gh0strat | 5a256b49d4ee4da4a463107250d8b7f231fff0d9139750606e1de5e2af6ee0c0

General

Target

JaffaCakes118_319d95b84ba3cdb5bc5183d1bb4aef0e.exe
Size

117KB
MD5

319d95b84ba3cdb5bc5183d1bb4aef0e
SHA1

5c4e862a2ffed5fc1b12908fc09c6e3caa9d9779
SHA256

5a256b49d4ee4da4a463107250d8b7f231fff0d9139750606e1de5e2af6ee0c0
SHA512

853da06445640a2ccec3088f41f8a3e983b7282ec3766cc4d9006862c7b050ff67545212b125ae6d9fd3a9e4e291522d49fcdd0b99e94c8b649e43b4e4ea11e9
SSDEEP

3072:J7vQZBvHLukTbqB+KHDkgHRO72ATUFWPm:p4ZBvHLXTUTxObs

Score

10^/10

Malware Config

Signatures

Gh0st RAT payload 5 IoCs

resource	yara_rule
behavioral2/files/0x000c000000023c27-3.dat	family_gh0strat
behavioral2/memory/4480-6-0x0000000000400000-0x0000000000435000-memory.dmp	family_gh0strat
behavioral2/memory/3904-7-0x0000000010000000-0x0000000010029000-memory.dmp	family_gh0strat
behavioral2/memory/516-10-0x0000000010000000-0x0000000010029000-memory.dmp	family_gh0strat
behavioral2/memory/1380-13-0x0000000010000000-0x0000000010029000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Loads dropped DLL 3 IoCs

pid	Process
3904	svchost.exe
516	svchost.exe
1380	svchost.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\qeawftxiwn	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\qmoqnwbgki	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\qudjvadewd	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4480-0-0x0000000000400000-0x0000000000435000-memory.dmp	upx
behavioral2/memory/4480-6-0x0000000000400000-0x0000000000435000-memory.dmp	upx

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4416	3904	WerFault.exe	91
4944	516	WerFault.exe	96
264	1380	WerFault.exe	99

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_319d95b84ba3cdb5bc5183d1bb4aef0e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4480	JaffaCakes118_319d95b84ba3cdb5bc5183d1bb4aef0e.exe
4480	JaffaCakes118_319d95b84ba3cdb5bc5183d1bb4aef0e.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeRestorePrivilege	4480	JaffaCakes118_319d95b84ba3cdb5bc5183d1bb4aef0e.exe
Token: SeBackupPrivilege	4480	JaffaCakes118_319d95b84ba3cdb5bc5183d1bb4aef0e.exe
Token: SeBackupPrivilege	4480	JaffaCakes118_319d95b84ba3cdb5bc5183d1bb4aef0e.exe
Token: SeRestorePrivilege	4480	JaffaCakes118_319d95b84ba3cdb5bc5183d1bb4aef0e.exe
Token: SeBackupPrivilege	3904	svchost.exe
Token: SeRestorePrivilege	3904	svchost.exe
Token: SeBackupPrivilege	516	svchost.exe
Token: SeRestorePrivilege	516	svchost.exe
Token: SeBackupPrivilege	1380	svchost.exe
Token: SeRestorePrivilege	1380	svchost.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_319d95b84ba3cdb5bc5183d1bb4aef0e.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_319d95b84ba3cdb5bc5183d1bb4aef0e.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4480

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 1064
  2⤵
  - Program crash
  PID:4416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3904 -ip 3904
1⤵
PID:4880

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:516
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 516 -s 1064
  2⤵
  - Program crash
  PID:4944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 516 -ip 516
1⤵
PID:2488

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 832
  2⤵
  - Program crash
  PID:264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1380 -ip 1380
1⤵
PID:4992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\svchost.exe.txt

Filesize
303B

MD5
487958b6da60ced097b4d36b166d1e6c

SHA1
f444e1957b312efbefe297464ecd2ce4cc4bf656

SHA256
49079ac33106398c90349892e2eedec677e0f4204c12abbe565c5730d2022631

SHA512
cf2404afe44a273a44d81b0b9d961db5d2a348e4c47a2b4eb90a8708f303d3ed2d864b254d24b99eccba4dbc1dd483577cc8aa1e16a9cef00302aee089e8d59a

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
202B

MD5
675e84ed1bae444cc175248eba802402

SHA1
f2de843ad392afb7fd3059a85fdd0d20033eaf03

SHA256
cc2b90129f64692b6eb84843b44198343d59d871a183abd39e0ae4c1a244722f

SHA512
9c9f961b1a7e3739c5a7b24e5e6056be53b96ec5fb80d2db83d4bf073b9d79b8034959a9041f4b7bbbb4e175066367200d3142a5d8c27591cb3f39834e704c7b

Download Submit
\??\c:\programdata\application data\360safe\%sessionname%\irxls.xm

Filesize
22.1MB

MD5
c9b15e459fec75e9f07f0c5bc85f6e97

SHA1
2fb66725d3b28b166e65e794a8bfa9eaf0e16b4b

SHA256
f2eaf50a437af2cb7d077bb40c6a3b89762f98a7386d72360b9eeef024cfd3fa

SHA512
428080c5ee8692d9ca6eae1ff2089f03c61d8afe0ffe40dd11cde6810f0e735739fddbbcea7ddd825e7ad64b4f0e698da8a617c6f18f60aeee87541a8b0495ea

Download Submit
memory/516-10-0x0000000010000000-0x0000000010029000-memory.dmp

Filesize
164KB

Download
memory/1380-13-0x0000000010000000-0x0000000010029000-memory.dmp

Filesize
164KB

Download
memory/3904-7-0x0000000010000000-0x0000000010029000-memory.dmp

Filesize
164KB

Download
memory/4480-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4480-6-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing