gh0strat | 3de735a8224cce1ea620fee1064b8c5c5b0c468b084573c31c2f75514c109b45

Analysis

max time kernel
94s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27-01-2025 05:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_3c5ceb6c6c80835baf0802d6bbfa8ce6.exe
Size

96KB
MD5

3c5ceb6c6c80835baf0802d6bbfa8ce6
SHA1

d1c1006b714334854316ee9dec8cd23ea0af89a7
SHA256

3de735a8224cce1ea620fee1064b8c5c5b0c468b084573c31c2f75514c109b45
SHA512

1592c5f4884af431e020482aaae8480714737bffb7d805fc2f5d2b4b8e7bc0ae3ebb803b3fcb9e2cd0d16a10e1dd78c3d86dcf0cf534cd10e78ff148cc7044b5
SSDEEP

3072:nDS4jHS8q/3nTzePCwNUh4E9s8HfycaYu:n2428q/nTzePCwG7t7S

Score

10^/10

gh0strat discovery rat

Malware Config

Signatures

Gh0st RAT payload 5 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023c82-15.dat	family_gh0strat
behavioral2/memory/4768-17-0x0000000000400000-0x000000000044E258-memory.dmp	family_gh0strat
behavioral2/memory/4240-20-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral2/memory/816-25-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral2/memory/1168-30-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Deletes itself 1 IoCs

pid	Process
4768	ltgyfwqfhk

Executes dropped EXE 1 IoCs

pid	Process
4768	ltgyfwqfhk

Loads dropped DLL 3 IoCs

pid	Process
4240	svchost.exe
816	svchost.exe
1168	svchost.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\kmbqyqhiof	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\kvpjhtjgcb	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\kmrvwaobcq	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
228	4240	WerFault.exe	83
2464	816	WerFault.exe	89
4496	1168	WerFault.exe	94

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_3c5ceb6c6c80835baf0802d6bbfa8ce6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ltgyfwqfhk
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4768	ltgyfwqfhk
4768	ltgyfwqfhk

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeRestorePrivilege	4768	ltgyfwqfhk
Token: SeBackupPrivilege	4768	ltgyfwqfhk
Token: SeBackupPrivilege	4768	ltgyfwqfhk
Token: SeRestorePrivilege	4768	ltgyfwqfhk
Token: SeBackupPrivilege	4240	svchost.exe
Token: SeRestorePrivilege	4240	svchost.exe
Token: SeBackupPrivilege	4240	svchost.exe
Token: SeBackupPrivilege	4240	svchost.exe
Token: SeSecurityPrivilege	4240	svchost.exe
Token: SeSecurityPrivilege	4240	svchost.exe
Token: SeBackupPrivilege	4240	svchost.exe
Token: SeBackupPrivilege	4240	svchost.exe
Token: SeSecurityPrivilege	4240	svchost.exe
Token: SeBackupPrivilege	4240	svchost.exe
Token: SeBackupPrivilege	4240	svchost.exe
Token: SeSecurityPrivilege	4240	svchost.exe
Token: SeBackupPrivilege	4240	svchost.exe
Token: SeRestorePrivilege	4240	svchost.exe
Token: SeBackupPrivilege	816	svchost.exe
Token: SeRestorePrivilege	816	svchost.exe
Token: SeBackupPrivilege	816	svchost.exe
Token: SeBackupPrivilege	816	svchost.exe
Token: SeSecurityPrivilege	816	svchost.exe
Token: SeSecurityPrivilege	816	svchost.exe
Token: SeBackupPrivilege	816	svchost.exe
Token: SeBackupPrivilege	816	svchost.exe
Token: SeSecurityPrivilege	816	svchost.exe
Token: SeBackupPrivilege	816	svchost.exe
Token: SeBackupPrivilege	816	svchost.exe
Token: SeSecurityPrivilege	816	svchost.exe
Token: SeBackupPrivilege	816	svchost.exe
Token: SeRestorePrivilege	816	svchost.exe
Token: SeBackupPrivilege	1168	svchost.exe
Token: SeRestorePrivilege	1168	svchost.exe
Token: SeBackupPrivilege	1168	svchost.exe
Token: SeBackupPrivilege	1168	svchost.exe
Token: SeSecurityPrivilege	1168	svchost.exe
Token: SeSecurityPrivilege	1168	svchost.exe
Token: SeBackupPrivilege	1168	svchost.exe
Token: SeBackupPrivilege	1168	svchost.exe
Token: SeSecurityPrivilege	1168	svchost.exe
Token: SeBackupPrivilege	1168	svchost.exe
Token: SeBackupPrivilege	1168	svchost.exe
Token: SeSecurityPrivilege	1168	svchost.exe
Token: SeBackupPrivilege	1168	svchost.exe
Token: SeRestorePrivilege	1168	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 4768	940	JaffaCakes118_3c5ceb6c6c80835baf0802d6bbfa8ce6.exe	82
PID 940 wrote to memory of 4768	940	JaffaCakes118_3c5ceb6c6c80835baf0802d6bbfa8ce6.exe	82
PID 940 wrote to memory of 4768	940	JaffaCakes118_3c5ceb6c6c80835baf0802d6bbfa8ce6.exe	82

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3c5ceb6c6c80835baf0802d6bbfa8ce6.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3c5ceb6c6c80835baf0802d6bbfa8ce6.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:940
- \??\c:\users\admin\appdata\local\ltgyfwqfhk
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3c5ceb6c6c80835baf0802d6bbfa8ce6.exe" a -sc:\users\admin\appdata\local\temp\jaffacakes118_3c5ceb6c6c80835baf0802d6bbfa8ce6.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4768

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4240 -s 1056
  2⤵
  - Program crash
  PID:228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4240 -ip 4240
1⤵
PID:2636

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:816
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 816 -s 1100
  2⤵
  - Program crash
  PID:2464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 816 -ip 816
1⤵
PID:396

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1168
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 1104
  2⤵
  - Program crash
  PID:4496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1168 -ip 1168
1⤵
PID:1276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\ltgyfwqfhk

Filesize
23.6MB

MD5
2919dfe4036a09f4bf937c2a571ef7ee

SHA1
5c2bb5b8b258c442731409315cccb68e5d727b58

SHA256
fb01c0bcaed6dde134299eb8d11b99f0bd6ce3e31431078b2bcede686c3d9d02

SHA512
083beffc6d6d901b49c5ab972033d761a27dd71e0b1747bbbf2a62c2f3d6dfcd9b93615153424a7db389bdbd74cff7a63ef351b515a63f7c9fab3680ec6f4613

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
202B

MD5
58dd230a9df5cbcc10e5e26aecc137f7

SHA1
cdbcc79c9d02fdd6802ab25440ca8ad6d0e4f05d

SHA256
9e233a7feb256ff51f9d89c7eac416dc351c7dae459e3605a827b40b54d72c3c

SHA512
771681abc992320b3792fd8a63f7c2c1f79b7c90e21b69912807fac7257096324863946759131877ef371c681c717600fe7ef4966ccaab2a9284792d349c8124

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
303B

MD5
f1de4f9c70ce99f4e146b41a487737ce

SHA1
e4ba7a09fce30590e20cfacc4b98973c4f8f783b

SHA256
b5c263e6065b24dfef22b969943976ec9ed4fc0c1072197e3ed1e82694e26119

SHA512
ae581677ca85d2d17d5d71290df79a2c8ca87f63a3885a07d471a24535b1af1247c49b6f94b564c1e94a77bb564fdfed8f300ceef0bba07be7bca5b996716ab4

Download Submit
\??\c:\programdata\application data\storm\update\%sessionname%\mksmx.cc3

Filesize
20.1MB

MD5
8c30b324e3aad9d630dd980165dc19fb

SHA1
282e3f02245499fe38895b0195ba02d417a74dc6

SHA256
c60f0c75192b60e3ced452726ba7467210d04d754cc2c8f9e051973d816b2a2b

SHA512
6b2ca46ce75fecb595dbc1b1dd7dd86e99f0a69b20ef502a75efa6c482fa2d43c704377cf116629b35b2639cec5d210f10770a96c22b129c8c37ba5bab4508ad

Download Submit
memory/816-25-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/816-22-0x0000000001B40000-0x0000000001B41000-memory.dmp

Filesize
4KB

Download
memory/940-2-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/940-12-0x0000000000400000-0x000000000044E258-memory.dmp

Filesize
312KB

Download
memory/940-0-0x0000000000400000-0x000000000044E258-memory.dmp

Filesize
312KB

Download
memory/1168-30-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/1168-27-0x0000000000FD0000-0x0000000000FD1000-memory.dmp

Filesize
4KB

Download
memory/4240-18-0x0000000000D80000-0x0000000000D81000-memory.dmp

Filesize
4KB

Download
memory/4240-20-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/4768-17-0x0000000000400000-0x000000000044E258-memory.dmp

Filesize
312KB

Download
memory/4768-9-0x0000000000400000-0x000000000044E258-memory.dmp

Filesize
312KB

Download
memory/4768-10-0x00000000001D0000-0x00000000001E0000-memory.dmp

Filesize
64KB

Download