gh0strat | 2ad9158380d361406f472e19be5387920f147288951022145bd0999d9ae183b3

General

Target

JaffaCakes118_632e334cdf2bf8af293ae815ab92739b.exe
Size

387KB
MD5

632e334cdf2bf8af293ae815ab92739b
SHA1

acb86e09d4b829903460890c5464187087ea8b0b
SHA256

2ad9158380d361406f472e19be5387920f147288951022145bd0999d9ae183b3
SHA512

fab8e42771a483e7722fae4ec0cd256192cd7613e11fd52a49d741379e6e2b1e26b468393f1d68bf853b442fca260327171b94985d0054858ef8970eeeaab488
SSDEEP

12288:e2bGl7HnLFagg+anw7RxEQxEX60CPwAlto:5bGl7HLng3nARiQx460C4Kt

Score

10^/10

Malware Config

Signatures

Gh0st RAT payload 4 IoCs

resource	yara_rule
behavioral2/files/0x000c000000023c3a-7.dat	family_gh0strat
behavioral2/memory/1136-8-0x0000000000400000-0x000000000041E000-memory.dmp	family_gh0strat
behavioral2/files/0x000a000000023c43-13.dat	family_gh0strat
behavioral2/memory/1136-15-0x0000000000400000-0x000000000041E000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Drivers\beep.sys	svchost.exe

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibilityex.dll"	server.exe

Executes dropped EXE 2 IoCs

pid	Process
3932	·èÅ£µÄ¹ÊÊÂ.exe
1136	server.exe

Loads dropped DLL 1 IoCs

pid	Process
4028	svchost.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\FastUserSwitchingCompatibilityex.dll	server.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	svchost.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\getip[1].htm	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_632e334cdf2bf8af293ae815ab92739b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	·èÅ£µÄ¹ÊÊÂ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
652	Process not Found

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1752	JaffaCakes118_632e334cdf2bf8af293ae815ab92739b.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 3932	1752	JaffaCakes118_632e334cdf2bf8af293ae815ab92739b.exe	85
PID 1752 wrote to memory of 3932	1752	JaffaCakes118_632e334cdf2bf8af293ae815ab92739b.exe	85
PID 1752 wrote to memory of 3932	1752	JaffaCakes118_632e334cdf2bf8af293ae815ab92739b.exe	85
PID 1752 wrote to memory of 1136	1752	JaffaCakes118_632e334cdf2bf8af293ae815ab92739b.exe	86
PID 1752 wrote to memory of 1136	1752	JaffaCakes118_632e334cdf2bf8af293ae815ab92739b.exe	86
PID 1752 wrote to memory of 1136	1752	JaffaCakes118_632e334cdf2bf8af293ae815ab92739b.exe	86

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_632e334cdf2bf8af293ae815ab92739b.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_632e334cdf2bf8af293ae815ab92739b.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Users\Admin\AppData\Local\Temp\·èÅ£µÄ¹ÊÊÂ.exe
  "C:\Users\Admin\AppData\Local\Temp\·èÅ£µÄ¹ÊÊÂ.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3932
- C:\Users\Admin\AppData\Local\Temp\server.exe
  "C:\Users\Admin\AppData\Local\Temp\server.exe"
  2⤵
  - Server Software Component: Terminal Services DLL
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:1136

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s FastUserSwitchingCompatibility
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

1

T1505

Terminal Services DLL

1

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\server.exe

Filesize
111KB

MD5
6aa308b7997ece9194a3d28a1b7e3f1f

SHA1
655bbf2499e9e73ea192ff17e79387f327e3e164

SHA256
62b3d692101a1e896fbbcaaa9b4381d76a545c87a68dbd62cf15ad9fab289c66

SHA512
eba7bcc5cb1f2cc40e82f08d195959efba0bed842399bbe11e7cda7e03736c41a0cc34f51d20463c547de364eecbaf433a9964643567573d4245f69199700a72

Download Submit
C:\Users\Admin\AppData\Local\Temp\·èÅ£µÄ¹ÊÊÂ.exe

Filesize
152KB

MD5
6c8a9b5d16c282c10f881a9616e81acc

SHA1
0cdc9c44c7505731d9805af0afbd19247ef6229a

SHA256
1879b6c508d1fc7c24b5c0aae2ad41cfbaa4eea69df5a6ee02dd1bf47055c1e9

SHA512
ee0cc08f9fde5932afd3c4e3c56d895bda536ddc8e1f2ed73286863b5a3f665b7cfe0acbadbeec89276269ac36fad0c784cb92435d16f692fd1ec49a52c04aef

Download Submit
\??\c:\windows\SysWOW64\fastuserswitchingcompatibilityex.dll

Filesize
99KB

MD5
89e0008ebd7ca52a6dae8506ca7c13dc

SHA1
6816ead13c9f15b7e71a1c7f77f35da772ff3439

SHA256
bb5705e22580dc3f98dfa07ec14e19108ad93519204b77b7be822a6b6df09fec

SHA512
3a802b7a83b0670af95e1cb2d92b5223ce0f53a17c90d18b91e71c3b5589688cb6fab60949c5f2315bee0a25fb0662b43c8328aca5fc8b577fb8a81de965e4a5

Download Submit
memory/1136-8-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1136-15-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3932-5-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3932-18-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download

Analysis

Sharing