gh0strat | 45a47383793a5807fa04369327ec38f8577eafa687779b067a7d37e335f5b3ea

General

Target

JaffaCakes118_3c15c935cb3587905407eb644ce55294.exe
Size

176KB
MD5

3c15c935cb3587905407eb644ce55294
SHA1

7e5d57cee7da2dd7e60981b6643421faab707972
SHA256

45a47383793a5807fa04369327ec38f8577eafa687779b067a7d37e335f5b3ea
SHA512

f42f3f87cd0189625151590947f2d988e8b54ee48f882899af120fbdba2f0a2535e05ee2a27d214743a865f34b8a33fc4ef28ef017de29f761cb68c76edab9db
SSDEEP

3072:kcYcYKEzcW526y6hs6PhwtqrorsVlkTEIcy1O4F3JhMWIknqX5d+vIjc8UW:kcBYKEz557e2VroYoTU4JOWnS5d+v0cu

Score

10^/10

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/files/0x000c0000000174b4-17.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Blocklisted process makes network request 1 IoCs

flow	pid	Process
3	2436	rundll32.exe

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Rspdates Apxplicatioan\Parameters\ServiceDll	JaffaCakes118_3c15c935cb3587905407eb644ce55294.exe

Deletes itself 1 IoCs

pid	Process
2436	rundll32.exe

Loads dropped DLL 2 IoCs

pid	Process
2932	svchost.exe
2436	rundll32.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\hfsetemp.ini	JaffaCakes118_3c15c935cb3587905407eb644ce55294.exe
File created	C:\Windows\Svchost.txt	JaffaCakes118_3c15c935cb3587905407eb644ce55294.exe
File created	C:\Windows\Svchost.reg	JaffaCakes118_3c15c935cb3587905407eb644ce55294.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_3c15c935cb3587905407eb644ce55294.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
2932	svchost.exe
2932	svchost.exe
2932	svchost.exe
2932	svchost.exe
2932	svchost.exe
2932	svchost.exe
2932	svchost.exe
2932	svchost.exe
2932	svchost.exe
2932	svchost.exe
2932	svchost.exe
2932	svchost.exe
2932	svchost.exe
2932	svchost.exe
2932	svchost.exe
2932	svchost.exe
2932	svchost.exe
2932	svchost.exe
2932	svchost.exe
2932	svchost.exe
2932	svchost.exe
2932	svchost.exe
2932	svchost.exe
2932	svchost.exe
2932	svchost.exe
2932	svchost.exe
2932	svchost.exe
2932	svchost.exe
2932	svchost.exe
2932	svchost.exe
2932	svchost.exe
2932	svchost.exe
2932	svchost.exe
2932	svchost.exe
2932	svchost.exe
2932	svchost.exe
2932	svchost.exe
2932	svchost.exe
2932	svchost.exe
2932	svchost.exe
2932	svchost.exe
2932	svchost.exe
2932	svchost.exe
2932	svchost.exe
2932	svchost.exe
2932	svchost.exe
2932	svchost.exe
2932	svchost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	2984	JaffaCakes118_3c15c935cb3587905407eb644ce55294.exe
Token: SeRestorePrivilege	2984	JaffaCakes118_3c15c935cb3587905407eb644ce55294.exe
Token: SeDebugPrivilege	2932	svchost.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2436	2932	svchost.exe	31
PID 2932 wrote to memory of 2436	2932	svchost.exe	31
PID 2932 wrote to memory of 2436	2932	svchost.exe	31
PID 2932 wrote to memory of 2436	2932	svchost.exe	31
PID 2932 wrote to memory of 2436	2932	svchost.exe	31
PID 2932 wrote to memory of 2436	2932	svchost.exe	31
PID 2932 wrote to memory of 2436	2932	svchost.exe	31

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3c15c935cb3587905407eb644ce55294.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3c15c935cb3587905407eb644ce55294.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2984

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "c:\windows\system32\winnie.cmd",EASTNOD Rspdates Apxplicatioan
  2⤵
  - Blocklisted process makes network request
  - Deletes itself
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

1

T1505

Terminal Services DLL

1

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\hfsetemp.ini

Filesize
365B

MD5
6b8e95ce2706ab34239e463b174df3c1

SHA1
e3a134ec6f9f1711d966acdb93b016760d1ce7fa

SHA256
23f948ac4e91de00d86ac10424cbb347f4ba564aec77926f01588337d9fe81a9

SHA512
34a5348edca8958c49e51223213ccc491e0937a9b4846e34ef6b1c28e555ca775350d96632fac6d36e3bb3861eeaa5d65e794e76b69c2ca7d6a6f75bd2d0bbd2

Download Submit
\??\c:\windows\SysWOW64\winnie.cmd

Filesize
1.1MB

MD5
c08793c8a814a6572d753cb121faad8a

SHA1
9354bba7e6eddbaeead4e5e79bf3b8fa1ff4d47a

SHA256
d69d521ce4c5b2b957880b416e031c67f40c83d85c0fefcd4f060bc9913bd891

SHA512
ee4b868d05cef490c2472f9b79fab71414903ec21dc1f3ea9b9cef38eb31d6064797d3e379c6a68cf0e4b3a2f94380f42afbdc6908bcefb315dd46f69745e35a

Download Submit

Analysis

Sharing