gh0strat | 37e36da002e3d24a504050250e61ee37209a0378e88bb6d00a6823fd9770a7f8

General

Target
jaffacakes118_37e36da002e3d24a504050250e61ee37209a0378e88bb6d00a6823fd9770a7f8.exe
Size 106KB
Sample260927-15nn9sys3l
SHA256 37e36da002e3d24a504050250e61ee37209a0378e88bb6d00a6823fd9770a7f8
MD5 0bcc9895cdb7aa392502c9d01914ea1b
SHA1 9421dd8336790913f71bf1a82a9ab4bb2c73fae6
SHA512 24ab821a8da91a69ebd578be0cd66bf5289fdc95d2d35c199ccdbb2305f5411cbc111584289e0f5218a61f3747b056ac1377d9c3f8fda710f057acb1c1421874
SSDEEP 3072:9b8syi34KFWQDxX9Rf/bUH9B18vrsKoksnKOxl9:9gsyi34rexrS9j0YKTsnKOxl9
TLSH
T125B38E01F9C640FEE6A8157C14BF7B369B3B7AA587095F837358D9580D63241AF2238B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery gh0strat persistence rat

Malware Config

Signatures

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Gh0st RAT payload 3 IoCs

resource	yara_rule
behavioral2/memory/4200-0-0x0000000000400000-0x000000000041D200-memory.dmp	family_gh0strat
behavioral2/files/0x001300000001b2f6-4.dat	family_gh0strat
behavioral2/memory/4200-14-0x0000000000400000-0x000000000041D200-memory.dmp	family_gh0strat

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Drivers\beep.sys	jaffacakes118_37e36da002e3d24a504050250e61ee37209a0378e88bb6d00a6823fd9770a7f8.exe
File opened for modification	C:\Windows\SysWOW64\Drivers\beep.sys	svchost.exe

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibilityex.dll"	jaffacakes118_37e36da002e3d24a504050250e61ee37209a0378e88bb6d00a6823fd9770a7f8.exe

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
2964	svchost.exe

Loads dropped DLL 2 IoCs

pid	Process
4200	jaffacakes118_37e36da002e3d24a504050250e61ee37209a0378e88bb6d00a6823fd9770a7f8.exe
2964	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\FastUserSwitchingCompatibilityex.dll	jaffacakes118_37e36da002e3d24a504050250e61ee37209a0378e88bb6d00a6823fd9770a7f8.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5080	4200	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_37e36da002e3d24a504050250e61ee37209a0378e88bb6d00a6823fd9770a7f8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_37e36da002e3d24a504050250e61ee37209a0378e88bb6d00a6823fd9770a7f8.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_37e36da002e3d24a504050250e61ee37209a0378e88bb6d00a6823fd9770a7f8.exe"
1⤵
- Drops file in Drivers directory
- Server Software Component: Terminal Services DLL
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4200
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4200 -s 640
  2⤵
  - Program crash
  PID:5080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4200 -ip 4200
1⤵
PID:972

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs
1⤵
PID:4472

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s FastUserSwitchingCompatibility
1⤵
- Drops file in Drivers directory
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

1

T1505

Terminal Services DLL

1

T1505.005

Privilege Escalation

Defense Evasion

Indicator Removal

1

T1070

File Deletion

1

T1070.004

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dll.tmp

Path C:\Users\Admin\AppData\Local\Temp\dll.tmp
Size 95KB
SHA256 fcd0a6e8c41d093b3b742d34890931bca6b3e3e8ad80d5a4d87773cba46c9b4f
MD5 00a60281dc2195a5db2c4ef34d3b5d70
SHA1 053ced846064474b2b8b38fc492ddaf1cda02a2e
SHA512 392d97568d75cce40e5ed9ffded17299404e34945276a7a2898ed611f4073c6d704b8b27d0a4046b4c4cc6a5b593dd5bcdb65416ca0771e5a89e001d5fd1dc1f
SSDEEP 1536:FPFJHJuXUPDxXModRsS/bcbHFfB18welrsKoksnKOx:xFWQDxX9Rf/bUH9B18vrsKoksnKOx
TLSH
T196A37D11F6C640FEE6A8147C14AF7B369B3B7AA59B055F837328DE540D233519F2238A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.tmp

Path C:\Windows\SysWOW64\install.tmp
Size 116B
SHA256 9464546926935dfff6bdc6401f66c06772f6b4f92d98e4ff6bd9704479360200
MD5 952eb2ec28c0f144e15c48c651eac88e
SHA1 bb9836c28704b2b5a8933dddc69795afbda284cb
SHA512 0eaa59fe129c4d597a79121b8f3686ff2b98b081208266a6e5b18bee0aa2db5f6744c37e48b21464988f7235e0ae370266e48b70e1409fcddebda1da3b744067
TLSH
T174B0122235C2CDB30841CDE74DF2E75871330D063B8C7F22022697EC025841AF59250E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4200-0-0x0000000000400000-0x000000000041D200-memory.dmp

Download

memory/4200-14-0x0000000000400000-0x000000000041D200-memory.dmp