gh0strat | 8a0bd42a625825a60ef70b82c2092a7ba40f70903f1d9a896f46df9958e5396a

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/04/2024, 22:07

Target

e88824aa7bf5ed456771b4712db445c1_JaffaCakes118.exe
Size

201KB
MD5

e88824aa7bf5ed456771b4712db445c1
SHA1

661e1e83da3033b6e60fac05f0d9b4b4a695ec36
SHA256

8a0bd42a625825a60ef70b82c2092a7ba40f70903f1d9a896f46df9958e5396a
SHA512

d6b09a894c927deba60fa6129b9951fb706c737944ec96d184d2ae0d108b7a72f346152de25343796d16222625bfd6c22b3d12e6c63a76f2df4db6876a859363
SSDEEP

3072:wQYFWQDxX9Rf/bUH9B18vrsKoksEKOxix3+LwwXx0FWlYVAjPjLnV:B1exrS9j0YKTsEKOxJLwwWFBAXp

Score

10^/10

gh0strat rat

Gh0st RAT payload 2 IoCs

resource	yara_rule
behavioral1/memory/1940-0-0x0000000000400000-0x0000000000451000-memory.dmp	family_gh0strat
behavioral1/memory/1940-1-0x0000000000400000-0x0000000000451000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Program crash 1 IoCs

pid	pid_target	Process	procid_target
356	1940	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 356	1940	e88824aa7bf5ed456771b4712db445c1_JaffaCakes118.exe	28
PID 1940 wrote to memory of 356	1940	e88824aa7bf5ed456771b4712db445c1_JaffaCakes118.exe	28
PID 1940 wrote to memory of 356	1940	e88824aa7bf5ed456771b4712db445c1_JaffaCakes118.exe	28
PID 1940 wrote to memory of 356	1940	e88824aa7bf5ed456771b4712db445c1_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\e88824aa7bf5ed456771b4712db445c1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e88824aa7bf5ed456771b4712db445c1_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 36
  2⤵
  - Program crash
  PID:356

memory/1940-0-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1940-1-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download