gh0strat | 2ad9158380d361406f472e19be5387920f147288951022145bd0999d9ae183b3

General

Target

JaffaCakes118_632e334cdf2bf8af293ae815ab92739b.exe
Size

387KB
MD5

632e334cdf2bf8af293ae815ab92739b
SHA1

acb86e09d4b829903460890c5464187087ea8b0b
SHA256

2ad9158380d361406f472e19be5387920f147288951022145bd0999d9ae183b3
SHA512

fab8e42771a483e7722fae4ec0cd256192cd7613e11fd52a49d741379e6e2b1e26b468393f1d68bf853b442fca260327171b94985d0054858ef8970eeeaab488
SSDEEP

12288:e2bGl7HnLFagg+anw7RxEQxEX60CPwAlto:5bGl7HLng3nARiQx460C4Kt

Score

10^/10

Malware Config

Signatures

Gh0st RAT payload 4 IoCs

resource	yara_rule
behavioral1/memory/2072-20-0x0000000000400000-0x000000000041E000-memory.dmp	family_gh0strat
behavioral1/files/0x000f000000018662-19.dat	family_gh0strat
behavioral1/files/0x00060000000186c8-25.dat	family_gh0strat
behavioral1/memory/2072-26-0x0000000000400000-0x000000000041E000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Drivers\beep.sys	svchost.exe

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibilityex.dll"	server.exe

Executes dropped EXE 2 IoCs

pid	Process
2060	·èÅ£µÄ¹ÊÊÂ.exe
2072	server.exe

Loads dropped DLL 5 IoCs

pid	Process
2492	JaffaCakes118_632e334cdf2bf8af293ae815ab92739b.exe
2492	JaffaCakes118_632e334cdf2bf8af293ae815ab92739b.exe
2492	JaffaCakes118_632e334cdf2bf8af293ae815ab92739b.exe
2492	JaffaCakes118_632e334cdf2bf8af293ae815ab92739b.exe
1624	svchost.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\FastUserSwitchingCompatibilityex.dll	server.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	svchost.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\getip[1].htm	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_632e334cdf2bf8af293ae815ab92739b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	·èÅ£µÄ¹ÊÊÂ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Modifies data under HKEY_USERS 24 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C9355E71-6C69-42EC-BC66-1A229BB74F95}\WpadDecisionTime = d0276f553d92db01	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C9355E71-6C69-42EC-BC66-1A229BB74F95}\WpadNetworkName = "Network 3"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00d5000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C9355E71-6C69-42EC-BC66-1A229BB74F95}	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C9355E71-6C69-42EC-BC66-1A229BB74F95}\WpadDecisionReason = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c6-f9-47-ac-63-b9	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c6-f9-47-ac-63-b9\WpadDecisionTime = d0276f553d92db01	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C9355E71-6C69-42EC-BC66-1A229BB74F95}\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C9355E71-6C69-42EC-BC66-1A229BB74F95}\c6-f9-47-ac-63-b9	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c6-f9-47-ac-63-b9\WpadDecisionReason = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c6-f9-47-ac-63-b9\WpadDecision = "0"	svchost.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
476	Process not Found

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2492	JaffaCakes118_632e334cdf2bf8af293ae815ab92739b.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 2060	2492	JaffaCakes118_632e334cdf2bf8af293ae815ab92739b.exe	30
PID 2492 wrote to memory of 2060	2492	JaffaCakes118_632e334cdf2bf8af293ae815ab92739b.exe	30
PID 2492 wrote to memory of 2060	2492	JaffaCakes118_632e334cdf2bf8af293ae815ab92739b.exe	30
PID 2492 wrote to memory of 2060	2492	JaffaCakes118_632e334cdf2bf8af293ae815ab92739b.exe	30
PID 2492 wrote to memory of 2072	2492	JaffaCakes118_632e334cdf2bf8af293ae815ab92739b.exe	31
PID 2492 wrote to memory of 2072	2492	JaffaCakes118_632e334cdf2bf8af293ae815ab92739b.exe	31
PID 2492 wrote to memory of 2072	2492	JaffaCakes118_632e334cdf2bf8af293ae815ab92739b.exe	31
PID 2492 wrote to memory of 2072	2492	JaffaCakes118_632e334cdf2bf8af293ae815ab92739b.exe	31

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_632e334cdf2bf8af293ae815ab92739b.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_632e334cdf2bf8af293ae815ab92739b.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Users\Admin\AppData\Local\Temp\·èÅ£µÄ¹ÊÊÂ.exe
  "C:\Users\Admin\AppData\Local\Temp\·èÅ£µÄ¹ÊÊÂ.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2060
- C:\Users\Admin\AppData\Local\Temp\server.exe
  "C:\Users\Admin\AppData\Local\Temp\server.exe"
  2⤵
  - Server Software Component: Terminal Services DLL
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:2072

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

1

T1505

Terminal Services DLL

1

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\server.exe

Filesize
111KB

MD5
6aa308b7997ece9194a3d28a1b7e3f1f

SHA1
655bbf2499e9e73ea192ff17e79387f327e3e164

SHA256
62b3d692101a1e896fbbcaaa9b4381d76a545c87a68dbd62cf15ad9fab289c66

SHA512
eba7bcc5cb1f2cc40e82f08d195959efba0bed842399bbe11e7cda7e03736c41a0cc34f51d20463c547de364eecbaf433a9964643567573d4245f69199700a72

Download Submit
C:\Users\Admin\AppData\Local\Temp\·èÅ£µÄ¹ÊÊÂ.exe

Filesize
152KB

MD5
6c8a9b5d16c282c10f881a9616e81acc

SHA1
0cdc9c44c7505731d9805af0afbd19247ef6229a

SHA256
1879b6c508d1fc7c24b5c0aae2ad41cfbaa4eea69df5a6ee02dd1bf47055c1e9

SHA512
ee0cc08f9fde5932afd3c4e3c56d895bda536ddc8e1f2ed73286863b5a3f665b7cfe0acbadbeec89276269ac36fad0c784cb92435d16f692fd1ec49a52c04aef

Download Submit
\??\c:\windows\SysWOW64\fastuserswitchingcompatibilityex.dll

Filesize
99KB

MD5
89e0008ebd7ca52a6dae8506ca7c13dc

SHA1
6816ead13c9f15b7e71a1c7f77f35da772ff3439

SHA256
bb5705e22580dc3f98dfa07ec14e19108ad93519204b77b7be822a6b6df09fec

SHA512
3a802b7a83b0670af95e1cb2d92b5223ce0f53a17c90d18b91e71c3b5589688cb6fab60949c5f2315bee0a25fb0662b43c8328aca5fc8b577fb8a81de965e4a5

Download Submit
memory/2060-18-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2060-31-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2072-20-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2072-26-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2492-9-0x0000000000340000-0x000000000037F000-memory.dmp

Filesize
252KB

Download
memory/2492-8-0x0000000000340000-0x000000000037F000-memory.dmp

Filesize
252KB

Download
memory/2492-17-0x00000000002A0000-0x00000000002BE000-memory.dmp

Filesize
120KB

Download
memory/2492-30-0x0000000000340000-0x000000000037F000-memory.dmp

Filesize
252KB

Download

Analysis

Sharing