gh0strat | e50095e848451feb042fcaea9c6776c14b66abeec1fea5684b9bfa46c0bfcaa3

Analysis

max time kernel
150s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 16:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd3014dd0ed8b74583e49667e459d2bd_JaffaCakes118.exe
Size

72KB
MD5

fd3014dd0ed8b74583e49667e459d2bd
SHA1

fd19e01adfa7c8801c581df8163564bd69e8afd7
SHA256

e50095e848451feb042fcaea9c6776c14b66abeec1fea5684b9bfa46c0bfcaa3
SHA512

e865ea606aa4cacc03b32dea6326409c130138f227e5231eeb155d3274ad1dfe06f7af1a523f4ffd3322fad5d683847d3baa5bae241a33ceff312f34d0d22a0e
SSDEEP

1536:V3w7BGnhngOUJArmfBYwFuIncbt0fbHAbQl+GXkq:JABGnhngOkAExuInctmbHAbQl+GXkq

Score

10^/10

gh0strat persistence rat

Malware Config

Signatures

Gh0st RAT payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2888-0-0x0000000000400000-0x0000000000414000-memory.dmp	family_gh0strat
\??\c:\users\admin\appdata\local\temp\user32.dll	family_gh0strat
behavioral1/memory/3040-4-0x0000000010000000-0x0000000010013000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

fd3014dd0ed8b74583e49667e459d2bd_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\360svc\Parameters\ServiceDll = "C:\\Users\\Admin\\AppData\\Local\\Temp\\user32.dll"	fd3014dd0ed8b74583e49667e459d2bd_JaffaCakes118.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

3040 svchost.exe
Loads dropped DLL 1 IoCs

Processes:

svchost.exe

pid process

3040 svchost.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

fd3014dd0ed8b74583e49667e459d2bd_JaffaCakes118.exe

pid process

2888 fd3014dd0ed8b74583e49667e459d2bd_JaffaCakes118.exe

pid	process
3040	svchost.exe

pid	process
3040	svchost.exe

pid	process
2888	fd3014dd0ed8b74583e49667e459d2bd_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fd3014dd0ed8b74583e49667e459d2bd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fd3014dd0ed8b74583e49667e459d2bd_JaffaCakes118.exe"
1⤵
- Sets DLL path for service in the registry
- Suspicious behavior: EnumeratesProcesses
PID:2888

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Deletes itself
- Loads dropped DLL
PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\users\admin\appdata\local\temp\user32.dll

Filesize
62KB

MD5
81074df6205aca9e849b46d204d5958f

SHA1
0d9d2ff51c4f97168827eb6eabc4d368f0b9184b

SHA256
e89c1347a43894e510504675ebed19303a3ba8203fafe157c4cd6de7bba1ee5a

SHA512
2664b03cd6a3268065b2436c2c710682a04dd68bfd333cec44a1854edd897ebcf1fc2ced3d5f021b7824ceee49fdf59ee48aa783ec7f3b67118bcbcf101101c0

Download Submit
memory/2888-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3040-4-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download