysWOW64\Com\Systemb2.exe
C:\Windows\SysWOW64\Com\Systemb2.exe Win7
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2656

C:\Windows\SysWOW64\Com\Systemb2.exe
C:\Windows\SysWOW64\Com\Systemb2.exe Win7
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 352
3⤵
- Loads dropped DLL
- Program crash
PID:3020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2556 -s 336
2⤵
- Loads dropped DLL
- Program crash
PID:2684

C:\Windows\SysWOW64\Com\Systemb2.exe
C:\Windows\SysWOW64\Com\Systemb2.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\8632.vbs
Filesize
500B

MD5
123d48688713e19417bf5a8de3d921be

SHA1
06b0304bba9ab370cc0d2facbbdf0a923e7814ab

SHA256
0406c6680c51c54f22b3db03c4f7a84e12978114bcdf03df14e227007887296b

SHA512
c1082c37260f11e2aabeb30c58f99b1dfd83524b95f3d82b56b60b69a810954269afde8a446f2de940e341e898796a9dbf0ee5794102599e6d784978ae46a6fb

Download Submit
C:\Windows\SysWOW64\com\Systemb2.exe
Filesize
431KB

MD5
72bb10e6bc89abba6b92d8026bbdf681

SHA1
9fed316956c7de6c705d1045b657cd68d58b1cd3

SHA256
86798e6b7a8168e80bb276180f5cc6ccc21aa74c0b0af8fe2abfc053aab7555c

SHA512
4715148e91af54aafeb035c950df050da3588e6908505f1634576291597945afcb0c3db958bbe4e4063587a581df03fd025204ebd8602b0e2937cb34355d0724

Download Submit
memory/2740-18-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download
memory/2980-0-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads