gh0strat | 0b33aa0c25d8606c1e51f76c1300ade0eb16a339a412e3ec1d745e75fab54715

General

Target

JaffaCakes118_3d144eac212ae1a8fd536620e37ede06.exe
Size

176KB
MD5

3d144eac212ae1a8fd536620e37ede06
SHA1

18c7cb8375b94dd167801a2d89e088d5c01941e7
SHA256

0b33aa0c25d8606c1e51f76c1300ade0eb16a339a412e3ec1d745e75fab54715
SHA512

987676716769a200e794421d457d37c3cf79a21b348e6a562c6463f775bca7091ef94b897dac756b8caa98cc3eb8a8e7866619d34eda47c323722cdb193e4226
SSDEEP

3072:kcYcYKEzcW526y6hs6PhwtqrorsVlkTEIcy1O4F3JhMWIknqX5d+vIjc8UW:kcBYKEz557e2VroYoTU4JOWnS5d+v0cu

Score

10^/10

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/files/0x0033000000017021-16.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Blocklisted process makes network request 1 IoCs

flow	pid	Process
3	2740	rundll32.exe

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Rspdates Apxplicatioan\Parameters\ServiceDll	JaffaCakes118_3d144eac212ae1a8fd536620e37ede06.exe

Deletes itself 1 IoCs

pid	Process
2740	rundll32.exe

Loads dropped DLL 2 IoCs

pid	Process
3068	svchost.exe
2740	rundll32.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\hfsetemp.ini	JaffaCakes118_3d144eac212ae1a8fd536620e37ede06.exe
File created	C:\Windows\Svchost.txt	JaffaCakes118_3d144eac212ae1a8fd536620e37ede06.exe
File created	C:\Windows\Svchost.reg	JaffaCakes118_3d144eac212ae1a8fd536620e37ede06.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_3d144eac212ae1a8fd536620e37ede06.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
3068	svchost.exe
3068	svchost.exe
3068	svchost.exe
3068	svchost.exe
3068	svchost.exe
3068	svchost.exe
3068	svchost.exe
3068	svchost.exe
3068	svchost.exe
3068	svchost.exe
3068	svchost.exe
3068	svchost.exe
3068	svchost.exe
3068	svchost.exe
3068	svchost.exe
3068	svchost.exe
3068	svchost.exe
3068	svchost.exe
3068	svchost.exe
3068	svchost.exe
3068	svchost.exe
3068	svchost.exe
3068	svchost.exe
3068	svchost.exe
3068	svchost.exe
3068	svchost.exe
3068	svchost.exe
3068	svchost.exe
3068	svchost.exe
3068	svchost.exe
3068	svchost.exe
3068	svchost.exe
3068	svchost.exe
3068	svchost.exe
3068	svchost.exe
3068	svchost.exe
3068	svchost.exe
3068	svchost.exe
3068	svchost.exe
3068	svchost.exe
3068	svchost.exe
3068	svchost.exe
3068	svchost.exe
3068	svchost.exe
3068	svchost.exe
3068	svchost.exe
3068	svchost.exe
3068	svchost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	2844	JaffaCakes118_3d144eac212ae1a8fd536620e37ede06.exe
Token: SeRestorePrivilege	2844	JaffaCakes118_3d144eac212ae1a8fd536620e37ede06.exe
Token: SeDebugPrivilege	3068	svchost.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2740	3068	svchost.exe	31
PID 3068 wrote to memory of 2740	3068	svchost.exe	31
PID 3068 wrote to memory of 2740	3068	svchost.exe	31
PID 3068 wrote to memory of 2740	3068	svchost.exe	31
PID 3068 wrote to memory of 2740	3068	svchost.exe	31
PID 3068 wrote to memory of 2740	3068	svchost.exe	31
PID 3068 wrote to memory of 2740	3068	svchost.exe	31

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3d144eac212ae1a8fd536620e37ede06.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3d144eac212ae1a8fd536620e37ede06.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2844

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "c:\windows\system32\winnie.cmd",EASTNOD Rspdates Apxplicatioan
  2⤵
  - Blocklisted process makes network request
  - Deletes itself
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

1

T1505

Terminal Services DLL

1

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\hfsetemp.ini

Filesize
365B

MD5
d512cf61534d5cbb71de98c6e65e7fe3

SHA1
56dddd5d595e1ea49b88b1f4e5970b9f0ac85824

SHA256
3afbfe4b8d0325e58811f788478bf53439fa26fdcbb5cd081b8a59535c749055

SHA512
de306841ca0fa2a3f05b8728f1bdd3bfd459dde01313b0b3773f8d79da871f9545c2ae0ef4122f6018743825795269d7839b0cee9d0ddc260eaa0d1e3852a74c

Download Submit
\??\c:\windows\SysWOW64\winnie.cmd

Filesize
1.1MB

MD5
9b569c217ec8927f7e33f9e8c814194a

SHA1
ea393da6c19431c23fecbf7fd6bb51c43fc7ead4

SHA256
22dee5c0e50489e53153d6d0484c9337b6e9f84a9dbb7cfb0301565102a461ff

SHA512
c934678a9879d2de5de2f2c016b119401cab351fa1c050ec5a509002cfb221b8911c053e51c284cc59d0875c10b7e9bfdeb518a1ed0b250e9c5d9f87dfc3b9d1

Download Submit

Analysis

Sharing