gh0strat | 379af2834fef6bca6300893b7deb4519a5b5479dac68e31e5d0148bc4780ecf6

General

Target

8a2e137f71d46acfff4d7bd2e68c5ec9_JaffaCakes118.exe
Size

376KB
MD5

8a2e137f71d46acfff4d7bd2e68c5ec9
SHA1

d5041ecd6f8b7ea7d6184c38992e87ccf92c3afa
SHA256

379af2834fef6bca6300893b7deb4519a5b5479dac68e31e5d0148bc4780ecf6
SHA512

9ca3a096419f9e55fa5a36efdc1ac3d450e3476098d088eab843926b922bdffcdce16fd88ae910a0b271fcb77258ab81bb0159b74f4098c81befe4938e0135ee
SSDEEP

6144:JgydAWCohF2idZecnl20lHRxp3gpXvHn5cF6KwUclRSKUrI3qxmOKEn:iydCobF3Z4mxxqv5clcO55EvE

Score

10^/10

Malware Config

Signatures

Gh0st RAT payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0005000000011c2f-15.dat	family_gh0strat
behavioral1/memory/2420-23-0x0000000000400000-0x0000000000474000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Drivers\beep.sys	8a2e137f71d46acfff4d7bd2e68c5ec9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Drivers\beep.sys	svchost.exe

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibilityex.dll"	8a2e137f71d46acfff4d7bd2e68c5ec9_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
2592	svchost.exe

Loads dropped DLL 2 IoCs

pid	Process
2420	8a2e137f71d46acfff4d7bd2e68c5ec9_JaffaCakes118.exe
2592	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\FastUserSwitchingCompatibilityex.dll	8a2e137f71d46acfff4d7bd2e68c5ec9_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8a2e137f71d46acfff4d7bd2e68c5ec9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
476	Process not Found
476	Process not Found

C:\Users\Admin\AppData\Local\Temp\8a2e137f71d46acfff4d7bd2e68c5ec9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8a2e137f71d46acfff4d7bd2e68c5ec9_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Server Software Component: Terminal Services DLL
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2420

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Drops file in Drivers directory
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

1

T1505

Terminal Services DLL

1

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\install.tmp

Filesize
84B

MD5
f08f58289486770df03e7909fc5616eb

SHA1
e749fb3fde9846bb886173142a91bb6c1aafe750

SHA256
de2a4c73f568bbdc954df671d5cdb81094e998e17e2c59f697739583b3309157

SHA512
3c13b6210ae3ce5794248da4326aad5ad69b93436f070d9b981c5c43f60f9cbcb05e5538f67ab195ed17b7625ae4726c52e0c97bc0f3fcee1c18a85dec76b53e

Download Submit
\Users\Admin\AppData\Local\Temp\dll.tmp

Filesize
88KB

MD5
18d801873817006bb86f13e258ca2d35

SHA1
cc57b7e4c663213dcc2cf9d3d8c5466efaf1a6bc

SHA256
fcbb8a941fd41150fdbb15448a2f477ced6abdf3129e65c9bb735273e284c2ba

SHA512
c62d49aea0dff792707587439bcf002385c53f3fd30c5a9e0976558d5392970f77ffa96c7f32dc26b5967cd1fd0a38e8a5b813045d6adf67463b6a10dd639f5e

Download Submit
memory/2420-9-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/2420-8-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/2420-13-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/2420-12-0x0000000001E50000-0x0000000001E51000-memory.dmp

Filesize
4KB

Download
memory/2420-11-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/2420-10-0x0000000000610000-0x0000000000611000-memory.dmp

Filesize
4KB

Download
memory/2420-1-0x0000000000280000-0x00000000002D4000-memory.dmp

Filesize
336KB

Download
memory/2420-14-0x00000000031A0000-0x00000000031A1000-memory.dmp

Filesize
4KB

Download
memory/2420-7-0x0000000000620000-0x0000000000621000-memory.dmp

Filesize
4KB

Download
memory/2420-6-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/2420-5-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download
memory/2420-23-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2420-24-0x0000000000280000-0x00000000002D4000-memory.dmp

Filesize
336KB

Download
memory/2420-0-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download

Analysis

Sharing