gh0strat | c9edea36f2fa7e91c2955d489c847a50c391733b3d1c4ad780930aa186d5077c

General

Target

JaffaCakes118_3c24b8368d1c03395c4c4b02ebcd1530.exe
Size

188KB
MD5

3c24b8368d1c03395c4c4b02ebcd1530
SHA1

64abe6e4a9c9aa859964a4629cc4e6afdd21aec5
SHA256

c9edea36f2fa7e91c2955d489c847a50c391733b3d1c4ad780930aa186d5077c
SHA512

783b239dd059f3eaa28469a83f619d103eaf563b7557c5bf67b770030d0d0bb16c2ebfcc7343de9909dfc7383e567307f72b88ce896a61dc8ebd49edda623b43
SSDEEP

3072:H2KsgypSznWkKrXQ0VHTTlBzK7fa4qR5J6HAb7JUt2lGgHqjuoKfybDgIpenwT1L:WI/znWkKjTTlBzK7fa4qR5J6HQ+twdqk

Score

10^/10

gh0strat bootkit discovery persistence rat

Malware Config

Signatures

Gh0st RAT payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000900000001727e-2.dat	family_gh0strat
behavioral1/memory/2308-4-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Deletes itself 1 IoCs

pid	Process
2308	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
2308	svchost.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\gjoyotymcq	svchost.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\MICROS~1.NET\FRAMEW~1\qqlbm.byj	JaffaCakes118_3c24b8368d1c03395c4c4b02ebcd1530.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_3c24b8368d1c03395c4c4b02ebcd1530.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7"	svchost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2308	svchost.exe
2308	svchost.exe
2308	svchost.exe
2308	svchost.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeBackupPrivilege	1440	JaffaCakes118_3c24b8368d1c03395c4c4b02ebcd1530.exe
Token: SeRestorePrivilege	1440	JaffaCakes118_3c24b8368d1c03395c4c4b02ebcd1530.exe
Token: SeBackupPrivilege	2308	svchost.exe
Token: SeRestorePrivilege	2308	svchost.exe
Token: SeBackupPrivilege	2308	svchost.exe
Token: SeBackupPrivilege	2308	svchost.exe
Token: SeSecurityPrivilege	2308	svchost.exe
Token: SeSecurityPrivilege	2308	svchost.exe
Token: SeBackupPrivilege	2308	svchost.exe
Token: SeBackupPrivilege	2308	svchost.exe
Token: SeSecurityPrivilege	2308	svchost.exe
Token: SeBackupPrivilege	2308	svchost.exe
Token: SeBackupPrivilege	2308	svchost.exe
Token: SeSecurityPrivilege	2308	svchost.exe
Token: SeBackupPrivilege	2308	svchost.exe
Token: SeRestorePrivilege	2308	svchost.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3c24b8368d1c03395c4c4b02ebcd1530.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3c24b8368d1c03395c4c4b02ebcd1530.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1440

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Deletes itself
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\micros~1.net\framew~1\qqlbm.byj

Filesize
1.2MB

MD5
d0572ebf3dc5129ee28b38c6c025ec73

SHA1
7a7ecfdaa7aedc9669c76874d12b5f464e466b88

SHA256
96375230dfea8424c68384c7e8f1123ed340079310434457c8971156b063fed4

SHA512
ac5dd72763f431bbee28e4720d69a75496035613005a2089863799132a98c05765e12c84d46c9ea0dc5f94f8c970a409ed0bbaed7f9e15fbde6aa8cef34b3caa

Download Submit
memory/2308-4-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads