gh0strat | 5f25a15e5e3bf6f9da6b2db85a9b6b7adc2d5cf2087c48f31dd7db4d5099602b

General

Target

48dd45032b620046f9b94ef443b07669_JaffaCakes118.exe
Size

95KB
MD5

48dd45032b620046f9b94ef443b07669
SHA1

4f2542d6dc5918bbf81b5337377eb4de8c2580d8
SHA256

5f25a15e5e3bf6f9da6b2db85a9b6b7adc2d5cf2087c48f31dd7db4d5099602b
SHA512

0d6fb16fc49d157a84bae830e59e27a5502d5ac81bd22687b65e590c340632bf5ebb934b14fa020ee502339319df40db1c028dee86a03d36a712f14511a056d3
SSDEEP

1536:CYFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prPUSry9KLw:CKS4jHS8q/3nTzePCwNUh4E9PUSu9KLw

Score

10^/10

Malware Config

Signatures

Gh0st RAT payload 3 IoCs

resource	yara_rule
behavioral1/files/0x00090000000162e3-17.dat	family_gh0strat
behavioral1/memory/2428-19-0x0000000000400000-0x000000000044E404-memory.dmp	family_gh0strat
behavioral1/memory/2188-21-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Deletes itself 1 IoCs

pid	Process
2428	iblkoxrkxc

Executes dropped EXE 1 IoCs

pid	Process
2428	iblkoxrkxc

Loads dropped DLL 2 IoCs

pid	Process
2980	48dd45032b620046f9b94ef443b07669_JaffaCakes118.exe
2188	svchost.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\pvvxrdbtds	svchost.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum\Version = "7"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum	svchost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2428	iblkoxrkxc
2188	svchost.exe
2188	svchost.exe
2188	svchost.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeRestorePrivilege	2428	iblkoxrkxc
Token: SeBackupPrivilege	2428	iblkoxrkxc
Token: SeBackupPrivilege	2428	iblkoxrkxc
Token: SeRestorePrivilege	2428	iblkoxrkxc
Token: SeBackupPrivilege	2188	svchost.exe
Token: SeRestorePrivilege	2188	svchost.exe
Token: SeBackupPrivilege	2188	svchost.exe
Token: SeBackupPrivilege	2188	svchost.exe
Token: SeSecurityPrivilege	2188	svchost.exe
Token: SeSecurityPrivilege	2188	svchost.exe
Token: SeBackupPrivilege	2188	svchost.exe
Token: SeBackupPrivilege	2188	svchost.exe
Token: SeSecurityPrivilege	2188	svchost.exe
Token: SeBackupPrivilege	2188	svchost.exe
Token: SeBackupPrivilege	2188	svchost.exe
Token: SeSecurityPrivilege	2188	svchost.exe
Token: SeBackupPrivilege	2188	svchost.exe
Token: SeRestorePrivilege	2188	svchost.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2428	2980	48dd45032b620046f9b94ef443b07669_JaffaCakes118.exe	30
PID 2980 wrote to memory of 2428	2980	48dd45032b620046f9b94ef443b07669_JaffaCakes118.exe	30
PID 2980 wrote to memory of 2428	2980	48dd45032b620046f9b94ef443b07669_JaffaCakes118.exe	30
PID 2980 wrote to memory of 2428	2980	48dd45032b620046f9b94ef443b07669_JaffaCakes118.exe	30
PID 2980 wrote to memory of 2428	2980	48dd45032b620046f9b94ef443b07669_JaffaCakes118.exe	30
PID 2980 wrote to memory of 2428	2980	48dd45032b620046f9b94ef443b07669_JaffaCakes118.exe	30
PID 2980 wrote to memory of 2428	2980	48dd45032b620046f9b94ef443b07669_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\48dd45032b620046f9b94ef443b07669_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\48dd45032b620046f9b94ef443b07669_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2980
- \??\c:\users\admin\appdata\local\iblkoxrkxc
  "C:\Users\Admin\AppData\Local\Temp\48dd45032b620046f9b94ef443b07669_JaffaCakes118.exe" a -sc:\users\admin\appdata\local\temp\48dd45032b620046f9b94ef443b07669_jaffacakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2428

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\programdata\application data\storm\update\%sessionname%\trmun.cc3

Filesize
21.0MB

MD5
b9aae2d639956f5715890007b2c93c66

SHA1
2ad765c73192ee509b3cd0c783d51d6d0b4e2a3d

SHA256
6afb190f68bc4cef6754392bef883e790b0cebe035c4c23ebde30153cd50905d

SHA512
fa605202fd604448cd627cadc626bd5b630f660c4353a356eb07b05269d535af59d5e05217a1b8e801d0b6a42974aee834eba0d09671ceaf569a43736f12b67d

Download Submit
\Users\Admin\AppData\Local\iblkoxrkxc

Filesize
20.1MB

MD5
7f6ffa23c64bdabbbf1166d142d41ad7

SHA1
5889e9602994acd61761287382036e0dc9a94d15

SHA256
0e9f6439a78d7e2537688e460adc0014a55d7c29b85e80c6474a1c51af0b5755

SHA512
75224e601baba28fc561a7b19f49c7a5fb62acb1ee2d81ec2d9289f7e0942ea1c1aaa2c79557bd087e0b4cd8109e477f55b1ffd2a03facfc4c0bbb9ec4145833

Download Submit
memory/2188-20-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/2188-21-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/2428-12-0x0000000000400000-0x000000000044E404-memory.dmp

Filesize
313KB

Download
memory/2428-14-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/2428-19-0x0000000000400000-0x000000000044E404-memory.dmp

Filesize
313KB

Download
memory/2980-0-0x0000000000400000-0x000000000044E404-memory.dmp

Filesize
313KB

Download
memory/2980-3-0x0000000000230000-0x000000000027F000-memory.dmp

Filesize
316KB

Download
memory/2980-2-0x0000000000230000-0x000000000027F000-memory.dmp

Filesize
316KB

Download
memory/2980-11-0x0000000000400000-0x000000000044E404-memory.dmp

Filesize
313KB

Download
memory/2980-23-0x0000000000270000-0x00000000002BF000-memory.dmp

Filesize
316KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads