gh0strat | b6d1c7346346188ed06447e7fd1733901759a787af9183270c753bd422b1adcc

Analysis

max time kernel
126s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 19:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

430d7f569570890402982569d686bf62_JaffaCakes118.exe
Size

204KB
MD5

430d7f569570890402982569d686bf62
SHA1

22cfca29b14e288c13645e39c04f0a91622e117f
SHA256

b6d1c7346346188ed06447e7fd1733901759a787af9183270c753bd422b1adcc
SHA512

f2e2b1a45dfd9b6a46e0f1e1825a45db473050f0d73e87cf7d41fa80f6dcb6aa5d03733fd6928950539becf7855159f2d2c6f212d6a1e45c1e3e28e2d67d8318
SSDEEP

3072:EhwVMQgpRh5qTsxyTDW2DQ8zK7dPLjNNRwPRmttOHXC:v2Rnh5EsIm2Ef7RNYPRmyXC

Score

10^/10

gh0strat persistence rat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000800000002343c-3.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Executes dropped EXE 1 IoCs

pid	Process
3160	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\V2011 = "C:\\WINDOWS\\V2011.exe"	svchost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\V2011.exe	svchost.exe
File opened for modification	C:\WINDOWS\V2011.exe	svchost.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4660	430d7f569570890402982569d686bf62_JaffaCakes118.exe
4660	430d7f569570890402982569d686bf62_JaffaCakes118.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3160	svchost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3160	svchost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 3160	4660	430d7f569570890402982569d686bf62_JaffaCakes118.exe	83
PID 4660 wrote to memory of 3160	4660	430d7f569570890402982569d686bf62_JaffaCakes118.exe	83
PID 4660 wrote to memory of 3160	4660	430d7f569570890402982569d686bf62_JaffaCakes118.exe	83
PID 4660 wrote to memory of 3948	4660	430d7f569570890402982569d686bf62_JaffaCakes118.exe	89
PID 4660 wrote to memory of 3948	4660	430d7f569570890402982569d686bf62_JaffaCakes118.exe	89
PID 4660 wrote to memory of 3948	4660	430d7f569570890402982569d686bf62_JaffaCakes118.exe	89

C:\Users\Admin\AppData\Local\Temp\430d7f569570890402982569d686bf62_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\430d7f569570890402982569d686bf62_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Users\Admin\AppData\Local\Temp\V2011\svchost.exe
  C:\Users\Admin\AppData\Local\Temp\V2011\svchost.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:3160
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c afc9fe2f418b00a0.bat
  2⤵
  PID:3948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\V2011\svchost.exe

Filesize
204KB

MD5
d145fea4d08942e87710981a67a7bd53

SHA1
d177d4b5220cef3c3ecbbc9bd1aec038758a1f7f

SHA256
bd6dd0a434a368aef3f39a4703abf6f491b3420ae60c17cdf4f81dcc422b6e64

SHA512
1ebef0e02d4e5a3ed1dc49f941444493b346595ed941807fc0d43fc3f59c5735f39a80e53f36567d719c36ac8e283b3ceb6c786237c2eb0791ebf974707d851e

Download Submit
C:\Users\Admin\AppData\Local\Temp\afc9fe2f418b00a0.bat

Filesize
2KB

MD5
fe008650439e215680bede5f5a77e274

SHA1
df6ded90b0f761611ec0e690d7d3374f8176bdd3

SHA256
df91ffd74e5767ce9114e3478666628272b4a6c615361d3a352b8bfb04e1965e

SHA512
c409581854f6a4007f8aaa86583ad5f5d836c2a18b12e0908571cf5e681cbf65b6fa69304a7d65d3f662b0bca97cdc8be851e9ffbafe3e73fa6ab18109644219

Download Submit