gh0strat | 9438c3b3a3414bf368ac2e43443a6923680f75cc58b6ef5639f12192c95e1a3f

Analysis

max time kernel
94s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 15:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f644584303672c4fc86f8fd7032f5993_JaffaCakes118.exe
Size

95KB
MD5

f644584303672c4fc86f8fd7032f5993
SHA1

681b30e41c67b2bc8a05da168e5f0881bbc977d9
SHA256

9438c3b3a3414bf368ac2e43443a6923680f75cc58b6ef5639f12192c95e1a3f
SHA512

19afe85b91ead8b66b480eea71d1b1d205eb088d6e98a3e8c456030b57cbbbf381fe2f0163aee2e6d98d9c7dacb9fe7917cd8337e864af399a24b2b2006380d0
SSDEEP

1536:mrVmXFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prYggPPw+t+:mohS4jHS8q/3nTzePCwNUh4E9lgPPwg+

Score

10^/10

gh0strat discovery rat

Malware Config

Signatures

Gh0st RAT payload 5 IoCs

resource	yara_rule
behavioral2/files/0x000800000002344b-15.dat	family_gh0strat
behavioral2/memory/1068-17-0x0000000000400000-0x000000000044C611-memory.dmp	family_gh0strat
behavioral2/memory/4424-20-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral2/memory/1436-25-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral2/memory/1988-30-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Deletes itself 1 IoCs

pid	Process
1068	fdeglygrby

Executes dropped EXE 1 IoCs

pid	Process
1068	fdeglygrby

Loads dropped DLL 3 IoCs

pid	Process
4424	svchost.exe
1436	svchost.exe
1988	svchost.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\emunflhvys	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\evihnojtmn	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\eeguxiexmw	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
728	4424	WerFault.exe	83
1292	1436	WerFault.exe	87
1560	1988	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f644584303672c4fc86f8fd7032f5993_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdeglygrby
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1068	fdeglygrby
1068	fdeglygrby

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeRestorePrivilege	1068	fdeglygrby
Token: SeBackupPrivilege	1068	fdeglygrby
Token: SeBackupPrivilege	1068	fdeglygrby
Token: SeRestorePrivilege	1068	fdeglygrby
Token: SeBackupPrivilege	4424	svchost.exe
Token: SeRestorePrivilege	4424	svchost.exe
Token: SeBackupPrivilege	4424	svchost.exe
Token: SeBackupPrivilege	4424	svchost.exe
Token: SeSecurityPrivilege	4424	svchost.exe
Token: SeSecurityPrivilege	4424	svchost.exe
Token: SeBackupPrivilege	4424	svchost.exe
Token: SeBackupPrivilege	4424	svchost.exe
Token: SeSecurityPrivilege	4424	svchost.exe
Token: SeBackupPrivilege	4424	svchost.exe
Token: SeBackupPrivilege	4424	svchost.exe
Token: SeSecurityPrivilege	4424	svchost.exe
Token: SeBackupPrivilege	4424	svchost.exe
Token: SeRestorePrivilege	4424	svchost.exe
Token: SeBackupPrivilege	1436	svchost.exe
Token: SeRestorePrivilege	1436	svchost.exe
Token: SeBackupPrivilege	1436	svchost.exe
Token: SeBackupPrivilege	1436	svchost.exe
Token: SeSecurityPrivilege	1436	svchost.exe
Token: SeSecurityPrivilege	1436	svchost.exe
Token: SeBackupPrivilege	1436	svchost.exe
Token: SeBackupPrivilege	1436	svchost.exe
Token: SeSecurityPrivilege	1436	svchost.exe
Token: SeBackupPrivilege	1436	svchost.exe
Token: SeBackupPrivilege	1436	svchost.exe
Token: SeSecurityPrivilege	1436	svchost.exe
Token: SeBackupPrivilege	1436	svchost.exe
Token: SeRestorePrivilege	1436	svchost.exe
Token: SeBackupPrivilege	1988	svchost.exe
Token: SeRestorePrivilege	1988	svchost.exe
Token: SeBackupPrivilege	1988	svchost.exe
Token: SeBackupPrivilege	1988	svchost.exe
Token: SeSecurityPrivilege	1988	svchost.exe
Token: SeSecurityPrivilege	1988	svchost.exe
Token: SeBackupPrivilege	1988	svchost.exe
Token: SeBackupPrivilege	1988	svchost.exe
Token: SeSecurityPrivilege	1988	svchost.exe
Token: SeBackupPrivilege	1988	svchost.exe
Token: SeBackupPrivilege	1988	svchost.exe
Token: SeSecurityPrivilege	1988	svchost.exe
Token: SeBackupPrivilege	1988	svchost.exe
Token: SeRestorePrivilege	1988	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 1068	2664	f644584303672c4fc86f8fd7032f5993_JaffaCakes118.exe	82
PID 2664 wrote to memory of 1068	2664	f644584303672c4fc86f8fd7032f5993_JaffaCakes118.exe	82
PID 2664 wrote to memory of 1068	2664	f644584303672c4fc86f8fd7032f5993_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\f644584303672c4fc86f8fd7032f5993_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f644584303672c4fc86f8fd7032f5993_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2664
- \??\c:\users\admin\appdata\local\fdeglygrby
  "C:\Users\Admin\AppData\Local\Temp\f644584303672c4fc86f8fd7032f5993_JaffaCakes118.exe" a -sc:\users\admin\appdata\local\temp\f644584303672c4fc86f8fd7032f5993_jaffacakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1068

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4424
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4424 -s 1080
  2⤵
  - Program crash
  PID:728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4424 -ip 4424
1⤵
PID:3700

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1436
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 1108
  2⤵
  - Program crash
  PID:1292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1436 -ip 1436
1⤵
PID:2948

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 936
  2⤵
  - Program crash
  PID:1560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1988 -ip 1988
1⤵
PID:1508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\fdeglygrby

Filesize
21.7MB

MD5
770cdd7b6d4decc6a78acff2c8d79ddf

SHA1
39c7faa350a7ebede1f386fda2ad1a8b435ee188

SHA256
2c081ae600baaa99a1cfe3b0bd3f1f8edd5dfa5f76412b1a9ae496f77ddf8ca5

SHA512
bac9d27fefb3e5b15dc730674abcf6a52b7b8933774446d13dab8020fee3addaeb9404ee8887b998b634a5c082bd843c16ed0a70f4936fd38f8cfc07f1e66b16

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
202B

MD5
5b070743a1b06f56bf67e01d10c06dec

SHA1
ba5d1bdc9346b7a08dd7830e6f9aa5c70e3ecaa4

SHA256
c4bea7899ac994512f2d3bc4d8c559d18b871adc709d3df783acec0847596f19

SHA512
03b1cd1a620fab49ffd74679929bec62f1deeb7a77bc960e13289ec2317f203323939df6c890a301f4b602025d0c16a62ec1bff09b9e4a01f5a172c62591ff4e

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
303B

MD5
5fd052f97d3f377a4de37da536de6bb8

SHA1
0adc63700c18996db7229dd543aeebb4aca522f4

SHA256
fc3c030fcb351c522823b1ea66af7d6225138611a3076c1c2a2bc40b663fbeb9

SHA512
939d5ddbd9937c2dcef663b5137d69d256fe15a54937ce806824df4c88f1929e69c70de43e5dd953a4c57db4318457a16b4b1793a07facb6368fee778560c1df

Download Submit
\??\c:\programdata\application data\storm\update\%sessionname%\pgggb.cc3

Filesize
24.1MB

MD5
dbb6b2af275aa26cdd95dd59c0a317d8

SHA1
3435f5668e0e5921564b273c8fe24d0f73ef05f4

SHA256
23b31f61a4abc4422ff3ff83a93a215926b9dc07c1dc74138ee6caf3ba3752bb

SHA512
d2ebfe77055ec201557314f5512b20aa345239348224cde3cc134fd0d020a43c3d0342d553fde3a2ccf024f1668e1c8b0e9a81e4f2e7625cfae118fe2674abd4

Download Submit
memory/1068-17-0x0000000000400000-0x000000000044C611-memory.dmp

Filesize
305KB

Download
memory/1068-8-0x0000000000400000-0x000000000044C611-memory.dmp

Filesize
305KB

Download
memory/1068-12-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1436-25-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/1436-22-0x00000000017F0000-0x00000000017F1000-memory.dmp

Filesize
4KB

Download
memory/1988-27-0x0000000001300000-0x0000000001301000-memory.dmp

Filesize
4KB

Download
memory/1988-30-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/2664-9-0x0000000000400000-0x000000000044C611-memory.dmp

Filesize
305KB

Download
memory/2664-0-0x0000000000400000-0x000000000044C611-memory.dmp

Filesize
305KB

Download
memory/2664-2-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/4424-18-0x00000000013E0000-0x00000000013E1000-memory.dmp

Filesize
4KB

Download
memory/4424-20-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download