gh0strat | a24b4269996bde42ff6757d2308c3a5f513e372a580d28e1c2df39c241f1170d

Analysis

max time kernel
93s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2024 21:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

90dea7c6b1edc5515d7e638748ef407e_JaffaCakes118.exe
Size

95KB
MD5

90dea7c6b1edc5515d7e638748ef407e
SHA1

2b2b9ecc061b1cc6f7acb38ca2c301bcc7c4cbc6
SHA256

a24b4269996bde42ff6757d2308c3a5f513e372a580d28e1c2df39c241f1170d
SHA512

a792636c7b0286d960c7f7cbd4dff5f622b1f8cffbb1bfeab5b1c2017cb3721a5b4b24277fb891ab00ffb0665e2e5e2c3292ee122dab5f60533482954d763623
SSDEEP

1536:cxEEoFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prvORvMN7:ceE6S4jHS8q/3nTzePCwNUh4E9vAvMN7

Score

10^/10

gh0strat discovery rat

Malware Config

Signatures

Gh0st RAT payload 5 IoCs

resource	yara_rule
behavioral2/files/0x000b000000023b9e-15.dat	family_gh0strat
behavioral2/memory/3704-17-0x0000000000400000-0x000000000044C612-memory.dmp	family_gh0strat
behavioral2/memory/380-20-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral2/memory/4160-25-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral2/memory/2328-30-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Deletes itself 1 IoCs

pid	Process
3704	mmygvinclj

Executes dropped EXE 1 IoCs

pid	Process
3704	mmygvinclj

Loads dropped DLL 3 IoCs

pid	Process
380	svchost.exe
4160	svchost.exe
2328	svchost.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\qouhlapfnf	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\qxruutkjno	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\qggodwmhbk	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1976	380	WerFault.exe	91
764	4160	WerFault.exe	98
4000	2328	WerFault.exe	102

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	90dea7c6b1edc5515d7e638748ef407e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mmygvinclj

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3704	mmygvinclj
3704	mmygvinclj

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeRestorePrivilege	3704	mmygvinclj
Token: SeBackupPrivilege	3704	mmygvinclj
Token: SeBackupPrivilege	3704	mmygvinclj
Token: SeRestorePrivilege	3704	mmygvinclj
Token: SeBackupPrivilege	380	svchost.exe
Token: SeRestorePrivilege	380	svchost.exe
Token: SeBackupPrivilege	380	svchost.exe
Token: SeBackupPrivilege	380	svchost.exe
Token: SeSecurityPrivilege	380	svchost.exe
Token: SeSecurityPrivilege	380	svchost.exe
Token: SeBackupPrivilege	380	svchost.exe
Token: SeBackupPrivilege	380	svchost.exe
Token: SeSecurityPrivilege	380	svchost.exe
Token: SeBackupPrivilege	380	svchost.exe
Token: SeBackupPrivilege	380	svchost.exe
Token: SeSecurityPrivilege	380	svchost.exe
Token: SeBackupPrivilege	380	svchost.exe
Token: SeRestorePrivilege	380	svchost.exe
Token: SeBackupPrivilege	4160	svchost.exe
Token: SeRestorePrivilege	4160	svchost.exe
Token: SeBackupPrivilege	4160	svchost.exe
Token: SeBackupPrivilege	4160	svchost.exe
Token: SeSecurityPrivilege	4160	svchost.exe
Token: SeSecurityPrivilege	4160	svchost.exe
Token: SeBackupPrivilege	4160	svchost.exe
Token: SeBackupPrivilege	4160	svchost.exe
Token: SeSecurityPrivilege	4160	svchost.exe
Token: SeBackupPrivilege	4160	svchost.exe
Token: SeBackupPrivilege	4160	svchost.exe
Token: SeSecurityPrivilege	4160	svchost.exe
Token: SeBackupPrivilege	4160	svchost.exe
Token: SeRestorePrivilege	4160	svchost.exe
Token: SeBackupPrivilege	2328	svchost.exe
Token: SeRestorePrivilege	2328	svchost.exe
Token: SeBackupPrivilege	2328	svchost.exe
Token: SeBackupPrivilege	2328	svchost.exe
Token: SeSecurityPrivilege	2328	svchost.exe
Token: SeSecurityPrivilege	2328	svchost.exe
Token: SeBackupPrivilege	2328	svchost.exe
Token: SeBackupPrivilege	2328	svchost.exe
Token: SeSecurityPrivilege	2328	svchost.exe
Token: SeBackupPrivilege	2328	svchost.exe
Token: SeBackupPrivilege	2328	svchost.exe
Token: SeSecurityPrivilege	2328	svchost.exe
Token: SeBackupPrivilege	2328	svchost.exe
Token: SeRestorePrivilege	2328	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3784 wrote to memory of 3704	3784	90dea7c6b1edc5515d7e638748ef407e_JaffaCakes118.exe	83
PID 3784 wrote to memory of 3704	3784	90dea7c6b1edc5515d7e638748ef407e_JaffaCakes118.exe	83
PID 3784 wrote to memory of 3704	3784	90dea7c6b1edc5515d7e638748ef407e_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\90dea7c6b1edc5515d7e638748ef407e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\90dea7c6b1edc5515d7e638748ef407e_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3784
- \??\c:\users\admin\appdata\local\mmygvinclj
  "C:\Users\Admin\AppData\Local\Temp\90dea7c6b1edc5515d7e638748ef407e_JaffaCakes118.exe" a -sc:\users\admin\appdata\local\temp\90dea7c6b1edc5515d7e638748ef407e_jaffacakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3704

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 380 -s 824
  2⤵
  - Program crash
  PID:1976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 380 -ip 380
1⤵
PID:2660

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4160
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4160 -s 892
  2⤵
  - Program crash
  PID:764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4160 -ip 4160
1⤵
PID:2752

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2328
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 812
  2⤵
  - Program crash
  PID:4000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2328 -ip 2328
1⤵
PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\mmygvinclj

Filesize
23.0MB

MD5
07c00c7aea6aa21120000939f6a3436d

SHA1
bb33f5211c1204829890ac298e53ba6d9b693081

SHA256
2fa271131ccae4c8aa5ea5320072a7fbda0a518b61166f9a57eb46b76319652e

SHA512
0dee4d34d760a834989fba665d522f580638eae11ba4b7aefc9f172e39031250102e47a369fb26b411ee472e72f4abadd127d1d7e08a8ab71be52a9e762a38fd

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
204B

MD5
feb5576dffb06f4c7d16a4a598e834a2

SHA1
c37bd2a9d8df53c9db0feeea141b195e1080e2f9

SHA256
5e20219446c4ef2cea0deff6570a41fad154989041b4a62912ba6f0863abb060

SHA512
c2364eb669a1a003b52208e00023e42ab0ec72b19a2dcf489aec9df3d1f9df8ef35ed851bd2a84af177bd618e29f94d241f43d9450f3aaff7256ed5fdffe65d3

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
306B

MD5
58f214749ae563f96871759b77322a8c

SHA1
761f77ab20e60bdb57ea557f3ed438d827df0654

SHA256
4f823fcc263e03f56303b5375cbce6a7a8cb47e1de811d164a8dac051ae7eef9

SHA512
46018ad1e17cbf5d6589b1c949426426a4a9789869536240786a115fc60daa434d058de6a63faea1fe9e7f9da8d2ec114f4ce4a1edf3a9d0150ad142b7e767d3

Download Submit
\??\c:\programdata\application data\storm\update\%sessionname%\lgjwm.cc3

Filesize
22.0MB

MD5
227b476e1ac2b5d8aa943071b1bfc2cc

SHA1
4b925ba926969160a337cc1d4d811e5cbf608c32

SHA256
a01c6b8aa61ef449c170d58bc1e54b5f80267ea48cd871d20d234ba2fd5edbaa

SHA512
a5302b3608ce70c91fd8589da5d1905775a592cf7a8d57b525a412f88095b1d6842a54cfc52802ee00b0799ee995efc2eba7dd3415ae7e5f02a4d8f60c12b6b8

Download Submit
memory/380-18-0x00000000019E0000-0x00000000019E1000-memory.dmp

Filesize
4KB

Download
memory/380-20-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/2328-27-0x0000000001900000-0x0000000001901000-memory.dmp

Filesize
4KB

Download
memory/2328-30-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/3704-9-0x0000000000400000-0x000000000044C612-memory.dmp

Filesize
305KB

Download
memory/3704-12-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/3704-17-0x0000000000400000-0x000000000044C612-memory.dmp

Filesize
305KB

Download
memory/3784-8-0x0000000000400000-0x000000000044C612-memory.dmp

Filesize
305KB

Download
memory/3784-0-0x0000000000400000-0x000000000044C612-memory.dmp

Filesize
305KB

Download
memory/3784-2-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/4160-25-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/4160-22-0x0000000001790000-0x0000000001791000-memory.dmp

Filesize
4KB

Download