gh0strat | 07e06a6712fc24faceaaf157311047a571b43661445e3f5dbe125e4e28e593fb

General

Target

JaffaCakes118_4b442a66bf49b764d4c47982a3fd85a6.exe
Size

132KB
MD5

4b442a66bf49b764d4c47982a3fd85a6
SHA1

7e840040f225916671127aaf5440c3c6bd805545
SHA256

07e06a6712fc24faceaaf157311047a571b43661445e3f5dbe125e4e28e593fb
SHA512

18f42fd472fa21ee580f032d0dd13620aaaddc63d475093499acbf81ec4696f4db2c82e6f542af7af3f30c0b72307cb636fe9df65b66095599e2237838bd188b
SSDEEP

1536:X9ohPGJiNOSsZ/A6TVZK12XvpscMvBf1AeO5b3QUIPLa8P9:C4Sofpsrvx1AeKbAUIPLrP9

Score

10^/10

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/2608-0-0x0000000000400000-0x0000000000422000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\:\WINDOWS\Temp\svchast.exe 20253445320.exe = "C:\\WINDOWS\\Temp\\svchast.exe 20253445320.exe"	JaffaCakes118_4b442a66bf49b764d4c47982a3fd85a6.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_4b442a66bf49b764d4c47982a3fd85a6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchast.exe 20253445320.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
2060	taskkill.exe
2164	taskkill.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2608	JaffaCakes118_4b442a66bf49b764d4c47982a3fd85a6.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2060	taskkill.exe
Token: SeDebugPrivilege	2164	taskkill.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 2060	2608	JaffaCakes118_4b442a66bf49b764d4c47982a3fd85a6.exe	29
PID 2608 wrote to memory of 2060	2608	JaffaCakes118_4b442a66bf49b764d4c47982a3fd85a6.exe	29
PID 2608 wrote to memory of 2060	2608	JaffaCakes118_4b442a66bf49b764d4c47982a3fd85a6.exe	29
PID 2608 wrote to memory of 2060	2608	JaffaCakes118_4b442a66bf49b764d4c47982a3fd85a6.exe	29
PID 2608 wrote to memory of 2060	2608	JaffaCakes118_4b442a66bf49b764d4c47982a3fd85a6.exe	29
PID 2608 wrote to memory of 2060	2608	JaffaCakes118_4b442a66bf49b764d4c47982a3fd85a6.exe	29
PID 2608 wrote to memory of 2060	2608	JaffaCakes118_4b442a66bf49b764d4c47982a3fd85a6.exe	29
PID 2608 wrote to memory of 2644	2608	JaffaCakes118_4b442a66bf49b764d4c47982a3fd85a6.exe	30
PID 2608 wrote to memory of 2644	2608	JaffaCakes118_4b442a66bf49b764d4c47982a3fd85a6.exe	30
PID 2608 wrote to memory of 2644	2608	JaffaCakes118_4b442a66bf49b764d4c47982a3fd85a6.exe	30
PID 2608 wrote to memory of 2644	2608	JaffaCakes118_4b442a66bf49b764d4c47982a3fd85a6.exe	30
PID 2608 wrote to memory of 2644	2608	JaffaCakes118_4b442a66bf49b764d4c47982a3fd85a6.exe	30
PID 2608 wrote to memory of 2644	2608	JaffaCakes118_4b442a66bf49b764d4c47982a3fd85a6.exe	30
PID 2608 wrote to memory of 2644	2608	JaffaCakes118_4b442a66bf49b764d4c47982a3fd85a6.exe	30
PID 2644 wrote to memory of 2164	2644	svchast.exe 20253445320.exe	32
PID 2644 wrote to memory of 2164	2644	svchast.exe 20253445320.exe	32
PID 2644 wrote to memory of 2164	2644	svchast.exe 20253445320.exe	32
PID 2644 wrote to memory of 2164	2644	svchast.exe 20253445320.exe	32
PID 2644 wrote to memory of 2164	2644	svchast.exe 20253445320.exe	32
PID 2644 wrote to memory of 2164	2644	svchast.exe 20253445320.exe	32
PID 2644 wrote to memory of 2164	2644	svchast.exe 20253445320.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4b442a66bf49b764d4c47982a3fd85a6.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4b442a66bf49b764d4c47982a3fd85a6.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im Ksafetray.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2060
- C:\WINDOWS\Temp\svchast.exe 20253445320.exe
  "C:\WINDOWS\Temp\svchast.exe 20253445320.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Ksafetray.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2164