gh0strat | 3fd9d905d9b08c22bb5517bd4e6a1d95c5e0c2deba4fda089b7ff5dac1343810

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 14:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1667bc2ccace57daf8068ab201dc0996_JaffaCakes118.exe
Size

196KB
MD5

1667bc2ccace57daf8068ab201dc0996
SHA1

7bf309aa53e691f6c168ccf2d2d05628855f33d2
SHA256

3fd9d905d9b08c22bb5517bd4e6a1d95c5e0c2deba4fda089b7ff5dac1343810
SHA512

e346239c0a43b0ee96aab8f023586a3139e985e99caad6f95c961625ad305c16564995c96d2b4691f63021e5b9aee49eef6ef2f52b8a027b8440e01118c68396
SSDEEP

3072:iIXD6tSGloVFwz8BD0cjRTyVwdUE3AZnC69NJ09sTpwWwo:izlQwz8BDpWwOUA1C6rTuWf

Score

10^/10

gh0strat rat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023431-8.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	1667bc2ccace57daf8068ab201dc0996_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
692	OATH.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5100	692	WerFault.exe	83

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	1667bc2ccace57daf8068ab201dc0996_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3456 wrote to memory of 692	3456	1667bc2ccace57daf8068ab201dc0996_JaffaCakes118.exe	83
PID 3456 wrote to memory of 692	3456	1667bc2ccace57daf8068ab201dc0996_JaffaCakes118.exe	83
PID 3456 wrote to memory of 692	3456	1667bc2ccace57daf8068ab201dc0996_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\1667bc2ccace57daf8068ab201dc0996_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1667bc2ccace57daf8068ab201dc0996_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3456
- C:\OATH.EXE
  "C:\OATH.EXE"
  2⤵
  - Executes dropped EXE
  PID:692
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 692 -s 216
    3⤵
    - Program crash
    PID:5100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 692 -ip 692
1⤵
PID:4040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\OATH.EXE

Filesize
172KB

MD5
a006cb4129f531243592629f040c9d94

SHA1
c121bff36f16b42ac308556a08b6addab945f250

SHA256
a5da7a8f657772cee923b5c3d320096418172df7be8830095bab3d226e2d9730

SHA512
89d6135a15fe8b98915ad648a9bf7e6e961b07d7c3280560aec1d334be2af2a94d3e268ec131ff29ffe118f2f637d25883e57e4ae76be5cbf6029cd86f9b4d6f

Download Submit