gh0strat | 8e16d74bba9f59ff3f38fa0b990e5158ba3ed2a643f2e059f2fbebcac0533c6b

Analysis

max time kernel
134s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-08-2024 05:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c849a12563137efc7e0b069841567ff1_JaffaCakes118.exe
Size

192KB
MD5

c849a12563137efc7e0b069841567ff1
SHA1

3fa09c093ed5c036ad148a3764882d456f5994ae
SHA256

8e16d74bba9f59ff3f38fa0b990e5158ba3ed2a643f2e059f2fbebcac0533c6b
SHA512

d648a57c6d08a55410cb69e00fe2eb563908220cbf08e65c82f70b1e98e6d89ad3b7a8f8c763ada4fbd270e0d1ad39a903cc7443915bd0e63795af6357dc1a57
SSDEEP

3072:WGZlBkinWavqt9QRV3RFw6ClwHHovoSs0K4diZPoOlrvyLQxP9rc0:HlBnnWavqfQRVPHovoSs0TCl+QxFrc

Score

10^/10

gh0strat discovery rat

Malware Config

Signatures

Gh0st RAT payload 5 IoCs

resource	yara_rule
behavioral2/memory/3760-5-0x0000000000400000-0x0000000000431000-memory.dmp	family_gh0strat
behavioral2/files/0x000b000000023487-11.dat	family_gh0strat
behavioral2/memory/2436-13-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/396-16-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/896-19-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Deletes itself 1 IoCs

pid	Process
1560	mheqti

Executes dropped EXE 1 IoCs

pid	Process
1560	mheqti

Loads dropped DLL 3 IoCs

pid	Process
2436	svchost.exe
396	svchost.exe
896	svchost.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\gshfvfutjn	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\gcfsfypxjx	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\gktlncsvvs	svchost.exe
File created	C:\Windows\SysWOW64\gktlncsvvs	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
3728	2436	WerFault.exe	91
2976	396	WerFault.exe	97
3556	896	WerFault.exe	100

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c849a12563137efc7e0b069841567ff1_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mheqti
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3760	c849a12563137efc7e0b069841567ff1_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeBackupPrivilege	1560	mheqti
Token: SeRestorePrivilege	1560	mheqti
Token: SeBackupPrivilege	1560	mheqti
Token: SeRestorePrivilege	1560	mheqti
Token: SeBackupPrivilege	1560	mheqti
Token: SeRestorePrivilege	1560	mheqti
Token: SeBackupPrivilege	1560	mheqti
Token: SeRestorePrivilege	1560	mheqti
Token: SeBackupPrivilege	2436	svchost.exe
Token: SeRestorePrivilege	2436	svchost.exe
Token: SeBackupPrivilege	2436	svchost.exe
Token: SeBackupPrivilege	2436	svchost.exe
Token: SeSecurityPrivilege	2436	svchost.exe
Token: SeSecurityPrivilege	2436	svchost.exe
Token: SeBackupPrivilege	2436	svchost.exe
Token: SeBackupPrivilege	2436	svchost.exe
Token: SeSecurityPrivilege	2436	svchost.exe
Token: SeBackupPrivilege	2436	svchost.exe
Token: SeBackupPrivilege	2436	svchost.exe
Token: SeSecurityPrivilege	2436	svchost.exe
Token: SeBackupPrivilege	2436	svchost.exe
Token: SeRestorePrivilege	2436	svchost.exe
Token: SeBackupPrivilege	396	svchost.exe
Token: SeRestorePrivilege	396	svchost.exe
Token: SeBackupPrivilege	396	svchost.exe
Token: SeBackupPrivilege	396	svchost.exe
Token: SeSecurityPrivilege	396	svchost.exe
Token: SeSecurityPrivilege	396	svchost.exe
Token: SeBackupPrivilege	396	svchost.exe
Token: SeBackupPrivilege	396	svchost.exe
Token: SeSecurityPrivilege	396	svchost.exe
Token: SeBackupPrivilege	396	svchost.exe
Token: SeBackupPrivilege	396	svchost.exe
Token: SeSecurityPrivilege	396	svchost.exe
Token: SeBackupPrivilege	396	svchost.exe
Token: SeRestorePrivilege	396	svchost.exe
Token: SeBackupPrivilege	896	svchost.exe
Token: SeRestorePrivilege	896	svchost.exe
Token: SeBackupPrivilege	896	svchost.exe
Token: SeBackupPrivilege	896	svchost.exe
Token: SeSecurityPrivilege	896	svchost.exe
Token: SeSecurityPrivilege	896	svchost.exe
Token: SeBackupPrivilege	896	svchost.exe
Token: SeBackupPrivilege	896	svchost.exe
Token: SeSecurityPrivilege	896	svchost.exe
Token: SeBackupPrivilege	896	svchost.exe
Token: SeBackupPrivilege	896	svchost.exe
Token: SeSecurityPrivilege	896	svchost.exe
Token: SeBackupPrivilege	896	svchost.exe
Token: SeRestorePrivilege	896	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3760 wrote to memory of 1560	3760	c849a12563137efc7e0b069841567ff1_JaffaCakes118.exe	88
PID 3760 wrote to memory of 1560	3760	c849a12563137efc7e0b069841567ff1_JaffaCakes118.exe	88
PID 3760 wrote to memory of 1560	3760	c849a12563137efc7e0b069841567ff1_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\c849a12563137efc7e0b069841567ff1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c849a12563137efc7e0b069841567ff1_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3760
- \??\c:\users\admin\appdata\local\mheqti
  "C:\Users\Admin\AppData\Local\Temp\c849a12563137efc7e0b069841567ff1_JaffaCakes118.exe"a -s
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1560

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2436
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2436 -s 712
  2⤵
  - Program crash
  PID:3728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2436 -ip 2436
1⤵
PID:3316

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:396
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 796
  2⤵
  - Program crash
  PID:2976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 396 -ip 396
1⤵
PID:3492

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:896
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 896 -s 800
  2⤵
  - Program crash
  PID:3556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 896 -ip 896
1⤵
PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\mheqti

Filesize
192KB

MD5
ea3ddf2a529bfa7e240364e2c7f008f7

SHA1
3f13dca6aca15e051edd98aca0b0d84820fc03a7

SHA256
ea231cc7759dca14e13bb28d5ab445be4f42a65a8ccbf7cc65727d27d1c28679

SHA512
82eaff1cb053217412c0198be27faf4504c8467f9d95c8297ce2e9a8f73c0472b6c0f1261910bdd890e28f94bbb32e6f0580a6c46b08e54a2f28ee663d00a680

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
202B

MD5
2bc038d4cb2bcaf6a3cfa7e753946c88

SHA1
3707669af352537998c4750a8018dd03a863780b

SHA256
e307d76c1f6a1c3072fa70b38354611bd7a6d5b9e1b7c69c25997dbaf504c1f6

SHA512
77abb9997c45516d8ce01107ee3e31d9a0ac2fb2b1284c16cb045bb24c4928112b722223f8ff73b38807ff6af722a5f1d75c8014184714789723f8e1143f92bd

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
303B

MD5
2a1360d5661d30537198697e23b7581e

SHA1
4aa7c555a63b8cc8156b39b43a07efd17b3a2c08

SHA256
98b7bfbf68980231653bcc006f60619121ce57d684b1ffe0759f62367253a58a

SHA512
76dce5d88a3c6a8895004f9e34a1e647a5c1de459568ed352a5e53def27a9f76af7210a27371727dafb6c692a1b2f7f7d429b62b72902f4bddb3b09273a78889

Download Submit
\??\c:\users\admin\application data\acd systems\acdsee\imagefj.ddf

Filesize
992KB

MD5
931165d293a5502a5d36aad02e46283c

SHA1
219b9075f29fea1527007a1a67da807b3a5fa6b1

SHA256
51655e04db0b1c01cf0b31d11baae3b34be44b64b40fc9e9ce2d4e3f299391a2

SHA512
806bf759792b0a0637133a8aed6544979b3e69856ac341056830307f50bbe47740fdacea1f23c770cc68dab8d7f2e67d32ef01f46f35d15ecb6209adae6c412a

Download Submit
memory/396-16-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/896-19-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/2436-13-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/3760-5-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download