gh0strat | 63b8d272c37c50921f84e53603a90bb11315279ef65aa39fd132354a7c4a6ed8

General

Target

JaffaCakes118_356e8ab1b9d44b70a9196fd77a4c0bd1.exe
Size

132KB
MD5

356e8ab1b9d44b70a9196fd77a4c0bd1
SHA1

4de9df019baf50fbeaff3c05400be4447b86281a
SHA256

63b8d272c37c50921f84e53603a90bb11315279ef65aa39fd132354a7c4a6ed8
SHA512

0ca57aa75ede8ad4780fc5a78cafe9efd3d6a80b535d2fca430262862bbeefa83e545df47992a280dd9191c93ae80d4602524ee68be6c83de0271721a4c02f66
SSDEEP

1536:pnqu5BrauA8rENnA3FTV1G+fyviuGuCcIcfr3fCteQwpK3sTIdbhBJelfMIJ:xqQ084NA9u9IIrvCteLpqsTIdbHJMJ

Score

10^/10

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/2276-0-0x0000000000400000-0x0000000000422000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\:\Program Files\Common Files\svchast.exe 2025310317.exe = "C:\\Program Files\\Common Files\\svchast.exe 2025310317.exe"	JaffaCakes118_356e8ab1b9d44b70a9196fd77a4c0bd1.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_356e8ab1b9d44b70a9196fd77a4c0bd1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchast.exe 2025310317.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
2012	taskkill.exe
2460	taskkill.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2276	JaffaCakes118_356e8ab1b9d44b70a9196fd77a4c0bd1.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2460	taskkill.exe
Token: SeDebugPrivilege	2012	taskkill.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2460	2276	JaffaCakes118_356e8ab1b9d44b70a9196fd77a4c0bd1.exe	31
PID 2276 wrote to memory of 2460	2276	JaffaCakes118_356e8ab1b9d44b70a9196fd77a4c0bd1.exe	31
PID 2276 wrote to memory of 2460	2276	JaffaCakes118_356e8ab1b9d44b70a9196fd77a4c0bd1.exe	31
PID 2276 wrote to memory of 2460	2276	JaffaCakes118_356e8ab1b9d44b70a9196fd77a4c0bd1.exe	31
PID 2276 wrote to memory of 2460	2276	JaffaCakes118_356e8ab1b9d44b70a9196fd77a4c0bd1.exe	31
PID 2276 wrote to memory of 2460	2276	JaffaCakes118_356e8ab1b9d44b70a9196fd77a4c0bd1.exe	31
PID 2276 wrote to memory of 2460	2276	JaffaCakes118_356e8ab1b9d44b70a9196fd77a4c0bd1.exe	31
PID 2276 wrote to memory of 2332	2276	JaffaCakes118_356e8ab1b9d44b70a9196fd77a4c0bd1.exe	32
PID 2276 wrote to memory of 2332	2276	JaffaCakes118_356e8ab1b9d44b70a9196fd77a4c0bd1.exe	32
PID 2276 wrote to memory of 2332	2276	JaffaCakes118_356e8ab1b9d44b70a9196fd77a4c0bd1.exe	32
PID 2276 wrote to memory of 2332	2276	JaffaCakes118_356e8ab1b9d44b70a9196fd77a4c0bd1.exe	32
PID 2276 wrote to memory of 2332	2276	JaffaCakes118_356e8ab1b9d44b70a9196fd77a4c0bd1.exe	32
PID 2276 wrote to memory of 2332	2276	JaffaCakes118_356e8ab1b9d44b70a9196fd77a4c0bd1.exe	32
PID 2276 wrote to memory of 2332	2276	JaffaCakes118_356e8ab1b9d44b70a9196fd77a4c0bd1.exe	32
PID 2332 wrote to memory of 2012	2332	svchast.exe 2025310317.exe	34
PID 2332 wrote to memory of 2012	2332	svchast.exe 2025310317.exe	34
PID 2332 wrote to memory of 2012	2332	svchast.exe 2025310317.exe	34
PID 2332 wrote to memory of 2012	2332	svchast.exe 2025310317.exe	34
PID 2332 wrote to memory of 2012	2332	svchast.exe 2025310317.exe	34
PID 2332 wrote to memory of 2012	2332	svchast.exe 2025310317.exe	34
PID 2332 wrote to memory of 2012	2332	svchast.exe 2025310317.exe	34

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_356e8ab1b9d44b70a9196fd77a4c0bd1.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_356e8ab1b9d44b70a9196fd77a4c0bd1.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im Ksafetray.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2460
- C:\Program Files\Common Files\svchast.exe 2025310317.exe
  "C:\Program Files\Common Files\svchast.exe 2025310317.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Ksafetray.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2012