gh0strat | d26a3823a07edf81d29c0a27b9e75fbc333cf79798e09d1b3c1aef27dafbfed6

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 10:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15be586f7c58be26ae3d593b7a5bbd5b_JaffaCakes118.exe
Size

156KB
MD5

15be586f7c58be26ae3d593b7a5bbd5b
SHA1

ffc9adeb712531129be0eb39aad768081634f0ea
SHA256

d26a3823a07edf81d29c0a27b9e75fbc333cf79798e09d1b3c1aef27dafbfed6
SHA512

19058f5755aa1a475e0d2578c631b2b9db391f3c232d56eec244a2f8f679de94bac2fde4f30ced352fa3970abf6fcc65f3b6f6cd31a5fd6f6b2bfc15ee0f8222
SSDEEP

3072:uo0IpeXWit3tHpqVibRj1U9doMigzLe1a7Lt17haeRriuemHC1O:u1weGEPkibRG9dPigz60F11Vriuex1O

Score

10^/10

gh0strat persistence rat

Malware Config

Signatures

Gh0st RAT payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000e000000012264-1.dat	family_gh0strat
behavioral1/memory/2212-3-0x0000000010000000-0x000000001001E000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\rsnet_\Parameters\ServiceDll = "C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\rsnet.dll"	15be586f7c58be26ae3d593b7a5bbd5b_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
2212	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
2212	svchost.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo	15be586f7c58be26ae3d593b7a5bbd5b_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\rsnet.dll	15be586f7c58be26ae3d593b7a5bbd5b_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\15be586f7c58be26ae3d593b7a5bbd5b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\15be586f7c58be26ae3d593b7a5bbd5b_JaffaCakes118.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Drops file in Program Files directory
PID:2560

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Deletes itself
- Loads dropped DLL
PID:2212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\program files\common files\microsoft shared\msinfo\rsnet.dll

Filesize
105KB

MD5
bedecbccfe51294184de56ffe1d39246

SHA1
40583f6a1748e3fb8f8265992ab1052337c1aea5

SHA256
6d8076d01b8bbe97f0a30491f91f0073962f1761658f61953afd97868a18f808

SHA512
986922c9db0393128206e2960b890d9e25f4a7387a403c51f66b48941cee4d527002c287c7f53c76207d87b13d0571f92efc14d8d2dc340f8514d59ec609e130

Download Submit
memory/2212-3-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download