Overview

overview

10

Static

static

10

e88824aa7b...18.exe

windows7-x64

10

e88824aa7b...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    145s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/04/2024, 22:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e88824aa7bf5ed456771b4712db445c1_JaffaCakes118.exe

  • Size

    201KB

  • MD5

    e88824aa7bf5ed456771b4712db445c1

  • SHA1

    661e1e83da3033b6e60fac05f0d9b4b4a695ec36

  • SHA256

    8a0bd42a625825a60ef70b82c2092a7ba40f70903f1d9a896f46df9958e5396a

  • SHA512

    d6b09a894c927deba60fa6129b9951fb706c737944ec96d184d2ae0d108b7a72f346152de25343796d16222625bfd6c22b3d12e6c63a76f2df4db6876a859363

  • SSDEEP

    3072:wQYFWQDxX9Rf/bUH9B18vrsKoksEKOxix3+LwwXx0FWlYVAjPjLnV:B1exrS9j0YKTsEKOxJLwwWFBAXp

Score
10/10
gh0stratrat

Malware Config

Signatures

  • Gh0st RAT payload 2 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat
  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e88824aa7bf5ed456771b4712db445c1_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e88824aa7bf5ed456771b4712db445c1_JaffaCakes118.exe"
    1⤵
      PID:3952
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 224
        2⤵
        • Program crash
        PID:4500
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3952 -ip 3952
      1⤵
        PID:1932

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/3952-0-0x0000000000400000-0x0000000000451000-memory.dmp

        Filesize

        324KB

        Download

      • memory/3952-1-0x0000000000400000-0x0000000000451000-memory.dmp

        Filesize

        324KB

        Download