gh0strat | 2eaffee2df904fe4f9e8275adba88b6b9c79833cd1c56f2efd730e49994ea3c1

General

Target

JaffaCakes118_569950bac39e02139f59232e4342bd72.exe
Size

338KB
MD5

569950bac39e02139f59232e4342bd72
SHA1

5fe8348ba8e33832c1d32c440ce6bcd5ca2d81a3
SHA256

2eaffee2df904fe4f9e8275adba88b6b9c79833cd1c56f2efd730e49994ea3c1
SHA512

2ab32d6807279921fd2c3f73d3dd7ed92fd1bdb1823c89e8065c7934b224e613daf7f82f39f457708c7f7ce7dd905f0166c16dfb61ca7d5d009ad857af3a0483
SSDEEP

6144:kDOKu03Vjuy4nDWgRAkPf2GQn8xID0DMFChkYkYZeTx1xirVOK/Apf8bZ9oWOQ:8ju0FKvR3Pf2GLxe0Dv7jZw1ucEN9oZQ

Score

10^/10

Malware Config

Signatures

Gh0st RAT payload 6 IoCs

resource	yara_rule
behavioral2/memory/1464-6-0x0000000000400000-0x0000000000486000-memory.dmp	family_gh0strat
behavioral2/memory/3040-28-0x0000000000400000-0x0000000000486000-memory.dmp	family_gh0strat
behavioral2/files/0x0004000000022b3b-33.dat	family_gh0strat
behavioral2/memory/3040-29-0x0000000000400000-0x0000000000486000-memory.dmp	family_gh0strat
behavioral2/memory/3040-25-0x0000000000400000-0x0000000000486000-memory.dmp	family_gh0strat
behavioral2/memory/1464-19-0x0000000000400000-0x0000000000486000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{76CD49E5-CDCC-44a7-8DBC-A651032FE409}	JaffaCakes118_569950bac39e02139f59232e4342bd72.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{76CD49E5-CDCC-44a7-8DBC-A651032FE409}\stubpath = "C:\\Windows\\system32\\insezthji.exe"	JaffaCakes118_569950bac39e02139f59232e4342bd72.exe

Executes dropped EXE 1 IoCs

pid	Process
3040	insezthji.exe

Loads dropped DLL 1 IoCs

pid	Process
4812	userinit.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\insezthji.exe	JaffaCakes118_569950bac39e02139f59232e4342bd72.exe
File opened for modification	C:\Windows\SysWOW64\insezthji.exe_lang.ini	JaffaCakes118_569950bac39e02139f59232e4342bd72.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_569950bac39e02139f59232e4342bd72.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	insezthji.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	userinit.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1464	JaffaCakes118_569950bac39e02139f59232e4342bd72.exe
1464	JaffaCakes118_569950bac39e02139f59232e4342bd72.exe
3040	insezthji.exe
3040	insezthji.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1464	JaffaCakes118_569950bac39e02139f59232e4342bd72.exe
Token: SeDebugPrivilege	3040	insezthji.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 3040	1464	JaffaCakes118_569950bac39e02139f59232e4342bd72.exe	85
PID 1464 wrote to memory of 3040	1464	JaffaCakes118_569950bac39e02139f59232e4342bd72.exe	85
PID 1464 wrote to memory of 3040	1464	JaffaCakes118_569950bac39e02139f59232e4342bd72.exe	85
PID 3040 wrote to memory of 4812	3040	insezthji.exe	86
PID 3040 wrote to memory of 4812	3040	insezthji.exe	86
PID 3040 wrote to memory of 4812	3040	insezthji.exe	86
PID 3040 wrote to memory of 4812	3040	insezthji.exe	86

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_569950bac39e02139f59232e4342bd72.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_569950bac39e02139f59232e4342bd72.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Windows\SysWOW64\insezthji.exe
  C:\Windows\system32\insezthji.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Windows\SysWOW64\userinit.exe
    userinit.exe
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\240646015_lang.dll

Filesize
122KB

MD5
a8279606ab507648d49c750df7ce270a

SHA1
505384b8dc287dbca20ba6d9db506bddbc0b3923

SHA256
5d7393bbe0f66c089371c40a7fcc554a4bd130838db35825659df703eef8400d

SHA512
5261c109df80b0f3198ecb7d60e9fe18a8b58762266cb80a442c8f00176a12fa1a414d711913ed12d6b12fb1782e79711353e611bf173426decc2c4eb0bb7855

Download Submit
C:\Windows\SysWOW64\insezthji.exe

Filesize
338KB

MD5
f5e0862bddc357383c5a6907b4e048cd

SHA1
9e7459b8e5df5d23361bcac07d162972acf99d9c

SHA256
adc6129112b429c02f50aec4dd5787781adf5ce91b3b39212891f783790dc3cf

SHA512
90aeca9251f183e455c4ac240571b72f37e66c0721b49785d1185196aaeb0794084012c7cb515cdb7dc46edc89f3a8f98d42325d96b5337e5810ce76cdb3a00a

Download Submit
memory/1464-6-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1464-20-0x0000000000401000-0x0000000000408000-memory.dmp

Filesize
28KB

Download
memory/1464-8-0x0000000000401000-0x0000000000408000-memory.dmp

Filesize
28KB

Download
memory/1464-7-0x0000000002200000-0x0000000002201000-memory.dmp

Filesize
4KB

Download
memory/1464-0-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1464-3-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1464-5-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1464-2-0x00000000021C0000-0x0000000002200000-memory.dmp

Filesize
256KB

Download
memory/1464-15-0x00000000021C0000-0x0000000002200000-memory.dmp

Filesize
256KB

Download
memory/1464-19-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1464-4-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1464-1-0x00000000021C0000-0x0000000002200000-memory.dmp

Filesize
256KB

Download
memory/3040-30-0x00000000004C0000-0x0000000000500000-memory.dmp

Filesize
256KB

Download
memory/3040-25-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/3040-24-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/3040-23-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/3040-22-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/3040-21-0x00000000004C0000-0x0000000000500000-memory.dmp

Filesize
256KB

Download
memory/3040-28-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/3040-29-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/3040-17-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/3040-16-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads