gh0strat | d76db7f6580126a1217c47c5136b113711425e1c5380017c1732d12822c3ac76

General

Target

JaffaCakes118_4beb2dc6e6ddb5f9c44f65d2ecf15700.exe
Size

191KB
MD5

4beb2dc6e6ddb5f9c44f65d2ecf15700
SHA1

85ca05199f36c0f5918c9de4bf0ff268b6bad95f
SHA256

d76db7f6580126a1217c47c5136b113711425e1c5380017c1732d12822c3ac76
SHA512

7f9c9d2634f2b891e86e1b1f0ffa8a07f295428248a9a269a91e2c2d16e57056dced9087bd3c37fb3c2be4a4ea4e5447fcc48595315037bc7634e0cb6a68d104
SSDEEP

3072:Hnk0q9YAjEFz7cUa8v2KvwSKJJQzL6Ql5OgjPbfvdIC7w8LjEuPqmJpX/YGRg:XeY4EFcU3wVJJsjHBbfvXMUdN/PO

Score

10^/10

gh0strat discovery persistence rat vmprotect

Malware Config

Signatures

Gh0st RAT payload 6 IoCs

resource	yara_rule
behavioral2/files/0x0009000000023c84-5.dat	family_gh0strat
behavioral2/memory/5052-7-0x0000000000400000-0x000000000041B000-memory.dmp	family_gh0strat
behavioral2/files/0x0008000000023c87-12.dat	family_gh0strat
behavioral2/memory/1344-14-0x0000000010000000-0x0000000010019000-memory.dmp	family_gh0strat
behavioral2/memory/5052-15-0x0000000000400000-0x000000000041B000-memory.dmp	family_gh0strat
behavioral2/memory/1344-17-0x0000000010000000-0x0000000010019000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibility360.dll"	¸´¼þ¸´~1.EXE

Executes dropped EXE 1 IoCs

pid	Process
5052	¸´¼þ¸´~1.EXE

Loads dropped DLL 1 IoCs

pid	Process
1344	SVCHOST.EXE

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/4132-0-0x0000000001000000-0x0000000001068000-memory.dmp	vmprotect
behavioral2/memory/4132-16-0x0000000001000000-0x0000000001068000-memory.dmp	vmprotect

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	JaffaCakes118_4beb2dc6e6ddb5f9c44f65d2ecf15700.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\FastUserSwitchingCompatibility360.dll	¸´¼þ¸´~1.EXE

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SVCHOST.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_4beb2dc6e6ddb5f9c44f65d2ecf15700.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	¸´¼þ¸´~1.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 5052	4132	JaffaCakes118_4beb2dc6e6ddb5f9c44f65d2ecf15700.exe	79
PID 4132 wrote to memory of 5052	4132	JaffaCakes118_4beb2dc6e6ddb5f9c44f65d2ecf15700.exe	79
PID 4132 wrote to memory of 5052	4132	JaffaCakes118_4beb2dc6e6ddb5f9c44f65d2ecf15700.exe	79

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4beb2dc6e6ddb5f9c44f65d2ecf15700.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4beb2dc6e6ddb5f9c44f65d2ecf15700.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ¸´~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ¸´~1.EXE
  2⤵
  - Server Software Component: Terminal Services DLL
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:5052

C:\Windows\SysWOW64\SVCHOST.EXE
C:\Windows\SysWOW64\SVCHOST.EXE -K NETSVCS -s FastUserSwitchingCompatibility
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Server Software Component

1

T1505

Terminal Services DLL

1

T1505.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ¸´~1.EXE

Filesize
102KB

MD5
a0455fa3feafbec24ed75b85b5509965

SHA1
e4de2ce0f8ce8e7294cf2102e57076222d93a834

SHA256
6c5752ee03846f73cf7804d1b123f578d21b71f86d1eddb87f237aeb17481138

SHA512
0d985dfad6f248907ddaa110765e31917aa156146b900d5a07b3946b48868f9481840a9c760d1899298284a1f736c0c10c17833004ca9c7988beb11549940a4d

Download Submit
\??\c:\windows\SysWOW64\fastuserswitchingcompatibility360.dll

Filesize
90KB

MD5
cb506ea84244745942705749ba5e2b9f

SHA1
7e02989652a8457d0eca9f92db2cf8a172134c65

SHA256
23c175e57ba6a8f6c08decb68c9c5049e94ba558f61cd0055d2c70c54203cd7f

SHA512
ab39505adfdbebe2b32430cec26950010c6176869915a6f226f154a9d6c281d1ae2d97fe4970d4ba4069329d04265dd72eb7248f089c2a1f97dfee048e99181b

Download Submit
memory/1344-14-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/1344-17-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/4132-0-0x0000000001000000-0x0000000001068000-memory.dmp

Filesize
416KB

Download
memory/4132-1-0x0000000001064000-0x0000000001065000-memory.dmp

Filesize
4KB

Download
memory/4132-16-0x0000000001000000-0x0000000001068000-memory.dmp

Filesize
416KB

Download
memory/5052-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/5052-8-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/5052-15-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads