gh0strat | bca7e90a839e552b03a61a74f0b18023b94963ed17b8557e902d6fe8ddd021e7

General

Target

b6d6b23e1d0aae268a74cf5d43202f3d_JaffaCakes118.exe
Size

155KB
MD5

b6d6b23e1d0aae268a74cf5d43202f3d
SHA1

5b0d8bf4637995aaf54767e52ca1a1d27b031be6
SHA256

bca7e90a839e552b03a61a74f0b18023b94963ed17b8557e902d6fe8ddd021e7
SHA512

603e0627cbf2efc48bd4038767ed45de04cbec38864be24d03f4037731cb6cc36818559824694a32e8f53fa5292fad2e025bcaa5bccbe6b04b7c8033645077d8
SSDEEP

3072:sJuGnYhTbK80khbOvf9xHwm1PXBmXZFeA28pM6EdePl9dehiv80P80Cnp8d6kL:sJueTk1ONdwaWB28edeP/deUv80P80Ak

Score

10^/10

Malware Config

Signatures

Gh0st RAT payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000018718-3.dat	family_gh0strat
behavioral1/files/0x0007000000018bf2-14.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4E5DA6A6-21B9-476c-9D83-37215845D21D}	b6d6b23e1d0aae268a74cf5d43202f3d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4E5DA6A6-21B9-476c-9D83-37215845D21D}\stubpath = "C:\\Windows\\system32\\incgzwjvl.exe"	b6d6b23e1d0aae268a74cf5d43202f3d_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2964	incgzwjvl.exe

Loads dropped DLL 5 IoCs

pid	Process
816	b6d6b23e1d0aae268a74cf5d43202f3d_JaffaCakes118.exe
2964	incgzwjvl.exe
2964	incgzwjvl.exe
2964	incgzwjvl.exe
2464	userinit.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\incgzwjvl.exe	b6d6b23e1d0aae268a74cf5d43202f3d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\incgzwjvl.exe_lang.ini	b6d6b23e1d0aae268a74cf5d43202f3d_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	incgzwjvl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	userinit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b6d6b23e1d0aae268a74cf5d43202f3d_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
816	b6d6b23e1d0aae268a74cf5d43202f3d_JaffaCakes118.exe
2964	incgzwjvl.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	816	b6d6b23e1d0aae268a74cf5d43202f3d_JaffaCakes118.exe
Token: SeDebugPrivilege	2964	incgzwjvl.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 2964	816	b6d6b23e1d0aae268a74cf5d43202f3d_JaffaCakes118.exe	31
PID 816 wrote to memory of 2964	816	b6d6b23e1d0aae268a74cf5d43202f3d_JaffaCakes118.exe	31
PID 816 wrote to memory of 2964	816	b6d6b23e1d0aae268a74cf5d43202f3d_JaffaCakes118.exe	31
PID 816 wrote to memory of 2964	816	b6d6b23e1d0aae268a74cf5d43202f3d_JaffaCakes118.exe	31
PID 816 wrote to memory of 2964	816	b6d6b23e1d0aae268a74cf5d43202f3d_JaffaCakes118.exe	31
PID 816 wrote to memory of 2964	816	b6d6b23e1d0aae268a74cf5d43202f3d_JaffaCakes118.exe	31
PID 816 wrote to memory of 2964	816	b6d6b23e1d0aae268a74cf5d43202f3d_JaffaCakes118.exe	31
PID 2964 wrote to memory of 2464	2964	incgzwjvl.exe	32
PID 2964 wrote to memory of 2464	2964	incgzwjvl.exe	32
PID 2964 wrote to memory of 2464	2964	incgzwjvl.exe	32
PID 2964 wrote to memory of 2464	2964	incgzwjvl.exe	32
PID 2964 wrote to memory of 2464	2964	incgzwjvl.exe	32
PID 2964 wrote to memory of 2464	2964	incgzwjvl.exe	32
PID 2964 wrote to memory of 2464	2964	incgzwjvl.exe	32
PID 2964 wrote to memory of 2464	2964	incgzwjvl.exe	32

C:\Users\Admin\AppData\Local\Temp\b6d6b23e1d0aae268a74cf5d43202f3d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b6d6b23e1d0aae268a74cf5d43202f3d_JaffaCakes118.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:816
- C:\Windows\SysWOW64\incgzwjvl.exe
  C:\Windows\system32\incgzwjvl.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2964
- - C:\Windows\SysWOW64\userinit.exe
    userinit.exe
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\259447665_lang.dll

Filesize
122KB

MD5
c39da1d0b4c53f424e5edfc2a3186011

SHA1
fd76c78a27bf17f7795dbc9d948af86effa4fbb4

SHA256
f750aca2df086fa168d0716af68964f7bd4f6915f8aabb8786e387cce6a3f83d

SHA512
80125f906c91793c8fb1c7511fc787e43418fed4dedb0f169b6bb606195839b4ce587e2e7e45d4d8c31061ab7978f9a0cd95277665cfd7f22ecc53b4066a1157

Download Submit
\Windows\SysWOW64\incgzwjvl.exe

Filesize
155KB

MD5
9f5e6062362db678c84984f3ffe79534

SHA1
11bb6ed2f277fa85f2deb0c082a82c190eaeead3

SHA256
e6c7104a9277e70faa06517a9c2c46f3915a9669ba60765e807aa34ddca74681

SHA512
fb4918102441e147bd80af89df30a1b6b1b9d723bb952d0f2207a0ff2fe15e641b7d95afd6817c2bc6ff76e9916625c3cd10d72f351237f3612cb91085d77652

Download Submit
memory/2464-13-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads