gh0strat | 7a5376903fe26fa792a55b3d4f995d34541fab173297fb7b70e22871ae866149

General

Target

JaffaCakes118_62e4ba7533320089f9b6710d20e29282.exe
Size

614KB
MD5

62e4ba7533320089f9b6710d20e29282
SHA1

f62947d65701d05f2c2236d842c4293da1279478
SHA256

7a5376903fe26fa792a55b3d4f995d34541fab173297fb7b70e22871ae866149
SHA512

a05a8a3367c146a6545c32ce6c3efb8a51c54e1c6b980384d2ea04c6ab471656be5045725aa90b0e29bd3538e8bc39d33ea81f9efe1354165e4892ff3f8237fc
SSDEEP

12288:6esLDOu68IwmMvMFpKIhMBlnOTB6zf8PDATGNBpRGQ7MZ862:hsEimM0bPsOTIoPDATkMJ2

Score

10^/10

Malware Config

Signatures

Gh0st RAT payload 3 IoCs

resource	yara_rule
behavioral1/memory/2496-59-0x0000000010000000-0x0000000010032000-memory.dmp	family_gh0strat
behavioral1/memory/2496-60-0x0000000010000000-0x0000000010032000-memory.dmp	family_gh0strat
behavioral1/memory/2496-64-0x0000000010000000-0x0000000010032000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\BITS\Parameters\ServiceDll = "C:\\Windows\\system32\\bits.dll"	server.exe

Executes dropped EXE 1 IoCs

pid	Process
2496	server.exe

Loads dropped DLL 3 IoCs

pid	Process
2528	cmd.exe
2528	cmd.exe
2496	server.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\bits.dll	server.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000900000001745b-57.dat	upx
behavioral1/memory/2496-59-0x0000000010000000-0x0000000010032000-memory.dmp	upx
behavioral1/memory/2496-60-0x0000000010000000-0x0000000010032000-memory.dmp	upx
behavioral1/memory/2496-64-0x0000000010000000-0x0000000010032000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_62e4ba7533320089f9b6710d20e29282.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2496	server.exe
2496	server.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2856	1688	JaffaCakes118_62e4ba7533320089f9b6710d20e29282.exe	30
PID 1688 wrote to memory of 2856	1688	JaffaCakes118_62e4ba7533320089f9b6710d20e29282.exe	30
PID 1688 wrote to memory of 2856	1688	JaffaCakes118_62e4ba7533320089f9b6710d20e29282.exe	30
PID 1688 wrote to memory of 2856	1688	JaffaCakes118_62e4ba7533320089f9b6710d20e29282.exe	30
PID 1688 wrote to memory of 2528	1688	JaffaCakes118_62e4ba7533320089f9b6710d20e29282.exe	32
PID 1688 wrote to memory of 2528	1688	JaffaCakes118_62e4ba7533320089f9b6710d20e29282.exe	32
PID 1688 wrote to memory of 2528	1688	JaffaCakes118_62e4ba7533320089f9b6710d20e29282.exe	32
PID 1688 wrote to memory of 2528	1688	JaffaCakes118_62e4ba7533320089f9b6710d20e29282.exe	32
PID 2528 wrote to memory of 2496	2528	cmd.exe	34
PID 2528 wrote to memory of 2496	2528	cmd.exe	34
PID 2528 wrote to memory of 2496	2528	cmd.exe	34
PID 2528 wrote to memory of 2496	2528	cmd.exe	34

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_62e4ba7533320089f9b6710d20e29282.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_62e4ba7533320089f9b6710d20e29282.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\ÌìÌì¸üÐÂ.exe.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2856
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\server.exe.bat" "
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2528
- - C:\Users\Admin\AppData\Local\Temp\server.exe
    "C:\Users\Admin\AppData\Local\Temp\server.exe"
    3⤵
    - Server Software Component: Terminal Services DLL
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

1

T1505

Terminal Services DLL

1

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\server.exe.bat

Filesize
154B

MD5
72329485b67191d6d47d5dd4cc9b63e9

SHA1
58a997b8caa0ddac6fba5f2e0ba613a20011826b

SHA256
7d81d958a98c30821fc0448462b3f867dc2eb048ba30a56432abe3e18c780e5b

SHA512
6a222de5cd6d18fcf2bfad4134f17c207cf756e0da958b0702ffd3446abe8b0111d68133d15f7be3c12da2b5ce710c14b89fbbba8e294029663aca268df02bef

Download Submit
C:\Users\Admin\AppData\Local\Temp\ÌìÌì¸üÐÂ.exe.bat

Filesize
160B

MD5
39d63e0183a257628dcabff58857289b

SHA1
c13cc6957c6b07e5884084d8aad26e1f83b35968

SHA256
5d669407c287cbf3136c2049e1f8873bd3146a676d177b802dcd21cd488a201a

SHA512
ee73a63166ba66dfea6e00949f9b3b1f22722923b1cdf7207c0e4456dc52d8bd07e1da31cf1e81f86e488ff6d954c4b304ee81f2419ef504f1c3c96a83895c93

Download Submit
\Users\Admin\AppData\Local\Temp\server.exe

Filesize
119KB

MD5
fc1b42d3ba4cf9289ffddab093f69b71

SHA1
9cc68096e94a0088f30cc420c3c3bfb78080ab86

SHA256
a282a5dca7ebff6402c6f7c51f2c6df41e3010a82dc916f9796bb67db315c9fd

SHA512
e25b50d7de17e08cc89fdd31d8c7cccdfa59bb3f5de63f7368b6c95f45a2063c57954f5c908d80ffcd21175229dd19e4b32f78e159289b9b430dcd8b28b94ed7

Download Submit
\Windows\SysWOW64\bits.dll

Filesize
103KB

MD5
aa56e054dea2042de7f8f4a5e1cb0194

SHA1
797ed5d7660c7b9f375406968ae0648f04655003

SHA256
6bd3b681aff9a76c8171c285cdd7ea30155e1dfcb85939450f3db5843a437764

SHA512
24ff874fab08c5c1e9a009849f6a6564dc91762eb0d0c120b522e7d1960bf155209fa9ed3d3c11604d04e5482cc85eb069b0c21d08599b833c1ac6cb8be791bd

Download Submit
memory/1688-8-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/1688-5-0x0000000001F20000-0x0000000001F21000-memory.dmp

Filesize
4KB

Download
memory/1688-10-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/1688-26-0x0000000003250000-0x0000000003251000-memory.dmp

Filesize
4KB

Download
memory/1688-25-0x0000000003260000-0x0000000003261000-memory.dmp

Filesize
4KB

Download
memory/1688-24-0x0000000003270000-0x0000000003271000-memory.dmp

Filesize
4KB

Download
memory/1688-23-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/1688-22-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1688-21-0x0000000003290000-0x0000000003291000-memory.dmp

Filesize
4KB

Download
memory/1688-20-0x0000000003280000-0x0000000003281000-memory.dmp

Filesize
4KB

Download
memory/1688-19-0x00000000032A0000-0x00000000032A1000-memory.dmp

Filesize
4KB

Download
memory/1688-9-0x0000000000850000-0x0000000000851000-memory.dmp

Filesize
4KB

Download
memory/1688-0-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1688-7-0x0000000000860000-0x0000000000861000-memory.dmp

Filesize
4KB

Download
memory/1688-6-0x0000000001F10000-0x0000000001F11000-memory.dmp

Filesize
4KB

Download
memory/1688-11-0x0000000003230000-0x0000000003231000-memory.dmp

Filesize
4KB

Download
memory/1688-4-0x0000000000580000-0x0000000000581000-memory.dmp

Filesize
4KB

Download
memory/1688-3-0x0000000000870000-0x0000000000871000-memory.dmp

Filesize
4KB

Download
memory/1688-2-0x0000000000880000-0x0000000000881000-memory.dmp

Filesize
4KB

Download
memory/1688-12-0x0000000003240000-0x0000000003241000-memory.dmp

Filesize
4KB

Download
memory/1688-42-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1688-43-0x0000000000280000-0x00000000002D2000-memory.dmp

Filesize
328KB

Download
memory/1688-13-0x0000000003220000-0x0000000003225000-memory.dmp

Filesize
20KB

Download
memory/1688-14-0x00000000032A0000-0x00000000032A1000-memory.dmp

Filesize
4KB

Download
memory/1688-1-0x0000000000280000-0x00000000002D2000-memory.dmp

Filesize
328KB

Download
memory/2496-59-0x0000000010000000-0x0000000010032000-memory.dmp

Filesize
200KB

Download
memory/2496-60-0x0000000010000000-0x0000000010032000-memory.dmp

Filesize
200KB

Download
memory/2496-64-0x0000000010000000-0x0000000010032000-memory.dmp

Filesize
200KB

Download
memory/2496-63-0x0000000000520000-0x0000000000541000-memory.dmp

Filesize
132KB

Download
memory/2528-50-0x0000000000100000-0x0000000000121000-memory.dmp

Filesize
132KB

Download
memory/2528-48-0x0000000000100000-0x0000000000121000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing