gh0strat | 68f7bfd84f76c9eace8a908db38270f247f9fc412ef377dc44c4832c896425b1

Analysis

max time kernel
136s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2024, 12:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b7ac02f975ac5d0ae78aa2b7ab464156_JaffaCakes118.exe
Size

95KB
MD5

b7ac02f975ac5d0ae78aa2b7ab464156
SHA1

52465aea3e6ef7c62b8c6146dc8b59e8a11b8c8d
SHA256

68f7bfd84f76c9eace8a908db38270f247f9fc412ef377dc44c4832c896425b1
SHA512

46b74849046f85c60a46544832922edc4af4bdd1293c5f5789505531e3bfc2a4bf09c7df8ded0e009cf1acdd5874c405c29b35bbdce4b19d88be9ca0c9796996
SSDEEP

1536:CRFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prOAocHu:CHS4jHS8q/3nTzePCwNUh4E9OA9O

Score

10^/10

gh0strat discovery rat

Malware Config

Signatures

Gh0st RAT payload 5 IoCs

resource	yara_rule
behavioral2/files/0x0009000000023586-14.dat	family_gh0strat
behavioral2/memory/828-17-0x0000000000400000-0x000000000044E308-memory.dmp	family_gh0strat
behavioral2/memory/1480-20-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral2/memory/2200-25-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral2/memory/1800-30-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Deletes itself 1 IoCs

pid	Process
828	exgrfqjjeg

Executes dropped EXE 1 IoCs

pid	Process
828	exgrfqjjeg

Loads dropped DLL 3 IoCs

pid	Process
1480	svchost.exe
2200	svchost.exe
1800	svchost.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ohicibuths	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\opvvqewrto	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\oykoxhaphj	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4220	1480	WerFault.exe	99
920	2200	WerFault.exe	103
4728	1800	WerFault.exe	106

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b7ac02f975ac5d0ae78aa2b7ab464156_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	exgrfqjjeg
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
828	exgrfqjjeg
828	exgrfqjjeg

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeRestorePrivilege	828	exgrfqjjeg
Token: SeBackupPrivilege	828	exgrfqjjeg
Token: SeBackupPrivilege	828	exgrfqjjeg
Token: SeRestorePrivilege	828	exgrfqjjeg
Token: SeBackupPrivilege	1480	svchost.exe
Token: SeRestorePrivilege	1480	svchost.exe
Token: SeBackupPrivilege	1480	svchost.exe
Token: SeBackupPrivilege	1480	svchost.exe
Token: SeSecurityPrivilege	1480	svchost.exe
Token: SeSecurityPrivilege	1480	svchost.exe
Token: SeBackupPrivilege	1480	svchost.exe
Token: SeBackupPrivilege	1480	svchost.exe
Token: SeSecurityPrivilege	1480	svchost.exe
Token: SeBackupPrivilege	1480	svchost.exe
Token: SeBackupPrivilege	1480	svchost.exe
Token: SeSecurityPrivilege	1480	svchost.exe
Token: SeBackupPrivilege	1480	svchost.exe
Token: SeRestorePrivilege	1480	svchost.exe
Token: SeBackupPrivilege	2200	svchost.exe
Token: SeRestorePrivilege	2200	svchost.exe
Token: SeBackupPrivilege	2200	svchost.exe
Token: SeBackupPrivilege	2200	svchost.exe
Token: SeSecurityPrivilege	2200	svchost.exe
Token: SeSecurityPrivilege	2200	svchost.exe
Token: SeBackupPrivilege	2200	svchost.exe
Token: SeBackupPrivilege	2200	svchost.exe
Token: SeSecurityPrivilege	2200	svchost.exe
Token: SeBackupPrivilege	2200	svchost.exe
Token: SeBackupPrivilege	2200	svchost.exe
Token: SeSecurityPrivilege	2200	svchost.exe
Token: SeBackupPrivilege	2200	svchost.exe
Token: SeRestorePrivilege	2200	svchost.exe
Token: SeBackupPrivilege	1800	svchost.exe
Token: SeRestorePrivilege	1800	svchost.exe
Token: SeBackupPrivilege	1800	svchost.exe
Token: SeBackupPrivilege	1800	svchost.exe
Token: SeSecurityPrivilege	1800	svchost.exe
Token: SeSecurityPrivilege	1800	svchost.exe
Token: SeBackupPrivilege	1800	svchost.exe
Token: SeBackupPrivilege	1800	svchost.exe
Token: SeSecurityPrivilege	1800	svchost.exe
Token: SeBackupPrivilege	1800	svchost.exe
Token: SeBackupPrivilege	1800	svchost.exe
Token: SeSecurityPrivilege	1800	svchost.exe
Token: SeBackupPrivilege	1800	svchost.exe
Token: SeRestorePrivilege	1800	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3196 wrote to memory of 828	3196	b7ac02f975ac5d0ae78aa2b7ab464156_JaffaCakes118.exe	96
PID 3196 wrote to memory of 828	3196	b7ac02f975ac5d0ae78aa2b7ab464156_JaffaCakes118.exe	96
PID 3196 wrote to memory of 828	3196	b7ac02f975ac5d0ae78aa2b7ab464156_JaffaCakes118.exe	96

C:\Users\Admin\AppData\Local\Temp\b7ac02f975ac5d0ae78aa2b7ab464156_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b7ac02f975ac5d0ae78aa2b7ab464156_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3196
- \??\c:\users\admin\appdata\local\exgrfqjjeg
  "C:\Users\Admin\AppData\Local\Temp\b7ac02f975ac5d0ae78aa2b7ab464156_JaffaCakes118.exe" a -sc:\users\admin\appdata\local\temp\b7ac02f975ac5d0ae78aa2b7ab464156_jaffacakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4340,i,1729213506309163284,12809566808978835441,262144 --variations-seed-version --mojo-platform-channel-handle=4036 /prefetch:8
1⤵
PID:4656

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 1076
  2⤵
  - Program crash
  PID:4220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1480 -ip 1480
1⤵
PID:4408

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2200
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 1060
  2⤵
  - Program crash
  PID:920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2200 -ip 2200
1⤵
PID:2376

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 1100
  2⤵
  - Program crash
  PID:4728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1800 -ip 1800
1⤵
PID:3980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\exgrfqjjeg

Filesize
23.8MB

MD5
d17a546a0535db6f18604af9a4a47d0c

SHA1
d62b2e0d7f9d50a062b356fb2c17f50004d9f2ab

SHA256
e60a044d1e7e3a52b0ac663663290e49e3d399f3919ac2299dc5e9aad0d74a00

SHA512
538850770a8d41fc867cfc8ea9ef02e296bc2fb0b87a32a2bf06cf80750021a4d9006cbc6faf79389c5d7f684f721a08407ba8fb2a6f4a646a75279a75ab042d

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
204B

MD5
25010eee5c7a5b593d5126df9fd3a881

SHA1
786e82138cea5f3b858550ddbaeb64850d4a53e2

SHA256
8ac92d17422d3af2e17f341b8e1ac13ea8aa6b4cca3fb767cac22ae0b123e95d

SHA512
9e6ad71f9ef5c6f5e6fc6bc60a3e6359d0fb3b6de8de661fa9c63aa1cd6485c3159f7a72dc9aef344e909cb7cb136a9d4dcaa3ae33ccd3a9acc04037db192d83

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
306B

MD5
43e80be0901ff369beaa66341519d7d3

SHA1
49beb661077d32c82175cabcecbca86a6e3cc320

SHA256
9f27142ff4748d01626bc5bee4722c90c6dd1afad96d356cd0bb4fc35a54082b

SHA512
8712de9f786e302c4c4c74ed4e0641069de09ea1cadc009f4453b3814a7ad375ce80d61cc6b2a8cf571b762128db0d44fc1f7be14702f25075a38dae0ff35b7b

Download Submit
\??\c:\programdata\application data\storm\update\%sessionname%\lwijk.cc3

Filesize
23.1MB

MD5
c41bcd41b4ff7ddc07595d661f00657e

SHA1
482b62dbc027097910394fe0acf5cfa17d1f731c

SHA256
364a1d7c0fcccbd2708d682b9d638769c8c45b0e304c479808a5a758288e7c02

SHA512
4b739172da8b8ac3935b83032aec8e8eb81f0936a14d49312f542e35fcf27203809c84b0728401b0758dfde9e6e215f1c9f956ef357dda8e8262ac98ce4e9bc4

Download Submit
memory/828-17-0x0000000000400000-0x000000000044E308-memory.dmp

Filesize
312KB

Download
memory/828-11-0x0000000000400000-0x000000000044E308-memory.dmp

Filesize
312KB

Download
memory/1480-18-0x00000000015D0000-0x00000000015D1000-memory.dmp

Filesize
4KB

Download
memory/1480-20-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/1800-27-0x00000000013C0000-0x00000000013C1000-memory.dmp

Filesize
4KB

Download
memory/1800-30-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/2200-22-0x0000000001490000-0x0000000001491000-memory.dmp

Filesize
4KB

Download
memory/2200-25-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/3196-10-0x0000000000400000-0x000000000044E308-memory.dmp

Filesize
312KB

Download
memory/3196-0-0x0000000000400000-0x000000000044E308-memory.dmp

Filesize
312KB

Download
memory/3196-2-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download