gh0strat | 42040200750951be020cb613f4a8064ab9819ae12009c5f604c2e3bb727d6291

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 13:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2281c1ecb617254ff6e4b8782e6df1ce_JaffaCakes118.exe
Size

183KB
MD5

2281c1ecb617254ff6e4b8782e6df1ce
SHA1

c844a9d926a04a38651cd143fb385ea4b6e6097f
SHA256

42040200750951be020cb613f4a8064ab9819ae12009c5f604c2e3bb727d6291
SHA512

d828e881b21ff547683b789f1b9c0a0d4f9fe63d44ed2f15954d2555bb65510fc5e149a77dd13235c813fc3e907965c2a50e70561f10052f3e2f7694a36fd514
SSDEEP

3072:E0PvR+ug5tLk8uWslG4tOAC2AzXwKRhy+uWZETDGnE+YQfjZtEShOH4IFpI:E0PJZg5B3slG4JATSjKEIdtxOYITI

Score

10^/10

gh0strat persistence rat

Malware Config

Signatures

Gh0st RAT payload 5 IoCs

resource	yara_rule
behavioral2/files/0x000600000002326e-5.dat	family_gh0strat
behavioral2/memory/2932-13-0x0000000000400000-0x000000000041D000-memory.dmp	family_gh0strat
behavioral2/files/0x00070000000233c8-16.dat	family_gh0strat
behavioral2/memory/2932-18-0x0000000000400000-0x000000000041D000-memory.dmp	family_gh0strat
behavioral2/memory/1588-19-0x0000000010000000-0x000000001001B000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\360svc\Parameters\ServiceDll = "C:\\Documents and Settings\\Local User\\ntuser.dll"	server.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	2281c1ecb617254ff6e4b8782e6df1ce_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2932	server.exe

Loads dropped DLL 1 IoCs

pid	Process
1588	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 2932	4968	2281c1ecb617254ff6e4b8782e6df1ce_JaffaCakes118.exe	81
PID 4968 wrote to memory of 2932	4968	2281c1ecb617254ff6e4b8782e6df1ce_JaffaCakes118.exe	81
PID 4968 wrote to memory of 2932	4968	2281c1ecb617254ff6e4b8782e6df1ce_JaffaCakes118.exe	81

C:\Users\Admin\AppData\Local\Temp\2281c1ecb617254ff6e4b8782e6df1ce_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2281c1ecb617254ff6e4b8782e6df1ce_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Users\Admin\AppData\Local\Temp\server.exe
  "C:\Users\Admin\AppData\Local\Temp\server.exe"
  2⤵
  - Server Software Component: Terminal Services DLL
  - Executes dropped EXE
  PID:2932

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:1588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\server.exe

Filesize
112KB

MD5
8f6d18c821f309140d787be352e62a1d

SHA1
ff16af0fececa718e3612f74d0b0a4dfdbc8e3b8

SHA256
eb9599c5d654b832754f64ef4dc9716e34311a0e0ad82d0405a32159eef538c2

SHA512
4903e3dcc299072f25169a2ce43a2bf4290606deda30fc3a385dd916d44d9138cf7a785f1f913a963e2e486e1f38f535f84361cc656cfde05414fd71aa15cb3b

Download Submit
\??\c:\documents and settings\local user\ntuser.dll

Filesize
98KB

MD5
34d438c3e7d402a3579dcc5e9bd7fc4e

SHA1
4d8363b7df7bbd39c3a08a295a4dd181f0d901d5

SHA256
167d49e835387f3a742d2245764633da6645be104ff5e4915d709ff64695598b

SHA512
f9b8a6562b0dd423f05a00fdc5b14af8dd3be42cb3bb2ad66786ec4e4c6866f6fd262d2933877e30349cf01564e8c1ce1c63f9e064cff17e9317874afa0e0ce0

Download Submit
memory/1588-19-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download
memory/2932-13-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2932-18-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4968-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4968-14-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download