gh0strat | 3af3127e1a2b395fe1aa931e74fb38523494475a527e872be5fc1ae2fe7f4b65

General

Target

a3961563d31db48bec0fc188a76b2568_JaffaCakes118.exe
Size

174KB
MD5

a3961563d31db48bec0fc188a76b2568
SHA1

5a167d9f348abf0d47d17173bf96095b34173d0e
SHA256

3af3127e1a2b395fe1aa931e74fb38523494475a527e872be5fc1ae2fe7f4b65
SHA512

acb2cf2b2e3fe96608b0a8d9d75dd78af7ce584fc3738102e0d7c3a20565ca76f5d2c1247b185c95a4661ec0840eccd0b2a1e14174dfd62ed46cd02a12d72356
SSDEEP

3072:VJuGnYhTbK80khbOW1oWOQ1f9xHwm1PXBmXZFeA28pM6EdePl9dehiv80P80CnpZ:VJueTk1OwoWOQ3dwaWB28edeP/deUv8M

Score

10^/10

Malware Config

Signatures

Gh0st RAT payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000900000002346c-4.dat	family_gh0strat
behavioral2/files/0x00070000000234d1-8.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E6A0251F-48A4-4d14-9EBD-A313D07E0AE5}	a3961563d31db48bec0fc188a76b2568_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E6A0251F-48A4-4d14-9EBD-A313D07E0AE5}\stubpath = "C:\\Windows\\system32\\incvyzsfr.exe"	a3961563d31db48bec0fc188a76b2568_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2428	incvyzsfr.exe

Loads dropped DLL 1 IoCs

pid	Process
4704	userinit.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.dat	a3961563d31db48bec0fc188a76b2568_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\incvyzsfr.exe_lang.ini	a3961563d31db48bec0fc188a76b2568_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\incvyzsfr.exe	a3961563d31db48bec0fc188a76b2568_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a3961563d31db48bec0fc188a76b2568_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	incvyzsfr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	userinit.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1812	a3961563d31db48bec0fc188a76b2568_JaffaCakes118.exe
1812	a3961563d31db48bec0fc188a76b2568_JaffaCakes118.exe
2428	incvyzsfr.exe
2428	incvyzsfr.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1812	a3961563d31db48bec0fc188a76b2568_JaffaCakes118.exe
Token: SeDebugPrivilege	2428	incvyzsfr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4704	userinit.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 2428	1812	a3961563d31db48bec0fc188a76b2568_JaffaCakes118.exe	85
PID 1812 wrote to memory of 2428	1812	a3961563d31db48bec0fc188a76b2568_JaffaCakes118.exe	85
PID 1812 wrote to memory of 2428	1812	a3961563d31db48bec0fc188a76b2568_JaffaCakes118.exe	85
PID 2428 wrote to memory of 4704	2428	incvyzsfr.exe	86
PID 2428 wrote to memory of 4704	2428	incvyzsfr.exe	86
PID 2428 wrote to memory of 4704	2428	incvyzsfr.exe	86
PID 2428 wrote to memory of 4704	2428	incvyzsfr.exe	86

C:\Users\Admin\AppData\Local\Temp\a3961563d31db48bec0fc188a76b2568_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a3961563d31db48bec0fc188a76b2568_JaffaCakes118.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\SysWOW64\incvyzsfr.exe
  C:\Windows\system32\incvyzsfr.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\SysWOW64\userinit.exe
    userinit.exe
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\240627312_lang.dll

Filesize
122KB

MD5
d8758e22f579b42bbe189517c748875b

SHA1
0ad514c730cf8ce06e521fbc1c41c62b7094cd74

SHA256
b226635d90045940de9380a58c9964ccaf22889a8059c8ef3c2fc704f76fc460

SHA512
a287ec16678b96e579294399d7689480defc1c34c94ea9ff04604ce1e4bf17c5c1b9b519a38536d0eed9905c365530327ade68789f7feac7d85c42199c17298e

Download Submit
C:\Windows\SysWOW64\incvyzsfr.exe

Filesize
174KB

MD5
0643525aa41896aabf29194cc343a343

SHA1
f0b85d0d6d381685306b899f286f84e9f65b6070

SHA256
3044cc6bae4abc9671ca285da18d374766240d9d2ec96e0b759a73f84da317ea

SHA512
01af5bacc0df82cef93fe4838b915a7e392a7d13b0be1cb1e0fa230c64feb575d9d1900ed722a1611b64d380d035bb327cf3b66657ce8887429f510d7a3c8600

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads