gh0strat | 3c26d8c54cee45d0cc0d58c629cf1aee4c0dcd1534ef956c484240bdf4ccbb99

General

Target

JaffaCakes118_52fae45994528c635150fec30273f0b0.exe
Size

292KB
MD5

52fae45994528c635150fec30273f0b0
SHA1

10ab647a23ae304e7e45ec2006975122621175b8
SHA256

3c26d8c54cee45d0cc0d58c629cf1aee4c0dcd1534ef956c484240bdf4ccbb99
SHA512

fd4fa692b3f4b980ec41bb871874f8718f6e1fdfc43cc47f3511ddcec95c49c69a49b8822d2d8c4566cd8abe94a91088110beb4f1c11dcb315acb8ab0c350324
SSDEEP

6144:pbS8Dee6ShFGDksOFilJzYcIbVwCuwtmnsxI5STCQjlM9:pO8K40DksoilJzYcIbVwCuwtmgI5Szj+

Score

10^/10

gh0strat defense_evasion discovery persistence rat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/files/0x000d000000012257-7.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\xxiaoxiliushui\Parameters\ServiceDll = "C:\\Windows\\system32\\mtf766d34m.dll"	JaffaCakes118_52fae45994528c635150fec30273f0b0.exe

Deletes itself 1 IoCs

pid	Process
1916	cmd.exe

Loads dropped DLL 6 IoCs

pid	Process
2848	JaffaCakes118_52fae45994528c635150fec30273f0b0.exe
2728	svchost.exe
2804	rundll32.exe
2804	rundll32.exe
2804	rundll32.exe
2804	rundll32.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\mtf766d34m.dll	JaffaCakes118_52fae45994528c635150fec30273f0b0.exe
File created	C:\Windows\SysWOW64\mtf766d34m.dll	JaffaCakes118_52fae45994528c635150fec30273f0b0.exe
File opened for modification	C:\Windows\SysWOW64\RCX6F85.tmp	JaffaCakes118_52fae45994528c635150fec30273f0b0.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_52fae45994528c635150fec30273f0b0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
2848	JaffaCakes118_52fae45994528c635150fec30273f0b0.exe
2804	rundll32.exe
2804	rundll32.exe
2804	rundll32.exe
2804	rundll32.exe
2804	rundll32.exe
2804	rundll32.exe
2804	rundll32.exe
2804	rundll32.exe
2804	rundll32.exe
2804	rundll32.exe
2804	rundll32.exe
2804	rundll32.exe
2804	rundll32.exe
2804	rundll32.exe
2804	rundll32.exe
2804	rundll32.exe
2804	rundll32.exe
2804	rundll32.exe
2804	rundll32.exe
2804	rundll32.exe
2804	rundll32.exe
2804	rundll32.exe
2804	rundll32.exe
2804	rundll32.exe
2804	rundll32.exe
2804	rundll32.exe
2804	rundll32.exe
2804	rundll32.exe
2804	rundll32.exe
2804	rundll32.exe
2804	rundll32.exe
2804	rundll32.exe
2804	rundll32.exe
2804	rundll32.exe
2804	rundll32.exe
2804	rundll32.exe
2804	rundll32.exe
2804	rundll32.exe
2804	rundll32.exe
2804	rundll32.exe
2804	rundll32.exe
2804	rundll32.exe
2804	rundll32.exe
2804	rundll32.exe
2804	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2728	svchost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2848	JaffaCakes118_52fae45994528c635150fec30273f0b0.exe
2848	JaffaCakes118_52fae45994528c635150fec30273f0b0.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 1916	2848	JaffaCakes118_52fae45994528c635150fec30273f0b0.exe	31
PID 2848 wrote to memory of 1916	2848	JaffaCakes118_52fae45994528c635150fec30273f0b0.exe	31
PID 2848 wrote to memory of 1916	2848	JaffaCakes118_52fae45994528c635150fec30273f0b0.exe	31
PID 2848 wrote to memory of 1916	2848	JaffaCakes118_52fae45994528c635150fec30273f0b0.exe	31
PID 2728 wrote to memory of 2804	2728	svchost.exe	33
PID 2728 wrote to memory of 2804	2728	svchost.exe	33
PID 2728 wrote to memory of 2804	2728	svchost.exe	33
PID 2728 wrote to memory of 2804	2728	svchost.exe	33
PID 2728 wrote to memory of 2804	2728	svchost.exe	33
PID 2728 wrote to memory of 2804	2728	svchost.exe	33
PID 2728 wrote to memory of 2804	2728	svchost.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_52fae45994528c635150fec30273f0b0.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_52fae45994528c635150fec30273f0b0.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_52fae45994528c635150fec30273f0b0.exe"
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:1916

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "xxiaoxiliushui"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe c:\windows\system32\mtf766d34m.dll, wince
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

1

T1505

Terminal Services DLL

1

T1505.005

Privilege Escalation

Defense Evasion

Indicator Removal

1

T1070

File Deletion

1

T1070.004

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\mtf766d34m.dll

Filesize
162KB

MD5
d991ebcf473c6adda9b4817d81cc191b

SHA1
1891a97be1bd4e02a74f3729fd2c31adfc97f5f3

SHA256
04e62897201e64d1e04087c2b2668c7a1701ef45a41846ce79379060d6693c2a

SHA512
aaabc185b9fe6ec0e55c8c6f2b5a7f40b3048a034a48f5d9ca008ac9806ea7be76beabcc427bbe886fc674e4b108c31be81f1cc1408fc25caf44e07b65282de7

Download Submit

Analysis

Sharing