gh0strat | d2439e91350d1e304a0b8355fe5ca3fb5bfada2dfe1ef21b7e9685dd5ca7d84b

General

Target

JaffaCakes118_463c02aeef9b48b276ac6900eacb113a.exe
Size

229KB
MD5

463c02aeef9b48b276ac6900eacb113a
SHA1

51cc1ea108b100d6dd9905afcdf16b985956b440
SHA256

d2439e91350d1e304a0b8355fe5ca3fb5bfada2dfe1ef21b7e9685dd5ca7d84b
SHA512

17bd9cd62b2ee36573f5f4da51259673b624accbeb3781732d1039d4774b4514f1e5159412a607369a6aaaea70076ed81ac46665a0c18772c0a9d78aec352cae
SSDEEP

6144:sevT6WnB3CVDvPM2jgd0Xg9wFaEIVUpo/spMEhGIizhCyJl:lb6ytQDvPM2jgWywUKo/YMVYyJl

Score

10^/10

gh0strat bootkit discovery persistence rat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001202c-2.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\fastuserswitchingcompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\COKE.DLL"	JaffaCakes118_463c02aeef9b48b276ac6900eacb113a.exe

Deletes itself 1 IoCs

pid	Process
2752	SVCHOST.EXE

Loads dropped DLL 1 IoCs

pid	Process
2752	SVCHOST.EXE

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	SVCHOST.EXE

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\COKE.DLL	JaffaCakes118_463c02aeef9b48b276ac6900eacb113a.exe
File opened for modification	C:\Windows\SysWOW64\cbdb394.del	JaffaCakes118_463c02aeef9b48b276ac6900eacb113a.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SVCHOST.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_463c02aeef9b48b276ac6900eacb113a.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\sYSTEM\cENTRALpROCEssor\0	SVCHOST.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SVCHOST.EXE

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum	SVCHOST.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software	SVCHOST.EXE
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	SVCHOST.EXE
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie	SVCHOST.EXE
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum	SVCHOST.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum\Version = "7"	SVCHOST.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2844	JaffaCakes118_463c02aeef9b48b276ac6900eacb113a.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeBackupPrivilege	2752	SVCHOST.EXE
Token: SeSecurityPrivilege	2752	SVCHOST.EXE
Token: SeSecurityPrivilege	2752	SVCHOST.EXE
Token: SeBackupPrivilege	2752	SVCHOST.EXE
Token: SeSecurityPrivilege	2752	SVCHOST.EXE
Token: SeBackupPrivilege	2752	SVCHOST.EXE
Token: SeSecurityPrivilege	2752	SVCHOST.EXE

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_463c02aeef9b48b276ac6900eacb113a.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_463c02aeef9b48b276ac6900eacb113a.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2844

C:\Windows\SysWOW64\SVCHOST.EXE
C:\Windows\SysWOW64\SVCHOST.EXE -K NETSVCS
1⤵
- Deletes itself
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Server Software Component

1

T1505

Terminal Services DLL

1

T1505.005

Privilege Escalation

Defense Evasion

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\coke.dll

Filesize
152KB

MD5
a8115bdad27e6a3d39f42827bd2dbed9

SHA1
69b504fbab72295525620f79fbe8bce66bcf9f66

SHA256
ac0c8794a5b291ebba56a99e8e4ad14b38d2d36245c42c03e260c6f58bb2007c

SHA512
801d1fb8fcb8b2f5ea1ea8220bf632e6bfb6c17f1a463905e7abb53b357337ee039652f86a32e68924967c5e157dc07157d27797ecc1c5021d3755bfb0598d84

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads