gh0strat | 42040200750951be020cb613f4a8064ab9819ae12009c5f604c2e3bb727d6291

General

Target

2281c1ecb617254ff6e4b8782e6df1ce_JaffaCakes118.exe
Size

183KB
MD5

2281c1ecb617254ff6e4b8782e6df1ce
SHA1

c844a9d926a04a38651cd143fb385ea4b6e6097f
SHA256

42040200750951be020cb613f4a8064ab9819ae12009c5f604c2e3bb727d6291
SHA512

d828e881b21ff547683b789f1b9c0a0d4f9fe63d44ed2f15954d2555bb65510fc5e149a77dd13235c813fc3e907965c2a50e70561f10052f3e2f7694a36fd514
SSDEEP

3072:E0PvR+ug5tLk8uWslG4tOAC2AzXwKRhy+uWZETDGnE+YQfjZtEShOH4IFpI:E0PJZg5B3slG4JATSjKEIdtxOYITI

Score

10^/10

Malware Config

Signatures

Gh0st RAT payload 6 IoCs

resource	yara_rule
behavioral1/files/0x000c000000012274-3.dat	family_gh0strat
behavioral1/memory/1932-5-0x0000000002790000-0x00000000027AD000-memory.dmp	family_gh0strat
behavioral1/memory/2068-13-0x0000000000400000-0x000000000041D000-memory.dmp	family_gh0strat
behavioral1/files/0x0007000000015cc7-15.dat	family_gh0strat
behavioral1/memory/1040-17-0x0000000010000000-0x000000001001B000-memory.dmp	family_gh0strat
behavioral1/memory/2068-18-0x0000000000400000-0x000000000041D000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\360svc\Parameters\ServiceDll = "C:\\Documents and Settings\\Local User\\ntuser.dll"	server.exe

Executes dropped EXE 1 IoCs

pid	Process
2068	server.exe

Loads dropped DLL 3 IoCs

pid	Process
1932	2281c1ecb617254ff6e4b8782e6df1ce_JaffaCakes118.exe
1932	2281c1ecb617254ff6e4b8782e6df1ce_JaffaCakes118.exe
1040	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2680	DllHost.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 2068	1932	2281c1ecb617254ff6e4b8782e6df1ce_JaffaCakes118.exe	28
PID 1932 wrote to memory of 2068	1932	2281c1ecb617254ff6e4b8782e6df1ce_JaffaCakes118.exe	28
PID 1932 wrote to memory of 2068	1932	2281c1ecb617254ff6e4b8782e6df1ce_JaffaCakes118.exe	28
PID 1932 wrote to memory of 2068	1932	2281c1ecb617254ff6e4b8782e6df1ce_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\2281c1ecb617254ff6e4b8782e6df1ce_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2281c1ecb617254ff6e4b8782e6df1ce_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Users\Admin\AppData\Local\Temp\server.exe
  "C:\Users\Admin\AppData\Local\Temp\server.exe"
  2⤵
  - Server Software Component: Terminal Services DLL
  - Executes dropped EXE
  PID:2068

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:1040

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

1

T1505

Terminal Services DLL

1

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\200809231105284577.jpg

Filesize
78KB

MD5
7f4b9549e4d9be8ddf0d85506772ab4f

SHA1
adebbb967fdfe834a500692f65caf65c3f31af27

SHA256
5ec9ef4f72161b43f4a6cec86a985358402358093ec6f5c37eff7c5b9138afe2

SHA512
c9299c5e112624f06a96078d226e2584649be934ef0e344c7866c399ff22abf68b5b98d17df26ce8f5c3200a51ad8b202128c9ca5e87975fc162072d9cfccb5e

Download Submit
\??\c:\documents and settings\local user\ntuser.dll

Filesize
98KB

MD5
34d438c3e7d402a3579dcc5e9bd7fc4e

SHA1
4d8363b7df7bbd39c3a08a295a4dd181f0d901d5

SHA256
167d49e835387f3a742d2245764633da6645be104ff5e4915d709ff64695598b

SHA512
f9b8a6562b0dd423f05a00fdc5b14af8dd3be42cb3bb2ad66786ec4e4c6866f6fd262d2933877e30349cf01564e8c1ce1c63f9e064cff17e9317874afa0e0ce0

Download Submit
\Users\Admin\AppData\Local\Temp\server.exe

Filesize
112KB

MD5
8f6d18c821f309140d787be352e62a1d

SHA1
ff16af0fececa718e3612f74d0b0a4dfdbc8e3b8

SHA256
eb9599c5d654b832754f64ef4dc9716e34311a0e0ad82d0405a32159eef538c2

SHA512
4903e3dcc299072f25169a2ce43a2bf4290606deda30fc3a385dd916d44d9138cf7a785f1f913a963e2e486e1f38f535f84361cc656cfde05414fd71aa15cb3b

Download Submit
memory/1040-17-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download
memory/1932-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1932-5-0x0000000002790000-0x00000000027AD000-memory.dmp

Filesize
116KB

Download
memory/1932-19-0x00000000028F0000-0x00000000028F2000-memory.dmp

Filesize
8KB

Download
memory/1932-21-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2068-13-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2068-18-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2680-20-0x00000000000F0000-0x00000000000F2000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing