gh0strat | 1cd89c1abd5c38499d4008dd002dc447c888bd06ea39fdeadccf6fdf3d80362e

General

Target

JaffaCakes118_309eedd6b8132089f96718dcf5cedd3f.exe
Size

132KB
MD5

309eedd6b8132089f96718dcf5cedd3f
SHA1

a3c219f45e3ff8f199d3028ec360fd0a603d382c
SHA256

1cd89c1abd5c38499d4008dd002dc447c888bd06ea39fdeadccf6fdf3d80362e
SHA512

72aa77e023acfa7892f3453ba0195c89adaa5aefc4fcf96b762d6238d5dda52876a20b953e3d391fd46dfde1b167ff74927bf99480c45c9fc7bac7d645eef9f6
SSDEEP

3072:Lgm6l4kMjic7q80asTJCoexn1rMI1vR0gLMu:MmaVeOnBJfyMIVug1

Score

10^/10

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/2136-0-0x0000000000400000-0x0000000000422000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\:\Program Files\Common Files\svchast.exe 202522805850.exe = "C:\\Program Files\\Common Files\\svchast.exe 202522805850.exe"	JaffaCakes118_309eedd6b8132089f96718dcf5cedd3f.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_309eedd6b8132089f96718dcf5cedd3f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchast.exe 202522805850.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
2212	taskkill.exe
2424	taskkill.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2136	JaffaCakes118_309eedd6b8132089f96718dcf5cedd3f.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2212	taskkill.exe
Token: SeDebugPrivilege	2424	taskkill.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2212	2136	JaffaCakes118_309eedd6b8132089f96718dcf5cedd3f.exe	30
PID 2136 wrote to memory of 2212	2136	JaffaCakes118_309eedd6b8132089f96718dcf5cedd3f.exe	30
PID 2136 wrote to memory of 2212	2136	JaffaCakes118_309eedd6b8132089f96718dcf5cedd3f.exe	30
PID 2136 wrote to memory of 2212	2136	JaffaCakes118_309eedd6b8132089f96718dcf5cedd3f.exe	30
PID 2136 wrote to memory of 2212	2136	JaffaCakes118_309eedd6b8132089f96718dcf5cedd3f.exe	30
PID 2136 wrote to memory of 2212	2136	JaffaCakes118_309eedd6b8132089f96718dcf5cedd3f.exe	30
PID 2136 wrote to memory of 2212	2136	JaffaCakes118_309eedd6b8132089f96718dcf5cedd3f.exe	30
PID 2136 wrote to memory of 2576	2136	JaffaCakes118_309eedd6b8132089f96718dcf5cedd3f.exe	31
PID 2136 wrote to memory of 2576	2136	JaffaCakes118_309eedd6b8132089f96718dcf5cedd3f.exe	31
PID 2136 wrote to memory of 2576	2136	JaffaCakes118_309eedd6b8132089f96718dcf5cedd3f.exe	31
PID 2136 wrote to memory of 2576	2136	JaffaCakes118_309eedd6b8132089f96718dcf5cedd3f.exe	31
PID 2136 wrote to memory of 2576	2136	JaffaCakes118_309eedd6b8132089f96718dcf5cedd3f.exe	31
PID 2136 wrote to memory of 2576	2136	JaffaCakes118_309eedd6b8132089f96718dcf5cedd3f.exe	31
PID 2136 wrote to memory of 2576	2136	JaffaCakes118_309eedd6b8132089f96718dcf5cedd3f.exe	31
PID 2576 wrote to memory of 2424	2576	svchast.exe 202522805850.exe	33
PID 2576 wrote to memory of 2424	2576	svchast.exe 202522805850.exe	33
PID 2576 wrote to memory of 2424	2576	svchast.exe 202522805850.exe	33
PID 2576 wrote to memory of 2424	2576	svchast.exe 202522805850.exe	33
PID 2576 wrote to memory of 2424	2576	svchast.exe 202522805850.exe	33
PID 2576 wrote to memory of 2424	2576	svchast.exe 202522805850.exe	33
PID 2576 wrote to memory of 2424	2576	svchast.exe 202522805850.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_309eedd6b8132089f96718dcf5cedd3f.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_309eedd6b8132089f96718dcf5cedd3f.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im Ksafetray.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2212
- C:\Program Files\Common Files\svchast.exe 202522805850.exe
  "C:\Program Files\Common Files\svchast.exe 202522805850.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2576
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Ksafetray.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2424