gh0strat | 1d62bb9231488ab53e7c5e46e7a537cfb23985278874364f9e9ae2ea4aa3f5f5

Analysis

max time kernel
92s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 12:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d456e39eed7df3b00cb187af5a5416ce_JaffaCakes118.exe
Size

96KB
MD5

d456e39eed7df3b00cb187af5a5416ce
SHA1

5be487bf1d610efc019eaaaec806a8e696730ca4
SHA256

1d62bb9231488ab53e7c5e46e7a537cfb23985278874364f9e9ae2ea4aa3f5f5
SHA512

b969b69bd0d8382789328addf40153a1d51d871439377a3de3afa7de2d05069ab2d28e5b26529afb904ccc3d85010f7defbba1a426b0ba57b03b89a0a990c1ce
SSDEEP

1536:0QFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prQK7DPOQnZHTj:0iS4jHS8q/3nTzePCwNUh4E9L7pZHTj

Score

10^/10

gh0strat discovery rat

Malware Config

Signatures

Gh0st RAT payload 5 IoCs

resource	yara_rule
behavioral2/files/0x000b0000000233a7-15.dat	family_gh0strat
behavioral2/memory/3124-17-0x0000000000400000-0x000000000044E338-memory.dmp	family_gh0strat
behavioral2/memory/4996-20-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral2/memory/2588-25-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral2/memory/3224-30-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Deletes itself 1 IoCs

pid	Process
3124	lgmmncuwwj

Executes dropped EXE 1 IoCs

pid	Process
3124	lgmmncuwwj

Loads dropped DLL 3 IoCs

pid	Process
4996	svchost.exe
2588	svchost.exe
3224	svchost.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\uckgqcojkw	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\ukitavkokh	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\uswmiymlwc	svchost.exe
File created	C:\Windows\SysWOW64\uswmiymlwc	svchost.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1676	4996	WerFault.exe	88
1928	2588	WerFault.exe	96
2352	3224	WerFault.exe	99

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d456e39eed7df3b00cb187af5a5416ce_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgmmncuwwj
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3124	lgmmncuwwj
3124	lgmmncuwwj

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeRestorePrivilege	3124	lgmmncuwwj
Token: SeBackupPrivilege	3124	lgmmncuwwj
Token: SeBackupPrivilege	3124	lgmmncuwwj
Token: SeRestorePrivilege	3124	lgmmncuwwj
Token: SeBackupPrivilege	4996	svchost.exe
Token: SeRestorePrivilege	4996	svchost.exe
Token: SeBackupPrivilege	4996	svchost.exe
Token: SeBackupPrivilege	4996	svchost.exe
Token: SeSecurityPrivilege	4996	svchost.exe
Token: SeSecurityPrivilege	4996	svchost.exe
Token: SeBackupPrivilege	4996	svchost.exe
Token: SeBackupPrivilege	4996	svchost.exe
Token: SeSecurityPrivilege	4996	svchost.exe
Token: SeBackupPrivilege	4996	svchost.exe
Token: SeBackupPrivilege	4996	svchost.exe
Token: SeSecurityPrivilege	4996	svchost.exe
Token: SeBackupPrivilege	4996	svchost.exe
Token: SeRestorePrivilege	4996	svchost.exe
Token: SeBackupPrivilege	2588	svchost.exe
Token: SeRestorePrivilege	2588	svchost.exe
Token: SeBackupPrivilege	2588	svchost.exe
Token: SeBackupPrivilege	2588	svchost.exe
Token: SeSecurityPrivilege	2588	svchost.exe
Token: SeSecurityPrivilege	2588	svchost.exe
Token: SeBackupPrivilege	2588	svchost.exe
Token: SeBackupPrivilege	2588	svchost.exe
Token: SeSecurityPrivilege	2588	svchost.exe
Token: SeBackupPrivilege	2588	svchost.exe
Token: SeBackupPrivilege	2588	svchost.exe
Token: SeSecurityPrivilege	2588	svchost.exe
Token: SeBackupPrivilege	2588	svchost.exe
Token: SeRestorePrivilege	2588	svchost.exe
Token: SeBackupPrivilege	3224	svchost.exe
Token: SeRestorePrivilege	3224	svchost.exe
Token: SeBackupPrivilege	3224	svchost.exe
Token: SeBackupPrivilege	3224	svchost.exe
Token: SeSecurityPrivilege	3224	svchost.exe
Token: SeSecurityPrivilege	3224	svchost.exe
Token: SeBackupPrivilege	3224	svchost.exe
Token: SeBackupPrivilege	3224	svchost.exe
Token: SeSecurityPrivilege	3224	svchost.exe
Token: SeBackupPrivilege	3224	svchost.exe
Token: SeBackupPrivilege	3224	svchost.exe
Token: SeSecurityPrivilege	3224	svchost.exe
Token: SeBackupPrivilege	3224	svchost.exe
Token: SeRestorePrivilege	3224	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 3124	4980	d456e39eed7df3b00cb187af5a5416ce_JaffaCakes118.exe	87
PID 4980 wrote to memory of 3124	4980	d456e39eed7df3b00cb187af5a5416ce_JaffaCakes118.exe	87
PID 4980 wrote to memory of 3124	4980	d456e39eed7df3b00cb187af5a5416ce_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\d456e39eed7df3b00cb187af5a5416ce_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d456e39eed7df3b00cb187af5a5416ce_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4980
- \??\c:\users\admin\appdata\local\lgmmncuwwj
  "C:\Users\Admin\AppData\Local\Temp\d456e39eed7df3b00cb187af5a5416ce_JaffaCakes118.exe" a -sc:\users\admin\appdata\local\temp\d456e39eed7df3b00cb187af5a5416ce_jaffacakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3124

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4996 -s 1092
  2⤵
  - Program crash
  PID:1676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4996 -ip 4996
1⤵
PID:3648

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2588
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 1100
  2⤵
  - Program crash
  PID:1928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 2588 -ip 2588
1⤵
PID:4692

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 1088
  2⤵
  - Program crash
  PID:2352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 3224 -ip 3224
1⤵
PID:892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\svchost.exe.txt

Filesize
202B

MD5
6dec4a18e48bfbbb7023a53b2fa6c449

SHA1
c3455186621a87d81225eb7953c444533596c03a

SHA256
645555a72c222148c666d55679bf87d77c07dab8cc047aa26c2062e9116dbb49

SHA512
20ef64a44ead19c0451db115f7844318e72f3d45298a2584c4fdbfd52a1e6886cd85345b1a71b0fdd188dbe22451555f934a0629ab888f0cd54ce88f554872df

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
303B

MD5
e553db24ce07ddb67a900a0d57839424

SHA1
ce0f651df96dc38e07c3f50227736e9ad25503b2

SHA256
ab41bddfc7b7c92a0eddb4c63d2dced67dc0cf6b9c0e9c17087fca51c2e4823e

SHA512
f57c5c13b6532eb792b7f18d135d5aa16278d5183d5b7f9bfffbd87239795ab20b409542e2f83b4fdfd5bba7b2e173eaabe58e9917878340bb516abbb455ca78

Download Submit
\??\c:\programdata\application data\storm\update\%sessionname%\xogbd.cc3

Filesize
19.1MB

MD5
df3e181d803d43aa6e861edf61ee60c7

SHA1
dd12216a5c79bb98b09a8de3f9ae2d536956426a

SHA256
b41ebab9ada779223ba065b2e9c0d471aeb2472107e3645905622bc99357afcf

SHA512
44b0ae45049efb19d75c986ea0789d55cf4bcd2464a6e2a65d24279f23af96fce11c2d722f4f575f98c4c6015ab73280dd8436dbaf3c8f6b9103e27f9fd5b2a3

Download Submit
\??\c:\users\admin\appdata\local\lgmmncuwwj

Filesize
22.0MB

MD5
9dcaee51c5181b6fd8f3a14e0e91c40f

SHA1
48cff4068c87c89725dedb4cc7444ad78a55696b

SHA256
582c29a9c8a1fa305739a0710eee109247296dcedd05126c7fce29d3fe7d505d

SHA512
41b3b27872d94137c6ef765e981b6271ac30e88c135c5dd7a628e1f4d09d3f63edb87700c8622894ec21f6c889c39c0923dd9e77e5de4631e4474f866520cb99

Download Submit
memory/2588-25-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/2588-22-0x0000000001440000-0x0000000001441000-memory.dmp

Filesize
4KB

Download
memory/3124-10-0x00000000001D0000-0x00000000001E0000-memory.dmp

Filesize
64KB

Download
memory/3124-9-0x0000000000400000-0x000000000044E338-memory.dmp

Filesize
312KB

Download
memory/3124-17-0x0000000000400000-0x000000000044E338-memory.dmp

Filesize
312KB

Download
memory/3224-30-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/3224-27-0x0000000000FB0000-0x0000000000FB1000-memory.dmp

Filesize
4KB

Download
memory/4980-12-0x0000000000400000-0x000000000044E338-memory.dmp

Filesize
312KB

Download
memory/4980-0-0x0000000000400000-0x000000000044E338-memory.dmp

Filesize
312KB

Download
memory/4980-2-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/4996-20-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/4996-18-0x0000000001C40000-0x0000000001C41000-memory.dmp

Filesize
4KB

Download