gh0strat | 2a1034dd32bf7a79fa810ac42fe1c27ace6955bdb21b2f12db0322880ac39c18

General

Target

JaffaCakes118_592420158f89efbb28d0bdb904c19de4.exe
Size

70KB
MD5

592420158f89efbb28d0bdb904c19de4
SHA1

d068f6d7fab9cb50240cbe1512bf996e2dfc1001
SHA256

2a1034dd32bf7a79fa810ac42fe1c27ace6955bdb21b2f12db0322880ac39c18
SHA512

27b07297efa856eb3fd50853295fe104e9b73520d6a91742ecd57d42fda2385b6ab7837ba6fd2955f41b922456832ef1bbf890b6bf90b858979596a1e58dc3be
SSDEEP

768:YqpmE7/ab4ZzVFT5W2LbMGc6dLhFoYlUEfXA6/nZkxHvHc1kv/n6Ur8xPFpzUfo:mef5W2BcqoWfXA6PZCv81k8zUA

Score

10^/10

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/2492-10-0x0000000000400000-0x0000000000416000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Executes dropped EXE 1 IoCs

pid	Process
1720	Sogou.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\KRIS = "C:\\Windows\\Sogou.exe"	JaffaCakes118_592420158f89efbb28d0bdb904c19de4.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\svchest.ini	Sogou.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Sogou.exe	JaffaCakes118_592420158f89efbb28d0bdb904c19de4.exe
File opened for modification	C:\Windows\Sogou.exe	JaffaCakes118_592420158f89efbb28d0bdb904c19de4.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sogou.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_592420158f89efbb28d0bdb904c19de4.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
1652	taskkill.exe
2184	taskkill.exe

Suspicious behavior: EnumeratesProcesses 51 IoCs

pid	Process
1720	Sogou.exe
1720	Sogou.exe
1720	Sogou.exe
1720	Sogou.exe
1720	Sogou.exe
1720	Sogou.exe
1720	Sogou.exe
1720	Sogou.exe
1720	Sogou.exe
1720	Sogou.exe
1720	Sogou.exe
1720	Sogou.exe
1720	Sogou.exe
1720	Sogou.exe
1720	Sogou.exe
1720	Sogou.exe
1720	Sogou.exe
1720	Sogou.exe
1720	Sogou.exe
1720	Sogou.exe
1720	Sogou.exe
1720	Sogou.exe
1720	Sogou.exe
1720	Sogou.exe
1720	Sogou.exe
1720	Sogou.exe
1720	Sogou.exe
1720	Sogou.exe
1720	Sogou.exe
1720	Sogou.exe
1720	Sogou.exe
1720	Sogou.exe
1720	Sogou.exe
1720	Sogou.exe
1720	Sogou.exe
1720	Sogou.exe
1720	Sogou.exe
1720	Sogou.exe
1720	Sogou.exe
1720	Sogou.exe
1720	Sogou.exe
1720	Sogou.exe
1720	Sogou.exe
1720	Sogou.exe
1720	Sogou.exe
1720	Sogou.exe
1720	Sogou.exe
1720	Sogou.exe
1720	Sogou.exe
1720	Sogou.exe
1720	Sogou.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2492	JaffaCakes118_592420158f89efbb28d0bdb904c19de4.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1652	taskkill.exe
Token: SeDebugPrivilege	2184	taskkill.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 1652	2492	JaffaCakes118_592420158f89efbb28d0bdb904c19de4.exe	30
PID 2492 wrote to memory of 1652	2492	JaffaCakes118_592420158f89efbb28d0bdb904c19de4.exe	30
PID 2492 wrote to memory of 1652	2492	JaffaCakes118_592420158f89efbb28d0bdb904c19de4.exe	30
PID 2492 wrote to memory of 1652	2492	JaffaCakes118_592420158f89efbb28d0bdb904c19de4.exe	30
PID 2492 wrote to memory of 1652	2492	JaffaCakes118_592420158f89efbb28d0bdb904c19de4.exe	30
PID 2492 wrote to memory of 1652	2492	JaffaCakes118_592420158f89efbb28d0bdb904c19de4.exe	30
PID 2492 wrote to memory of 1652	2492	JaffaCakes118_592420158f89efbb28d0bdb904c19de4.exe	30
PID 2492 wrote to memory of 1720	2492	JaffaCakes118_592420158f89efbb28d0bdb904c19de4.exe	33
PID 2492 wrote to memory of 1720	2492	JaffaCakes118_592420158f89efbb28d0bdb904c19de4.exe	33
PID 2492 wrote to memory of 1720	2492	JaffaCakes118_592420158f89efbb28d0bdb904c19de4.exe	33
PID 2492 wrote to memory of 1720	2492	JaffaCakes118_592420158f89efbb28d0bdb904c19de4.exe	33
PID 2492 wrote to memory of 1720	2492	JaffaCakes118_592420158f89efbb28d0bdb904c19de4.exe	33
PID 2492 wrote to memory of 1720	2492	JaffaCakes118_592420158f89efbb28d0bdb904c19de4.exe	33
PID 2492 wrote to memory of 1720	2492	JaffaCakes118_592420158f89efbb28d0bdb904c19de4.exe	33
PID 1720 wrote to memory of 2184	1720	Sogou.exe	34
PID 1720 wrote to memory of 2184	1720	Sogou.exe	34
PID 1720 wrote to memory of 2184	1720	Sogou.exe	34
PID 1720 wrote to memory of 2184	1720	Sogou.exe	34

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_592420158f89efbb28d0bdb904c19de4.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_592420158f89efbb28d0bdb904c19de4.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im Ksafetray.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1652
- C:\Windows\Sogou.exe
  C:\Windows\Sogou.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1720
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Ksafetray.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\svchest.ini

Filesize
94B

MD5
f537bd72a0991fd0f2b184a94dfe76ab

SHA1
1ad19ad7a4a1b9d3d78c14dd5a760063c5d13dfa

SHA256
17e1af3fb61c8c169e0a676b60365c0e6ac47734cbc0f19182665d7260f9b900

SHA512
ac2644c52ac85e9479cea6c6d6e8f6072329c4ca8b78d105cf98a902fc6b6d87e758a525cb00bbc4f22ab7ef071363ce25a6c7a24a41a6a56928b88a406e6c71

Download Submit
memory/2492-10-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads