gh0strat | 6426d30c2ea733e1518219eba8c3d70ebc3d6e98106f513c56f6ade6b93eb03c

Analysis

max time kernel
14s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 22:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3248fb9094e25aa840005b9c763e2b00_JaffaCakes118.exe
Size

188KB
MD5

3248fb9094e25aa840005b9c763e2b00
SHA1

cacb6cdb354d4f8f8ce6ecd84a249bd4e849d6bd
SHA256

6426d30c2ea733e1518219eba8c3d70ebc3d6e98106f513c56f6ade6b93eb03c
SHA512

fad7db4f0df830a0856e286b4c2421b8e641bbf31766c277d4f083bdade1c64060f700be25ff0a55e27f32e153ea0aabdb4f90d4f47225e2b4d0a48d0404c3ce
SSDEEP

3072:lO3IMonogaQNJDVAkAEftr/TE9qnUkG+k+g0C7Ed51OO0nf9z8f+srZrNg:9ogaQLVAEtbT9nUzf7+51/6S+GZh

Score

10^/10

gh0strat persistence rat

Malware Config

Signatures

Gh0st RAT payload 3 IoCs

resource	yara_rule
behavioral1/files/0x000c000000014968-5.dat	family_gh0strat
behavioral1/memory/1528-7-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral1/memory/2452-8-0x0000000000400000-0x0000000000430000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\fastuserswitchingcompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\alsgl.ref"	3248fb9094e25aa840005b9c763e2b00_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
1528	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\d2f5ca0e.del	3248fb9094e25aa840005b9c763e2b00_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\alsgl.ref	3248fb9094e25aa840005b9c763e2b00_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2452	3248fb9094e25aa840005b9c763e2b00_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3248fb9094e25aa840005b9c763e2b00_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3248fb9094e25aa840005b9c763e2b00_JaffaCakes118.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2452

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:1528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\alsgl.ref

Filesize
148KB

MD5
34d611816388cfedce2ed544a0bcb731

SHA1
f8823e8cd2fcb659f229e4882ab66968108624c9

SHA256
b4743d5d6ffe692db0ad2d88850758ee791fac7a64a3538f44a894f3800eb445

SHA512
d205981c90462dd1694a3c11e2421c066e80a72f3bb0c26dffc353a095dae93717aaad0eceeafd3e335f188a3a45df58bfa6a2eaccb011678662b4d1852c9e58

Download Submit
memory/1528-7-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/2452-0-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2452-1-0x0000000000230000-0x0000000000260000-memory.dmp

Filesize
192KB

Download
memory/2452-2-0x0000000000230000-0x0000000000260000-memory.dmp

Filesize
192KB

Download
memory/2452-8-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2452-9-0x0000000000230000-0x000000000023D000-memory.dmp

Filesize
52KB

Download