gh0strat | 1bd09ad8c46a54e624a6e82579b4f6a086d13ec5f918764745bb71088797f164

Analysis

max time kernel
139s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 21:33

Target

1c93319d575e893daf29982f1841f7d3_JaffaCakes118.dll
Size

111KB
MD5

1c93319d575e893daf29982f1841f7d3
SHA1

28040494891661c2cdffa81275eaf7cb972fb911
SHA256

1bd09ad8c46a54e624a6e82579b4f6a086d13ec5f918764745bb71088797f164
SHA512

4cd89a4755dae60a8297715a1dd365c5f58c2ae200675966f37078509f7547b87364c1a773129af11683ed5b787a7d13ca0a8d89045c7a06837ae2232c1c5048
SSDEEP

3072:YZYg+EhQjIR+IlCC6+s1arQXrTw+hf5J5NHgu1kC:WYg+EWjIR+sX01Igfw+LNHNb

Score

10^/10

gh0strat rat

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/1408-0-0x0000000010000000-0x000000001001C000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1252	1408	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 1408	2120	rundll32.exe	90
PID 2120 wrote to memory of 1408	2120	rundll32.exe	90
PID 2120 wrote to memory of 1408	2120	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1c93319d575e893daf29982f1841f7d3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1c93319d575e893daf29982f1841f7d3_JaffaCakes118.dll,#1
  2⤵
  PID:1408
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 552
    3⤵
    - Program crash
    PID:1252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1408 -ip 1408
1⤵
PID:1636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8
1⤵
PID:4028

memory/1408-0-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download