gh0strat | 3148a1447613f96425d8544dea48a247f4cbaf3798f9e7718236f9742dc348b2

General

Target

JaffaCakes118_39a9c0cd0065e627ef7fb3ca6369ee60.exe
Size

87KB
MD5

39a9c0cd0065e627ef7fb3ca6369ee60
SHA1

97782e33146aa3034d97f2da6b5e35f7cbb127f8
SHA256

3148a1447613f96425d8544dea48a247f4cbaf3798f9e7718236f9742dc348b2
SHA512

faf2e5e0496ea7d52a5a917502202b0737254f5feee3ef6688722afbccae6ad1f64d9940a92fc0aaaf1f3803fce38798e626beb04048ff476af9cd5c305e7f10
SSDEEP

1536:J5P8Vcennnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn+J8CP+X4JUo+vfpu4PE:vennnnnnnnnnnnnnnnnn5+o4PKxuGx3e

Score

10^/10

Malware Config

Signatures

Gh0st RAT payload 3 IoCs

resource	yara_rule
behavioral1/memory/2848-15-0x0000000010000000-0x0000000010022000-memory.dmp	family_gh0strat
behavioral1/memory/2848-17-0x0000000010000000-0x0000000010022000-memory.dmp	family_gh0strat
behavioral1/memory/2848-19-0x0000000010000000-0x0000000010022000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Drivers\beep.sys	JaffaCakes118_39a9c0cd0065e627ef7fb3ca6369ee60.exe
File opened for modification	C:\Windows\SysWOW64\Drivers\beep.sys	svchost.exe

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibilityex.dll"	JaffaCakes118_39a9c0cd0065e627ef7fb3ca6369ee60.exe

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000700000001211a-5.dat	acprotect
behavioral1/files/0x00080000000161f6-8.dat	acprotect

Deletes itself 1 IoCs

pid	Process
2848	svchost.exe

Loads dropped DLL 2 IoCs

pid	Process
2328	JaffaCakes118_39a9c0cd0065e627ef7fb3ca6369ee60.exe
2848	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\FastUserSwitchingCompatibilityex.dll	JaffaCakes118_39a9c0cd0065e627ef7fb3ca6369ee60.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2328-7-0x0000000010000000-0x0000000010022000-memory.dmp	upx
behavioral1/files/0x000700000001211a-5.dat	upx
behavioral1/files/0x00080000000161f6-8.dat	upx
behavioral1/memory/2848-15-0x0000000010000000-0x0000000010022000-memory.dmp	upx
behavioral1/memory/2848-17-0x0000000010000000-0x0000000010022000-memory.dmp	upx
behavioral1/memory/2848-19-0x0000000010000000-0x0000000010022000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_39a9c0cd0065e627ef7fb3ca6369ee60.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_39a9c0cd0065e627ef7fb3ca6369ee60.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
476	Process not Found
476	Process not Found

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2328	3068	JaffaCakes118_39a9c0cd0065e627ef7fb3ca6369ee60.exe	30
PID 3068 wrote to memory of 2328	3068	JaffaCakes118_39a9c0cd0065e627ef7fb3ca6369ee60.exe	30
PID 3068 wrote to memory of 2328	3068	JaffaCakes118_39a9c0cd0065e627ef7fb3ca6369ee60.exe	30
PID 3068 wrote to memory of 2328	3068	JaffaCakes118_39a9c0cd0065e627ef7fb3ca6369ee60.exe	30

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_39a9c0cd0065e627ef7fb3ca6369ee60.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_39a9c0cd0065e627ef7fb3ca6369ee60.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_39a9c0cd0065e627ef7fb3ca6369ee60.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_39a9c0cd0065e627ef7fb3ca6369ee60.exe
  2⤵
  - Drops file in Drivers directory
  - Server Software Component: Terminal Services DLL
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:2328

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Drops file in Drivers directory
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

1

T1505

Terminal Services DLL

1

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\259426698_res.tmp

Filesize
47KB

MD5
9f2f4dfcb225df481af63531e1eca7a5

SHA1
ae10efff6e47d88bad00589707c6d726f65ab39d

SHA256
d693f714e572a90124dce48d26d0979b491da02968397562f63e545ac3213e22

SHA512
b9fa644e7b40de361cebf01b3fd6f63c96979c90cf93bcea46fc2091d18e6b1aebc81a5eb683c23585d6c699c5e1bb2d06d6aa4f8eb11fdfd5e7f85fb3dbb0f1

Download Submit
\Users\Admin\AppData\Local\Temp\259426636_ex.tmp

Filesize
47KB

MD5
618ce117563a0c851830cd2be505b652

SHA1
054e3289e2d841a47a40211c28892a8511077b31

SHA256
5d3cbc7b0893000dafdbc6964379a3c5a225fd25fa9e47506dc62150965de7a2

SHA512
4789f1a6bbf0f5c85b6a9791f274355ee81715e86d197f26714373fc7cb6c8f59e2d767d00c71e53ab90fdd4708248e0a740039eb4aa68d03a452809e099fea2

Download Submit
memory/2328-1-0x0000000000400000-0x0000000000417340-memory.dmp

Filesize
92KB

Download
memory/2328-7-0x0000000010000000-0x0000000010022000-memory.dmp

Filesize
136KB

Download
memory/2328-13-0x0000000000400000-0x0000000000417340-memory.dmp

Filesize
92KB

Download
memory/2848-15-0x0000000010000000-0x0000000010022000-memory.dmp

Filesize
136KB

Download
memory/2848-17-0x0000000010000000-0x0000000010022000-memory.dmp

Filesize
136KB

Download
memory/2848-19-0x0000000010000000-0x0000000010022000-memory.dmp

Filesize
136KB

Download
memory/3068-0-0x0000000000400000-0x0000000000401000-memory.dmp

Filesize
4KB

Download
memory/3068-16-0x0000000000400000-0x0000000000417340-memory.dmp

Filesize
92KB

Download

Analysis

Sharing