gh0strat | 5d176047bf863b5efbc3da771af58acba1a59f933807aec5bc0929e71822e7a8

Resubmissions

27/06/2024, 12:49

240627-p2twbsscpa 10

27/06/2024, 12:45

240627-py2f1avanr 10

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 12:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

160f0df132f7ef72bb0925d66fc9fc7f_JaffaCakes118.exe
Size

96KB
MD5

160f0df132f7ef72bb0925d66fc9fc7f
SHA1

508c55d6ff391df0b4e4efdd7786bdaffd10a23d
SHA256

5d176047bf863b5efbc3da771af58acba1a59f933807aec5bc0929e71822e7a8
SHA512

15c764d6aca16fcb01d8fbe8a9a3944643ada7a739a9fab1102729451e49efbb3750b8fd258fd96fad5b786ff93aa6c89b0bde0d0f8e4e12ee29af9973d6cf6e
SSDEEP

1536:8uFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8przeoobQdbNcO0sJ:8US4jHS8q/3nTzePCwNUh4E9zeoVPWsJ

Score

10^/10

gh0strat rat

Malware Config

Signatures

Gh0st RAT payload 5 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023468-16.dat	family_gh0strat
behavioral2/memory/1696-17-0x0000000000400000-0x000000000044E360-memory.dmp	family_gh0strat
behavioral2/memory/3192-20-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral2/memory/4676-25-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral2/memory/436-30-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Deletes itself 1 IoCs

pid	Process
1696	dktyioeycb

Executes dropped EXE 1 IoCs

pid	Process
1696	dktyioeycb

Loads dropped DLL 3 IoCs

pid	Process
3192	svchost.exe
4676	svchost.exe
436	svchost.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\keaovbaaoa	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\kmoheedxbv	svchost.exe
File created	C:\Windows\SysWOW64\kvcbmhfuoq	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\keaovbaaoa	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
3824	3192	WerFault.exe	92
3776	4676	WerFault.exe	99
4432	436	WerFault.exe	102

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1696	dktyioeycb
1696	dktyioeycb

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeRestorePrivilege	1696	dktyioeycb
Token: SeBackupPrivilege	1696	dktyioeycb
Token: SeBackupPrivilege	1696	dktyioeycb
Token: SeRestorePrivilege	1696	dktyioeycb
Token: SeBackupPrivilege	3192	svchost.exe
Token: SeRestorePrivilege	3192	svchost.exe
Token: SeBackupPrivilege	3192	svchost.exe
Token: SeBackupPrivilege	3192	svchost.exe
Token: SeSecurityPrivilege	3192	svchost.exe
Token: SeSecurityPrivilege	3192	svchost.exe
Token: SeBackupPrivilege	3192	svchost.exe
Token: SeBackupPrivilege	3192	svchost.exe
Token: SeSecurityPrivilege	3192	svchost.exe
Token: SeBackupPrivilege	3192	svchost.exe
Token: SeBackupPrivilege	3192	svchost.exe
Token: SeSecurityPrivilege	3192	svchost.exe
Token: SeBackupPrivilege	3192	svchost.exe
Token: SeRestorePrivilege	3192	svchost.exe
Token: SeBackupPrivilege	4676	svchost.exe
Token: SeRestorePrivilege	4676	svchost.exe
Token: SeBackupPrivilege	4676	svchost.exe
Token: SeBackupPrivilege	4676	svchost.exe
Token: SeSecurityPrivilege	4676	svchost.exe
Token: SeSecurityPrivilege	4676	svchost.exe
Token: SeBackupPrivilege	4676	svchost.exe
Token: SeBackupPrivilege	4676	svchost.exe
Token: SeSecurityPrivilege	4676	svchost.exe
Token: SeBackupPrivilege	4676	svchost.exe
Token: SeBackupPrivilege	4676	svchost.exe
Token: SeSecurityPrivilege	4676	svchost.exe
Token: SeBackupPrivilege	4676	svchost.exe
Token: SeRestorePrivilege	4676	svchost.exe
Token: SeBackupPrivilege	436	svchost.exe
Token: SeRestorePrivilege	436	svchost.exe
Token: SeBackupPrivilege	436	svchost.exe
Token: SeBackupPrivilege	436	svchost.exe
Token: SeSecurityPrivilege	436	svchost.exe
Token: SeSecurityPrivilege	436	svchost.exe
Token: SeBackupPrivilege	436	svchost.exe
Token: SeBackupPrivilege	436	svchost.exe
Token: SeSecurityPrivilege	436	svchost.exe
Token: SeBackupPrivilege	436	svchost.exe
Token: SeBackupPrivilege	436	svchost.exe
Token: SeSecurityPrivilege	436	svchost.exe
Token: SeBackupPrivilege	436	svchost.exe
Token: SeRestorePrivilege	436	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1696	1632	160f0df132f7ef72bb0925d66fc9fc7f_JaffaCakes118.exe	86
PID 1632 wrote to memory of 1696	1632	160f0df132f7ef72bb0925d66fc9fc7f_JaffaCakes118.exe	86
PID 1632 wrote to memory of 1696	1632	160f0df132f7ef72bb0925d66fc9fc7f_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\160f0df132f7ef72bb0925d66fc9fc7f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\160f0df132f7ef72bb0925d66fc9fc7f_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- \??\c:\users\admin\appdata\local\dktyioeycb
  "C:\Users\Admin\AppData\Local\Temp\160f0df132f7ef72bb0925d66fc9fc7f_JaffaCakes118.exe" a -sc:\users\admin\appdata\local\temp\160f0df132f7ef72bb0925d66fc9fc7f_jaffacakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1696

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3192
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 1080
  2⤵
  - Program crash
  PID:3824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3192 -ip 3192
1⤵
PID:2436

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4676
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 928
  2⤵
  - Program crash
  PID:3776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4676 -ip 4676
1⤵
PID:532

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:436
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 436 -s 1060
  2⤵
  - Program crash
  PID:4432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 436 -ip 436
1⤵
PID:1884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Storm\update\%SESSIONNAME%\ptxks.cc3

Filesize
23.0MB

MD5
cf218305bf3de68dd94ccc7c49d1b029

SHA1
cbabf26813f6c1029e12fb03e6ac7625514ba50a

SHA256
140f1124d2e02b331432bf30fda326682a16969f68f67af68955cd3531621282

SHA512
d351569a3866813ac53f96883e4e6c19df146af4c40f4b6600dff696febc283f70c475f2e8fb7afb1801d8bd5053a520789c7b5ffa13cb3f548e0c285d56b188

Download Submit
C:\Users\Admin\AppData\Local\dktyioeycb

Filesize
22.9MB

MD5
add6f52b890a51e739ba9e55f46d6b57

SHA1
3f8b5c2558a4d7b215c7a969d378cebb709c5073

SHA256
679c6490124fb186636570ca4fd7688e99871c73964886a02171865e264c66bc

SHA512
531b3f22153a16c0d6b438d86134b5b3132dd7e431605b31253937e1ac4d590d36aaa8acf184fa4980ed9094357a73e2aeac56d25bf26d2e3191bb49a66b6bb0

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
204B

MD5
6c233eb0d97abf9b3d69820c1de47e5b

SHA1
b898288d568ae25d6636d86a9aa1302c254f7ed8

SHA256
a5d80158afbfd6d6effa6d61bee8effff8b011c8c4be6b05d5032978f7611221

SHA512
da7f371ca470071b0de12c79d5ca24c7fff052fd4137cbfc415c369b4e655ff224c8694d89efec4272d52ea2c5979eba11496a7c2f3afb1c2002c0ff01e732ae

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
306B

MD5
b59d2b4ba8a0d97430b8fc52d736bef5

SHA1
12295d3c3785cb09fd02043b2a517624a7d69506

SHA256
cbcd7059c7b01be543f52fbe8622a662aecb7d13daa23a8a5d14ddaf6f4ba610

SHA512
1914cf444aad2c0bd5e3444d2ed23ce54176a63533abe4a707b6269c3e79ac54110b31f41d394d8ca58ddf030e2d531ea42fdbda8cdce14a81deb40ec1313ab4

Download Submit
memory/436-27-0x0000000002040000-0x0000000002041000-memory.dmp

Filesize
4KB

Download
memory/436-30-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/1632-2-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1632-10-0x0000000000400000-0x000000000044E360-memory.dmp

Filesize
312KB

Download
memory/1632-0-0x0000000000400000-0x000000000044E360-memory.dmp

Filesize
312KB

Download
memory/1696-12-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1696-11-0x0000000000400000-0x000000000044E360-memory.dmp

Filesize
312KB

Download
memory/1696-17-0x0000000000400000-0x000000000044E360-memory.dmp

Filesize
312KB

Download
memory/3192-18-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

Filesize
4KB

Download
memory/3192-20-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/4676-25-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/4676-22-0x0000000001F00000-0x0000000001F01000-memory.dmp

Filesize
4KB

Download