gh0strat | 110e121a5c20d21a8735dc42a8ac85a81a85e2045d79fb91d77a7328e2662ad9

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27-01-2025 04:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_3c216dfd1ea55f02b865059c1d2aac4c.exe
Size

95KB
MD5

3c216dfd1ea55f02b865059c1d2aac4c
SHA1

930c175570611d2628c4537ddb188d0cd6fcd6e2
SHA256

110e121a5c20d21a8735dc42a8ac85a81a85e2045d79fb91d77a7328e2662ad9
SHA512

aae362f40039d1ce011173f16d013d112635e59ca3168de2fc35ed2452834ff6500df7c6ea6ba631b20f89e8d2961354f64bec28f57ca00566ac9697f4ddd52c
SSDEEP

1536:C+FusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prjXVrGONLfdD:CES4jHS8q/3nTzePCwNUh4E9jXYifdD

Score

10^/10

gh0strat discovery rat

Malware Config

Signatures

Gh0st RAT payload 5 IoCs

resource	yara_rule
behavioral2/files/0x000b000000023b61-15.dat	family_gh0strat
behavioral2/memory/1616-17-0x0000000000400000-0x000000000044E3D4-memory.dmp	family_gh0strat
behavioral2/memory/5068-20-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral2/memory/4764-25-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral2/memory/3716-30-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Deletes itself 1 IoCs

pid	Process
1616	lbcscecmck

Executes dropped EXE 1 IoCs

pid	Process
1616	lbcscecmck

Loads dropped DLL 3 IoCs

pid	Process
5068	svchost.exe
4764	svchost.exe
3716	svchost.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\fxqltpnysr	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\fgffcsqvfm	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\fosxkvstsh	svchost.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1972	5068	WerFault.exe	85
3680	4764	WerFault.exe	90
3180	3716	WerFault.exe	94

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_3c216dfd1ea55f02b865059c1d2aac4c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lbcscecmck
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1616	lbcscecmck
1616	lbcscecmck

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeRestorePrivilege	1616	lbcscecmck
Token: SeBackupPrivilege	1616	lbcscecmck
Token: SeBackupPrivilege	1616	lbcscecmck
Token: SeRestorePrivilege	1616	lbcscecmck
Token: SeBackupPrivilege	5068	svchost.exe
Token: SeRestorePrivilege	5068	svchost.exe
Token: SeBackupPrivilege	5068	svchost.exe
Token: SeBackupPrivilege	5068	svchost.exe
Token: SeSecurityPrivilege	5068	svchost.exe
Token: SeSecurityPrivilege	5068	svchost.exe
Token: SeBackupPrivilege	5068	svchost.exe
Token: SeBackupPrivilege	5068	svchost.exe
Token: SeSecurityPrivilege	5068	svchost.exe
Token: SeBackupPrivilege	5068	svchost.exe
Token: SeBackupPrivilege	5068	svchost.exe
Token: SeSecurityPrivilege	5068	svchost.exe
Token: SeBackupPrivilege	5068	svchost.exe
Token: SeRestorePrivilege	5068	svchost.exe
Token: SeBackupPrivilege	4764	svchost.exe
Token: SeRestorePrivilege	4764	svchost.exe
Token: SeBackupPrivilege	4764	svchost.exe
Token: SeBackupPrivilege	4764	svchost.exe
Token: SeSecurityPrivilege	4764	svchost.exe
Token: SeSecurityPrivilege	4764	svchost.exe
Token: SeBackupPrivilege	4764	svchost.exe
Token: SeBackupPrivilege	4764	svchost.exe
Token: SeSecurityPrivilege	4764	svchost.exe
Token: SeBackupPrivilege	4764	svchost.exe
Token: SeBackupPrivilege	4764	svchost.exe
Token: SeSecurityPrivilege	4764	svchost.exe
Token: SeBackupPrivilege	4764	svchost.exe
Token: SeRestorePrivilege	4764	svchost.exe
Token: SeBackupPrivilege	3716	svchost.exe
Token: SeRestorePrivilege	3716	svchost.exe
Token: SeBackupPrivilege	3716	svchost.exe
Token: SeBackupPrivilege	3716	svchost.exe
Token: SeSecurityPrivilege	3716	svchost.exe
Token: SeSecurityPrivilege	3716	svchost.exe
Token: SeBackupPrivilege	3716	svchost.exe
Token: SeBackupPrivilege	3716	svchost.exe
Token: SeSecurityPrivilege	3716	svchost.exe
Token: SeBackupPrivilege	3716	svchost.exe
Token: SeBackupPrivilege	3716	svchost.exe
Token: SeSecurityPrivilege	3716	svchost.exe
Token: SeBackupPrivilege	3716	svchost.exe
Token: SeRestorePrivilege	3716	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3700 wrote to memory of 1616	3700	JaffaCakes118_3c216dfd1ea55f02b865059c1d2aac4c.exe	83
PID 3700 wrote to memory of 1616	3700	JaffaCakes118_3c216dfd1ea55f02b865059c1d2aac4c.exe	83
PID 3700 wrote to memory of 1616	3700	JaffaCakes118_3c216dfd1ea55f02b865059c1d2aac4c.exe	83

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3c216dfd1ea55f02b865059c1d2aac4c.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3c216dfd1ea55f02b865059c1d2aac4c.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3700
- \??\c:\users\admin\appdata\local\lbcscecmck
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3c216dfd1ea55f02b865059c1d2aac4c.exe" a -sc:\users\admin\appdata\local\temp\jaffacakes118_3c216dfd1ea55f02b865059c1d2aac4c.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1616

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5068
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 1080
  2⤵
  - Program crash
  PID:1972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5068 -ip 5068
1⤵
PID:2520

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4764
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4764 -s 748
  2⤵
  - Program crash
  PID:3680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4764 -ip 4764
1⤵
PID:1564

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3716
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 872
  2⤵
  - Program crash
  PID:3180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3716 -ip 3716
1⤵
PID:1612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\svchost.exe.txt

Filesize
202B

MD5
990989bad65ac0fb12a3a00dd762fedb

SHA1
aa23e09c008c040410b792d0292f0f9d2d94880c

SHA256
67304580a9fd9fa8fc416c58db9b388bbb432f546cefefe43abdfb3fdb629957

SHA512
c2ec4dd94ee12cbb4d73801542b8f298715cc08498132483d56ba4a1ed30f94e39503cd109c9ca56f09a8c9bc180512fa922f24e8305842d28d4ca4e342be2ab

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
303B

MD5
30c43cd454b330a3d525350b9a0a03c0

SHA1
ec04747f5bb481711d95e8a12d50f726130e484e

SHA256
85225bf6037ad04ffb247e78f88cdc301e10cbaa9142bc5307c85b51e8b30ab1

SHA512
23285d865fc301a8b410047290aac2cfa07cdcfe91dde0b8de3c5dbc9dac2bc9c43dcac076ea89c7e5e8af09abe39dc33ce2bcbb4918102a2a76b8755d7b2351

Download Submit
\??\c:\programdata\application data\storm\update\%sessionname%\qhbqk.cc3

Filesize
22.1MB

MD5
5c0933a8f1bbae668863fba4591070eb

SHA1
5bc3f0eb5a19202600750fc0d41a21cf706ed8d5

SHA256
a0997800ccfbce87c537e1ec5568de3009f6d9c847119a5b460beaf7dc00a411

SHA512
3fa68ee43d22761a8e75628a01a22284be1edde4891eb3e4f824bb274e6d38d8b586708b89726cef79b283002f1a165876e928bfc2a68afb4274e12e7d3af16c

Download Submit
\??\c:\users\admin\appdata\local\lbcscecmck

Filesize
19.2MB

MD5
26a1c6f399c3debf29f5b8931223a4ab

SHA1
61c58158325153b722e520080cff318c64180e7f

SHA256
a7f7f57ce25d513a9ba57f5a42ce3f8ddfa9f420bc4da6e5854bc468a3f6bae8

SHA512
4c2b95875448a3729f5010757b5dbd9420b7587fd2aa9c3ebc98396a5f214c72907c99f5ff8fa75d8b3f8c43a341f85807254b206252f5e37af4d390a47bbac2

Download Submit
memory/1616-8-0x0000000000400000-0x000000000044E3D4-memory.dmp

Filesize
312KB

Download
memory/1616-12-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1616-17-0x0000000000400000-0x000000000044E3D4-memory.dmp

Filesize
312KB

Download
memory/3700-0-0x0000000000400000-0x000000000044E3D4-memory.dmp

Filesize
312KB

Download
memory/3700-2-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/3700-9-0x0000000000400000-0x000000000044E3D4-memory.dmp

Filesize
312KB

Download
memory/3716-30-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/3716-27-0x0000000001D80000-0x0000000001D81000-memory.dmp

Filesize
4KB

Download
memory/4764-25-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/4764-22-0x00000000011F0000-0x00000000011F1000-memory.dmp

Filesize
4KB

Download
memory/5068-20-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/5068-18-0x0000000001B80000-0x0000000001B81000-memory.dmp

Filesize
4KB

Download