gh0strat | 4fed6f47d53558644e2f6540a528610e55f873535622c316776adf63aa7b38de

Analysis

max time kernel
150s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 03:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14709ae74e90bec62e0c97a8059aca89_JaffaCakes118.exe
Size

87KB
MD5

14709ae74e90bec62e0c97a8059aca89
SHA1

46a6f457df039f46c58bb817c11be9c5977c3d74
SHA256

4fed6f47d53558644e2f6540a528610e55f873535622c316776adf63aa7b38de
SHA512

ac41a04414297dc1050ddd5cd245ee39caf5fda3abd4269f72b61b736adfd9b122f377bfac9bddfb364f908698814f69abf9582707b9aa1f6e8557fcec8523c6
SSDEEP

1536:afJrvJt56iwXdSxw5p90VK7rtjlzFPUzc7Q5fsncljsNMG7BRWvi:aft756iwXdSxw5p9bppzFPUzYQ5sncp+

Score

10^/10

gh0strat persistence rat

Malware Config

Signatures

Gh0st RAT payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023523-2.dat	family_gh0strat
behavioral2/memory/2952-4-0x0000000010000000-0x0000000010013000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Documents and Settings\\Local User\\everest.dll"	14709ae74e90bec62e0c97a8059aca89_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
2952	SVCHOST.EXE

Loads dropped DLL 1 IoCs

pid	Process
2952	SVCHOST.EXE

C:\Users\Admin\AppData\Local\Temp\14709ae74e90bec62e0c97a8059aca89_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\14709ae74e90bec62e0c97a8059aca89_JaffaCakes118.exe"
1⤵
- Server Software Component: Terminal Services DLL
PID:3500

C:\Windows\SysWOW64\SVCHOST.EXE
C:\Windows\SysWOW64\SVCHOST.EXE -K NETSVCS -s FastUserSwitchingCompatibility
1⤵
- Deletes itself
- Loads dropped DLL
PID:2952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4176,i,5711962389779687290,1245653010537220991,262144 --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:8
1⤵
PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\documents and settings\local user\everest.dll

Filesize
68KB

MD5
02909ba57c9bf2fefdfa3b9dcaab8d78

SHA1
42eb81a9fcfca0ec432d0b8385e09b1eade1d43d

SHA256
d8f698fdb721ad25c0e36b84f8ac3045c4fd6df7361fb81d05a9f0ed03950a83

SHA512
010b01d5462a10f4c08f34beea34fc4e6ebd200653553065695477d77c11568aff0332e73a6a8d26fa0f1826c228e70a5a2b4e4965c7812e094c60414d3771cc

Download Submit
memory/2952-4-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download