gh0strat | ba79f72aa55d3396ac7bef3be2ab749c2e692ec81e303b9211629df0514a44d4

Analysis

max time kernel
12s
max time network
29s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 22:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

471f19142b48d8ab0495307aaea6bcd6_JaffaCakes118.exe
Size

252KB
MD5

471f19142b48d8ab0495307aaea6bcd6
SHA1

68f9a06537d5cdaf9cb1de08cff61d7b035a6cb2
SHA256

ba79f72aa55d3396ac7bef3be2ab749c2e692ec81e303b9211629df0514a44d4
SHA512

cf52bdeeaddc0d542abc7483f711024ed6285eccc25d9ce746cd41e8405c9977d92fcc186382385024a9caf48350cc60d23d07809fb5e71804955a3e29214528
SSDEEP

3072:51qCf3QNagbT6aCpnRiWVqDohz53nbWyk7AuVaa+D4SfU+V4P7KVXUa/pjcR:fxQNNbOaCZOezxnbWFA0ad4S/VaKVXjS

Score

10^/10

gh0strat persistence rat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/files/0x0008000000017482-4.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\JhdfF1C5\Parameters\ServiceDll = "C:\\Windows\\system32\\b0dbcF.pic"	471f19142b48d8ab0495307aaea6bcd6_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
2356	rundll32.exe

Loads dropped DLL 4 IoCs

pid	Process
992	svchost.exe
2356	rundll32.exe
2864	svchost.exe
2788	rundll32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\b0dbcF.pic	471f19142b48d8ab0495307aaea6bcd6_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2260	471f19142b48d8ab0495307aaea6bcd6_JaffaCakes118.exe
2260	471f19142b48d8ab0495307aaea6bcd6_JaffaCakes118.exe
2260	471f19142b48d8ab0495307aaea6bcd6_JaffaCakes118.exe
2260	471f19142b48d8ab0495307aaea6bcd6_JaffaCakes118.exe
2260	471f19142b48d8ab0495307aaea6bcd6_JaffaCakes118.exe
2356	rundll32.exe
2356	rundll32.exe
2356	rundll32.exe
2356	rundll32.exe
2356	rundll32.exe
2356	rundll32.exe
2356	rundll32.exe
2356	rundll32.exe
2356	rundll32.exe
2356	rundll32.exe
2356	rundll32.exe
2356	rundll32.exe
2356	rundll32.exe
2356	rundll32.exe
2356	rundll32.exe
2356	rundll32.exe
2356	rundll32.exe
2356	rundll32.exe
2356	rundll32.exe
2356	rundll32.exe
2356	rundll32.exe
2356	rundll32.exe
2356	rundll32.exe
2356	rundll32.exe
2356	rundll32.exe
2356	rundll32.exe
2356	rundll32.exe
2356	rundll32.exe
2356	rundll32.exe
2356	rundll32.exe
2356	rundll32.exe
2356	rundll32.exe
2356	rundll32.exe
2356	rundll32.exe
2356	rundll32.exe
2356	rundll32.exe
2356	rundll32.exe
2356	rundll32.exe
2356	rundll32.exe
2356	rundll32.exe
2356	rundll32.exe
2356	rundll32.exe
2356	rundll32.exe
2356	rundll32.exe
2356	rundll32.exe
2356	rundll32.exe
2356	rundll32.exe
2356	rundll32.exe
2356	rundll32.exe
2356	rundll32.exe
2788	rundll32.exe
2788	rundll32.exe
2788	rundll32.exe
2788	rundll32.exe
2788	rundll32.exe
2788	rundll32.exe
2788	rundll32.exe
2788	rundll32.exe
2788	rundll32.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: 33	2260	471f19142b48d8ab0495307aaea6bcd6_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2260	471f19142b48d8ab0495307aaea6bcd6_JaffaCakes118.exe
Token: SeBackupPrivilege	2260	471f19142b48d8ab0495307aaea6bcd6_JaffaCakes118.exe
Token: SeRestorePrivilege	2260	471f19142b48d8ab0495307aaea6bcd6_JaffaCakes118.exe
Token: SeDebugPrivilege	992	svchost.exe
Token: SeBackupPrivilege	2356	rundll32.exe
Token: SeSecurityPrivilege	2356	rundll32.exe
Token: SeDebugPrivilege	2864	svchost.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 992 wrote to memory of 2356	992	svchost.exe	31
PID 992 wrote to memory of 2356	992	svchost.exe	31
PID 992 wrote to memory of 2356	992	svchost.exe	31
PID 992 wrote to memory of 2356	992	svchost.exe	31
PID 992 wrote to memory of 2356	992	svchost.exe	31
PID 992 wrote to memory of 2356	992	svchost.exe	31
PID 992 wrote to memory of 2356	992	svchost.exe	31
PID 2864 wrote to memory of 2788	2864	svchost.exe	33
PID 2864 wrote to memory of 2788	2864	svchost.exe	33
PID 2864 wrote to memory of 2788	2864	svchost.exe	33
PID 2864 wrote to memory of 2788	2864	svchost.exe	33
PID 2864 wrote to memory of 2788	2864	svchost.exe	33
PID 2864 wrote to memory of 2788	2864	svchost.exe	33
PID 2864 wrote to memory of 2788	2864	svchost.exe	33
PID 2356 wrote to memory of 2484	2356	rundll32.exe	34
PID 2356 wrote to memory of 2484	2356	rundll32.exe	34
PID 2356 wrote to memory of 2484	2356	rundll32.exe	34
PID 2356 wrote to memory of 2484	2356	rundll32.exe	34

C:\Users\Admin\AppData\Local\Temp\471f19142b48d8ab0495307aaea6bcd6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\471f19142b48d8ab0495307aaea6bcd6_JaffaCakes118.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2260

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k JhdfF1C5
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe c:\windows\system32\b0dbcf.pic,main JhdfF1C5
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Windows\SysWOW64\route.exe
    route -f
    3⤵
    PID:2484

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k JhdfF1C5
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe c:\windows\system32\b0dbcf.pic,main JhdfF1C5
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\b0dbcf.pic

Filesize
28.1MB

MD5
88bcdb3a04de7e06d9b08e0cbf0ffa16

SHA1
860a7d56c797bd971d3100ece85bab203a573552

SHA256
757f6a83d43ad8d31056117e40acb53e27f2dde9b8b5e31aea4d3295bc58e1e0

SHA512
f83466be96501a5fdbc2e21f98cad3ef3f1e0e1d3f5cc955aa62f0994902504fb43c63f22a7f0cfedd58e5646ea0ecab6351155c18bfe602f315aa46a0112528

Download Submit