gh0strat | ea095f9c7eee868b594f1223fd58750e25b9139f895b112fae6f7a7946a9bc77

General

Target

JaffaCakes118_45211db88090405d8269529f167c6ef7.exe
Size

363KB
MD5

45211db88090405d8269529f167c6ef7
SHA1

3789c1510549959210d846d309ec9398d5c2f7c4
SHA256

ea095f9c7eee868b594f1223fd58750e25b9139f895b112fae6f7a7946a9bc77
SHA512

e736d390a4ba09183d60967a5461f04d90961c2cfb1bc031f8c6b887444a83f2a9fd304b68a3b4153989ea5d9069ec1646cffe340b6c19dc536ffb377a0cd1ef
SSDEEP

6144:34lRkAehaKuqT+Fz0LIxIXB3qqKrDlGCmIg265lvOrxRMiA4mhg6RHFJn0:3kWAehJuqT+xIXduM5Z7rvQRpA7hH5n0

Score

10^/10

Malware Config

Signatures

Gh0st RAT payload 4 IoCs

resource	yara_rule
behavioral2/memory/228-23-0x0000000010000000-0x0000000010121000-memory.dmp	family_gh0strat
behavioral2/memory/228-22-0x0000000010000000-0x0000000010121000-memory.dmp	family_gh0strat
behavioral2/memory/228-28-0x0000000010000000-0x0000000010121000-memory.dmp	family_gh0strat
behavioral2/memory/228-30-0x0000000010000000-0x0000000010121000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	JaffaCakes118_45211db88090405d8269529f167c6ef7.exe

Executes dropped EXE 2 IoCs

pid	Process
1096	uharc.exe
228	122333.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XXXXXXE90A0F66 = "C:\\Windows\\XXXXXXE90A0F66\\svchsot.exe"	122333.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0031000000023b76-6.dat	upx
behavioral2/memory/1096-10-0x0000000000400000-0x0000000000492000-memory.dmp	upx
behavioral2/memory/1096-17-0x0000000000400000-0x0000000000492000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_45211db88090405d8269529f167c6ef7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uharc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	122333.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
228	122333.exe
228	122333.exe
228	122333.exe
228	122333.exe
228	122333.exe
228	122333.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 1096	4452	JaffaCakes118_45211db88090405d8269529f167c6ef7.exe	83
PID 4452 wrote to memory of 1096	4452	JaffaCakes118_45211db88090405d8269529f167c6ef7.exe	83
PID 4452 wrote to memory of 1096	4452	JaffaCakes118_45211db88090405d8269529f167c6ef7.exe	83
PID 4452 wrote to memory of 228	4452	JaffaCakes118_45211db88090405d8269529f167c6ef7.exe	85
PID 4452 wrote to memory of 228	4452	JaffaCakes118_45211db88090405d8269529f167c6ef7.exe	85
PID 4452 wrote to memory of 228	4452	JaffaCakes118_45211db88090405d8269529f167c6ef7.exe	85

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_45211db88090405d8269529f167c6ef7.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_45211db88090405d8269529f167c6ef7.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\uharc.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\uharc.exe" e thing.uha
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1096
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\122333.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\122333.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\122333.exe

Filesize
192KB

MD5
0559eaa9f40e9d3db5bc5bf2021a701c

SHA1
026650f35d4ef033c9adece71e4a396456a0f338

SHA256
2a15f5b4b63621332b0537cf591018ada2c29b6f6391cdeef6f5d0dff4e746e7

SHA512
9df822ba573f73cc71e3ef8906ab2489dde8b09091d3d062b9af7b4754550a3546971869e0636541fa324cf72e8b360caf1166607695566080faf9552e4e69ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\UHARC.EXE

Filesize
108KB

MD5
50ce184e4cf489dac8b75a6023f67020

SHA1
7d407c0765e0cbfdd5e1e609f645f1673ec961d2

SHA256
e0baf423024a8cbc6d7ff66c8890f7b2835a801faa7244912c0181d6fe178388

SHA512
ae42fb065adceafa218c45862474d2e6d131a1f8620e9db2a8bd081b10a9059b9b5c5e6c9b104dead6e17d51d76c7dddb13d93248a0f617e181d5c469caf3e3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\thing.uha

Filesize
162KB

MD5
42b8b5aff120d3e5a28fe3e3e1bbe59d

SHA1
cfefb0f0ad7185e457ab7c550928abad17f7198c

SHA256
dc0d195f231c4c01cd7fa5fd7587c569468304d0857c3860e5f778bcbc573eaa

SHA512
cda6ff74f3036d6c796b67c4ef1797d7ab885cfa227c2ece82bbaa7b2be48b9ca77d2489bc1c2b571c36358b7dd680e9396e6018eec4affa17724fd72e4bb3ab

Download Submit
memory/228-20-0x0000000010000000-0x0000000010121000-memory.dmp

Filesize
1.1MB

Download
memory/228-23-0x0000000010000000-0x0000000010121000-memory.dmp

Filesize
1.1MB

Download
memory/228-22-0x0000000010000000-0x0000000010121000-memory.dmp

Filesize
1.1MB

Download
memory/228-29-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download
memory/228-28-0x0000000010000000-0x0000000010121000-memory.dmp

Filesize
1.1MB

Download
memory/228-30-0x0000000010000000-0x0000000010121000-memory.dmp

Filesize
1.1MB

Download
memory/228-31-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download
memory/228-32-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1096-17-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/1096-10-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads