gh0strat | da6cbd42489879760c5dd8e8d7a85e764a4a1c5b75500df04a65fa9c081731d1

Analysis

max time kernel
127s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01/01/2025, 00:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JaffaCakes118_416982e3bc2ba706d0d42b3a80299500.exe
Size 205KB
Sample250101-back3sykgw
SHA256 da6cbd42489879760c5dd8e8d7a85e764a4a1c5b75500df04a65fa9c081731d1
MD5 416982e3bc2ba706d0d42b3a80299500
SHA1 b30475bd42c46c99d81d933f479386d6e661fcfe
SHA512 b5a9c13c920a22bed43f5f82ae3c5613beb4a5b4b7b5f6fe63bc6534eccf8cc1db155b2ab7c7773fcc144dfd9dd283659ffa7fa5b82a78959537c2b8d2e3c185
SSDEEP 3072:/hwVMQgpRh5qTsFyTDW2DQ8UK7dPLjNNRwQRWttOn3C:i2Rnh5Es0m2EI7RNYQRWS3C
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat discovery persistence rat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000b000000023ba8-3.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Executes dropped EXE 1 IoCs

pid	Process
988	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\V2011 = "C:\\WINDOWS\\V2011.exe"	svchost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\V2011.exe	svchost.exe
File opened for modification	C:\WINDOWS\V2011.exe	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_416982e3bc2ba706d0d42b3a80299500.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2640	JaffaCakes118_416982e3bc2ba706d0d42b3a80299500.exe
2640	JaffaCakes118_416982e3bc2ba706d0d42b3a80299500.exe
988	svchost.exe
988	svchost.exe
988	svchost.exe
988	svchost.exe
988	svchost.exe
988	svchost.exe
988	svchost.exe
988	svchost.exe
988	svchost.exe
988	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
988	svchost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	988	svchost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 988	2640	JaffaCakes118_416982e3bc2ba706d0d42b3a80299500.exe	82
PID 2640 wrote to memory of 988	2640	JaffaCakes118_416982e3bc2ba706d0d42b3a80299500.exe	82
PID 2640 wrote to memory of 988	2640	JaffaCakes118_416982e3bc2ba706d0d42b3a80299500.exe	82
PID 2640 wrote to memory of 3272	2640	JaffaCakes118_416982e3bc2ba706d0d42b3a80299500.exe	91
PID 2640 wrote to memory of 3272	2640	JaffaCakes118_416982e3bc2ba706d0d42b3a80299500.exe	91
PID 2640 wrote to memory of 3272	2640	JaffaCakes118_416982e3bc2ba706d0d42b3a80299500.exe	91

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_416982e3bc2ba706d0d42b3a80299500.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_416982e3bc2ba706d0d42b3a80299500.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Users\Admin\AppData\Local\Temp\V2011\svchost.exe
  C:\Users\Admin\AppData\Local\Temp\V2011\svchost.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c afc9fe2f418b00a0.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\V2011\svchost.exe
Size 205KB
SHA256 47eb5e71b0390b0548bb49076b04b0fc7981b9b7e2926d2dde584f515d265d29
MD5 2c2f45c66cf5d6c1b80a5ed31ada7c6f
SHA1 ed85b086c292d9939cf74aadb1729b5650de8869
SHA512 84bd2350ad2446c1e2302ddc0f8802b6103b15fe0f809ec4369c5cee812d85bdd85d8eb8d0d73bd3990892e370366adeb63d01223f52d922677a46f9538a20f9
SSDEEP 3072:/hwVMQgpRh5qTsFyTDW2DQ8UK7dPLjNNRwQRWttOn3s:i2Rnh5Es0m2EI7RNYQRWS3s
MD5 SHA1 SHA512 SSDEEP

Submit Download

afc9fe2f418b00a0.bat

Path C:\Users\Admin\AppData\Local\Temp\afc9fe2f418b00a0.bat
Size 2KB
SHA256 d75af7a6a052dbacd8e6474b2be0cee5ea1e77497e52083c1334030eadfc44fc
MD5 0c417254a3ddee656c6ec3f66f939a64
SHA1 69f90e5afca3bbdca06db2a2e91bc30bcdbbee63
SHA512 c34c1821a131bd54100bfb6fad402c1ea09caa2c9a963205bd6d7c5e1d34ba78e25855f3cd310608395c75e2db2bcf393e3f191a046c075b8f1c893df8f28c04
MD5 SHA1 SHA512

Submit Download