gh0strat | 5a418ead2ac303be8aed436403c896e8889a1a69e8713e4ed4dd8d5a19cb940a

General

Target

JaffaCakes118_488607dedae971ea5b8e7f3def3cb2b5.exe
Size

594KB
MD5

488607dedae971ea5b8e7f3def3cb2b5
SHA1

d5a4496f6d3f3b6d86b50c60a9a29566856cb09d
SHA256

5a418ead2ac303be8aed436403c896e8889a1a69e8713e4ed4dd8d5a19cb940a
SHA512

3f55cb348bd58ef79d81e891e88de9a3bebd2ee0576002070f57b1bc351a1327b550295dd4428005834e12c48ddda1152b8eb9c34061b07466488c46c98b53d1
SSDEEP

12288:nsaY8rUG145rgzi6f5oIFygohoFRbSwqsxYLH3KrztdE7Wb+2PZd:B/rc5rOamnTFR8tLHAoWb+2z

Score

10^/10

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023c04-16.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\Control Panel\International\Geo\Nation	JaffaCakes118_488607dedae971ea5b8e7f3def3cb2b5.exe

Executes dropped EXE 2 IoCs

pid	Process
1312	ip.exe
3676	server.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ball = "C:\\WINDOWS\\Ball.exe"	server.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1596-0-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/1596-24-0x0000000000400000-0x000000000041C000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\Ball.exe	server.exe
File opened for modification	C:\WINDOWS\Ball.exe	server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_488607dedae971ea5b8e7f3def3cb2b5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ip.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3676	server.exe
3676	server.exe
3676	server.exe
3676	server.exe
3676	server.exe
3676	server.exe
3676	server.exe
3676	server.exe
3676	server.exe
3676	server.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3676	server.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 1312	1596	JaffaCakes118_488607dedae971ea5b8e7f3def3cb2b5.exe	84
PID 1596 wrote to memory of 1312	1596	JaffaCakes118_488607dedae971ea5b8e7f3def3cb2b5.exe	84
PID 1596 wrote to memory of 1312	1596	JaffaCakes118_488607dedae971ea5b8e7f3def3cb2b5.exe	84
PID 1596 wrote to memory of 3676	1596	JaffaCakes118_488607dedae971ea5b8e7f3def3cb2b5.exe	85
PID 1596 wrote to memory of 3676	1596	JaffaCakes118_488607dedae971ea5b8e7f3def3cb2b5.exe	85
PID 1596 wrote to memory of 3676	1596	JaffaCakes118_488607dedae971ea5b8e7f3def3cb2b5.exe	85

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_488607dedae971ea5b8e7f3def3cb2b5.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_488607dedae971ea5b8e7f3def3cb2b5.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Users\Admin\AppData\Local\Temp\Temp\ip.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp\ip.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1312
- C:\Users\Admin\AppData\Local\Temp\Temp\server.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp\server.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Temp\ip.exe

Filesize
919KB

MD5
4e1851196b1e28b00b8f53797a7f8f62

SHA1
ddbfc84d4bfd59456b59b1077fbd20e8158a71ac

SHA256
bb7b35d387c3f13d06678742ae2656300c54565701fd7b76c5cc4c4fa095c988

SHA512
c03e68e9b0ae1cf5db534e1f910bbb632b8e7191bedc85bae863cf337c4da8429d1879f9671b87183d091472b66be82171c714efffabd717920a207db573be46

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp\server.exe

Filesize
192KB

MD5
f31cf901e65d11ddf064b0c42b23c3a0

SHA1
aaecc24009c509315f6cce076eb9ef0b8aaef27c

SHA256
8db677ba05eb872b3d30f2c5696ab75eb6d4eeee1ae2ef1ca45748a166dab8e3

SHA512
fde0ee5fa8aa2e2b947ec00d00ffaa78df627e93756d00f882fb575bcf9a436eb41e02a48654ac490ecaab883f7501592a65fdc02ba360ebaf157a714b8232ca

Download Submit
memory/1312-20-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/1312-31-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/1312-30-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/1596-0-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1596-24-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads