gh0strat | e417c5a3ca38437f76c79d97e5376d389df3600e449a728a77fb82e41fcae253

General

Target

JaffaCakes118_488b98d1f8a811b2634c3ed6a72027b5.exe
Size

628KB
MD5

488b98d1f8a811b2634c3ed6a72027b5
SHA1

1316f6ea8e07d340caff333349503564530ec0dc
SHA256

e417c5a3ca38437f76c79d97e5376d389df3600e449a728a77fb82e41fcae253
SHA512

823a0c87cb1edd20a6c6477cd9adb1abe69abe3645fa91c07646cca64e6b555df3120611cea5c9d3da303d2227e003da78c9ac525afacb4c7c42ac0bc1ca2c12
SSDEEP

12288:8hxwMhMsqIC/oyLH3K+n4i/yFHr4KKDrs9:02MesqICwyTP4i/64KKDW

Score

10^/10

Malware Config

Signatures

Gh0st RAT payload 3 IoCs

resource	yara_rule
behavioral2/memory/648-5-0x0000000000400000-0x0000000000633000-memory.dmp	family_gh0strat
behavioral2/memory/648-9-0x0000000000400000-0x0000000000633000-memory.dmp	family_gh0strat
behavioral2/files/0x0007000000023ca1-8.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Microsoft MR\Parameters\ServiceDll = "C:\\Windows\\Csrss.dll"	1.exe

Executes dropped EXE 1 IoCs

pid	Process
648	1.exe

Loads dropped DLL 1 IoCs

pid	Process
1156	svchost.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Csrss.dll	1.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_488b98d1f8a811b2634c3ed6a72027b5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
536	cmd.exe
2776	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2776	PING.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
988	JaffaCakes118_488b98d1f8a811b2634c3ed6a72027b5.exe
988	JaffaCakes118_488b98d1f8a811b2634c3ed6a72027b5.exe
988	JaffaCakes118_488b98d1f8a811b2634c3ed6a72027b5.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 988 wrote to memory of 648	988	JaffaCakes118_488b98d1f8a811b2634c3ed6a72027b5.exe	83
PID 988 wrote to memory of 648	988	JaffaCakes118_488b98d1f8a811b2634c3ed6a72027b5.exe	83
PID 988 wrote to memory of 648	988	JaffaCakes118_488b98d1f8a811b2634c3ed6a72027b5.exe	83
PID 988 wrote to memory of 536	988	JaffaCakes118_488b98d1f8a811b2634c3ed6a72027b5.exe	85
PID 988 wrote to memory of 536	988	JaffaCakes118_488b98d1f8a811b2634c3ed6a72027b5.exe	85
PID 988 wrote to memory of 536	988	JaffaCakes118_488b98d1f8a811b2634c3ed6a72027b5.exe	85
PID 536 wrote to memory of 2776	536	cmd.exe	87
PID 536 wrote to memory of 2776	536	cmd.exe	87
PID 536 wrote to memory of 2776	536	cmd.exe	87

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_488b98d1f8a811b2634c3ed6a72027b5.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_488b98d1f8a811b2634c3ed6a72027b5.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:988
- C:\1.exe
  C:\1.exe
  2⤵
  - Server Software Component: Terminal Services DLL
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:648
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping 127.0.0.1 -n 1 &del "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_488b98d1f8a811b2634c3ed6a72027b5.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:536
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2776

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

1

T1505

Terminal Services DLL

1

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\1.exe

Filesize
57KB

MD5
bb95548b299715e9877d0daab5b12b11

SHA1
63245f10b3c0e04e1b2bcc35ebfdbfef069271b8

SHA256
5dd3444372f3228261884b717723cccf9da540d464eb8d4d00f726a7b58f372f

SHA512
728d22330b255c5f0e54400318a0cdb2fdc9df7449e59b85a9b48d5894c8c119d713ad1639f377cb566cd60dadb2f455b532f2bb57b4f47d7b73f29f15ccb662

Download Submit
C:\Windows\Csrss.dll

Filesize
2.1MB

MD5
0502a70de84dad76e4bec277bab60b10

SHA1
fa8518fb7c93694036858b9140e7ed1a77cd11df

SHA256
241d1fb589f5d3b6dc4fd9d17b49672f72dcb7ae28a3773c722456a52c313078

SHA512
0aed6dd04fc8e51f79fad0313cd5aa8741e7271e7059afa6f85a55c3fb3895778eceb0c87c019be72c467713d1728d9dc64d2e8300e5386fd66c4d393ed9f637

Download Submit
memory/648-6-0x0000000000750000-0x0000000000790000-memory.dmp

Filesize
256KB

Download
memory/648-5-0x0000000000400000-0x0000000000633000-memory.dmp

Filesize
2.2MB

Download
memory/648-9-0x0000000000400000-0x0000000000633000-memory.dmp

Filesize
2.2MB

Download

Analysis

Sharing