gh0strat | 1590170a9e1db39d7dd17dd1e173dc0c117692fad525ac72ad248a2510b17e62

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07-09-2024 15:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d23dfb4894ee6e2b1c1f46855e92b4e9_JaffaCakes118.exe
Size

224KB
MD5

d23dfb4894ee6e2b1c1f46855e92b4e9
SHA1

8009c24d55a9bc6fa79c3fdcea46576f81b68ad8
SHA256

1590170a9e1db39d7dd17dd1e173dc0c117692fad525ac72ad248a2510b17e62
SHA512

27e40086ec5dba09c63b3710e5ecf996815b2b7255f83ff9a0be0191b286f3b21ef728459bd6c2d907de3ff436a9e2f0b063a3c956365001357ef760333eb085
SSDEEP

6144:4w0avOvtYSiod4uYzqAvZd/246Nvm7oS:RvGvViG4HOKZdem7oS

Score

10^/10

gh0strat discovery rat upx

Malware Config

Signatures

Gh0st RAT payload 4 IoCs

resource	yara_rule
behavioral2/files/0x000b000000023413-13.dat	family_gh0strat
behavioral2/memory/4756-17-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral2/memory/5116-22-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral2/memory/404-27-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Executes dropped EXE 2 IoCs

pid	Process
1224	Oath.exe
1400	nodpidtfdu

Loads dropped DLL 3 IoCs

pid	Process
4756	svchost.exe
5116	svchost.exe
404	svchost.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4908-0-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral2/memory/4908-9-0x0000000000400000-0x000000000043A000-memory.dmp	upx

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ifafdbtjeh	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\innylevhrd	svchost.exe
File created	C:\Windows\SysWOW64\innylevhrd	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\ivcrshxeex	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\nodpidtfdu	Oath.exe
File created	\??\c:\windows\nodpidtfdu	Oath.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
3068	4756	WerFault.exe	89
4604	5116	WerFault.exe	93
1540	404	WerFault.exe	96

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d23dfb4894ee6e2b1c1f46855e92b4e9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oath.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nodpidtfdu
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1400	nodpidtfdu
1400	nodpidtfdu

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeRestorePrivilege	1400	nodpidtfdu
Token: SeBackupPrivilege	1400	nodpidtfdu
Token: SeBackupPrivilege	1400	nodpidtfdu
Token: SeRestorePrivilege	1400	nodpidtfdu
Token: SeBackupPrivilege	4756	svchost.exe
Token: SeRestorePrivilege	4756	svchost.exe
Token: SeBackupPrivilege	4756	svchost.exe
Token: SeBackupPrivilege	4756	svchost.exe
Token: SeSecurityPrivilege	4756	svchost.exe
Token: SeSecurityPrivilege	4756	svchost.exe
Token: SeBackupPrivilege	4756	svchost.exe
Token: SeBackupPrivilege	4756	svchost.exe
Token: SeSecurityPrivilege	4756	svchost.exe
Token: SeBackupPrivilege	4756	svchost.exe
Token: SeBackupPrivilege	4756	svchost.exe
Token: SeSecurityPrivilege	4756	svchost.exe
Token: SeBackupPrivilege	4756	svchost.exe
Token: SeRestorePrivilege	4756	svchost.exe
Token: SeBackupPrivilege	5116	svchost.exe
Token: SeRestorePrivilege	5116	svchost.exe
Token: SeBackupPrivilege	5116	svchost.exe
Token: SeBackupPrivilege	5116	svchost.exe
Token: SeSecurityPrivilege	5116	svchost.exe
Token: SeSecurityPrivilege	5116	svchost.exe
Token: SeBackupPrivilege	5116	svchost.exe
Token: SeBackupPrivilege	5116	svchost.exe
Token: SeSecurityPrivilege	5116	svchost.exe
Token: SeBackupPrivilege	5116	svchost.exe
Token: SeBackupPrivilege	5116	svchost.exe
Token: SeSecurityPrivilege	5116	svchost.exe
Token: SeBackupPrivilege	5116	svchost.exe
Token: SeRestorePrivilege	5116	svchost.exe
Token: SeBackupPrivilege	404	svchost.exe
Token: SeRestorePrivilege	404	svchost.exe
Token: SeBackupPrivilege	404	svchost.exe
Token: SeBackupPrivilege	404	svchost.exe
Token: SeSecurityPrivilege	404	svchost.exe
Token: SeSecurityPrivilege	404	svchost.exe
Token: SeBackupPrivilege	404	svchost.exe
Token: SeBackupPrivilege	404	svchost.exe
Token: SeSecurityPrivilege	404	svchost.exe
Token: SeBackupPrivilege	404	svchost.exe
Token: SeBackupPrivilege	404	svchost.exe
Token: SeSecurityPrivilege	404	svchost.exe
Token: SeBackupPrivilege	404	svchost.exe
Token: SeRestorePrivilege	404	svchost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 1224	4908	d23dfb4894ee6e2b1c1f46855e92b4e9_JaffaCakes118.exe	86
PID 4908 wrote to memory of 1224	4908	d23dfb4894ee6e2b1c1f46855e92b4e9_JaffaCakes118.exe	86
PID 4908 wrote to memory of 1224	4908	d23dfb4894ee6e2b1c1f46855e92b4e9_JaffaCakes118.exe	86
PID 1224 wrote to memory of 1400	1224	Oath.exe	88
PID 1224 wrote to memory of 1400	1224	Oath.exe	88
PID 1224 wrote to memory of 1400	1224	Oath.exe	88

C:\Users\Admin\AppData\Local\Temp\d23dfb4894ee6e2b1c1f46855e92b4e9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d23dfb4894ee6e2b1c1f46855e92b4e9_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4908
- C:\windows\temp\Oath.exe
  C:\windows\temp\Oath.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1224
- - \??\c:\windows\nodpidtfdu
    C:\windows\temp\Oath.exe a -sc:\windows\temp\oath.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1400

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 860
  2⤵
  - Program crash
  PID:3068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4756 -ip 4756
1⤵
PID:3348

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5116 -s 940
  2⤵
  - Program crash
  PID:4604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5116 -ip 5116
1⤵
PID:1816

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:404
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 404 -s 748
  2⤵
  - Program crash
  PID:1540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 404 -ip 404
1⤵
PID:628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\svchost.exe.txt

Filesize
202B

MD5
747b7869e547f93cc2c8a6f4d8bca782

SHA1
40736d66800681faba752c0e3fefff2dcce2bc77

SHA256
e4f07dd8bc8e4f6624d2afe64dee83d6dd186fd1e76c930c0a52f8e97eaed39b

SHA512
292a740de85ab0b0d50676db02cf49faa9484b73cc4b28388d75c4a878a272f3a0bd4d4bb396482798167ac707a3bdf218904f5d511efe1e80790ee5c2c41ad6

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
303B

MD5
52c0a7fd0e2bdb00050588940292bc3f

SHA1
63403e32836dc455caeeafb04d2d5343d4d53ebe

SHA256
4b55d6f4f7396d657c27b4b0efb9161497b7f40023571312ebb46ecb67a7858e

SHA512
6d99a6e657b9828ffdf755b020560b3159c65f8f9974f0d3b480e41dc2ec635b96ad2dbb07b4514c1c42769f032c0afac9193211b209d6462a915b54cdd7fbaa

Download Submit
\??\c:\programdata\application data\storm\update\%sessionname%\ebjml.cc3

Filesize
24.1MB

MD5
f8b45f07b6430d637d7350fa944ae3d1

SHA1
a7a39adee03539fa333adb3d8315ea15a9b15e30

SHA256
f63efa94643ee5d335e1b4ea226df31f33bd1df90c5985bc01764a922d7900e3

SHA512
85324b43e820b9d4ad5993294b0b08c573bba3e78d9a3ba52e7e0202fb941a7179b7096a579aedae813aae42d25def311a4b24c0c8a17bd95999a9f80bfccd21

Download Submit
memory/404-24-0x00000000017D0000-0x00000000017D1000-memory.dmp

Filesize
4KB

Download
memory/404-27-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/4756-15-0x00000000019F0000-0x00000000019F1000-memory.dmp

Filesize
4KB

Download
memory/4756-17-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/4908-0-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4908-9-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/5116-22-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download