gh0strat | 505de3496906627c08ffa7d3c3360d12aabb98b90fe93af7c2a90a3142086b4f

Analysis

max time kernel
95s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27-01-2025 09:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_3e3c6096674b01d8ac7bb09ced93adc5.exe
Size

95KB
MD5

3e3c6096674b01d8ac7bb09ced93adc5
SHA1

a25ab5ef063393755c3c124dba8f842146ee3062
SHA256

505de3496906627c08ffa7d3c3360d12aabb98b90fe93af7c2a90a3142086b4f
SHA512

dcc522f1d0eb84a3b0051719fe073e8aff2f77f3252f34e9b1b4dfba7701ec999dde4cd93d24783377f2b00b774f427279fc9e52b89f8d565da323a72d4619db
SSDEEP

1536:rJFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8pr4enbiVG:rfS4jHS8q/3nTzePCwNUh4E9JbR

Score

10^/10

gh0strat discovery rat

Malware Config

Signatures

Gh0st RAT payload 5 IoCs

resource	yara_rule
behavioral2/files/0x0009000000023bbd-15.dat	family_gh0strat
behavioral2/memory/1240-17-0x0000000000400000-0x000000000044E27C-memory.dmp	family_gh0strat
behavioral2/memory/3800-20-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral2/memory/1804-25-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral2/memory/4612-30-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Deletes itself 1 IoCs

pid	Process
1240	lqqpisrgpw

Executes dropped EXE 1 IoCs

pid	Process
1240	lqqpisrgpw

Loads dropped DLL 3 IoCs

pid	Process
3800	svchost.exe
1804	svchost.exe
4612	svchost.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wilgsmgnng	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\wqayapikbb	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\wqayapikbb	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2452	3800	WerFault.exe	85
2372	1804	WerFault.exe	90
3460	4612	WerFault.exe	94

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_3e3c6096674b01d8ac7bb09ced93adc5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lqqpisrgpw
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1240	lqqpisrgpw
1240	lqqpisrgpw

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeRestorePrivilege	1240	lqqpisrgpw
Token: SeBackupPrivilege	1240	lqqpisrgpw
Token: SeBackupPrivilege	1240	lqqpisrgpw
Token: SeRestorePrivilege	1240	lqqpisrgpw
Token: SeBackupPrivilege	3800	svchost.exe
Token: SeRestorePrivilege	3800	svchost.exe
Token: SeBackupPrivilege	3800	svchost.exe
Token: SeBackupPrivilege	3800	svchost.exe
Token: SeSecurityPrivilege	3800	svchost.exe
Token: SeSecurityPrivilege	3800	svchost.exe
Token: SeBackupPrivilege	3800	svchost.exe
Token: SeBackupPrivilege	3800	svchost.exe
Token: SeSecurityPrivilege	3800	svchost.exe
Token: SeBackupPrivilege	3800	svchost.exe
Token: SeBackupPrivilege	3800	svchost.exe
Token: SeSecurityPrivilege	3800	svchost.exe
Token: SeBackupPrivilege	3800	svchost.exe
Token: SeRestorePrivilege	3800	svchost.exe
Token: SeBackupPrivilege	1804	svchost.exe
Token: SeRestorePrivilege	1804	svchost.exe
Token: SeBackupPrivilege	1804	svchost.exe
Token: SeBackupPrivilege	1804	svchost.exe
Token: SeSecurityPrivilege	1804	svchost.exe
Token: SeSecurityPrivilege	1804	svchost.exe
Token: SeBackupPrivilege	1804	svchost.exe
Token: SeBackupPrivilege	1804	svchost.exe
Token: SeSecurityPrivilege	1804	svchost.exe
Token: SeBackupPrivilege	1804	svchost.exe
Token: SeBackupPrivilege	1804	svchost.exe
Token: SeSecurityPrivilege	1804	svchost.exe
Token: SeBackupPrivilege	1804	svchost.exe
Token: SeRestorePrivilege	1804	svchost.exe
Token: SeBackupPrivilege	4612	svchost.exe
Token: SeRestorePrivilege	4612	svchost.exe
Token: SeBackupPrivilege	4612	svchost.exe
Token: SeBackupPrivilege	4612	svchost.exe
Token: SeSecurityPrivilege	4612	svchost.exe
Token: SeSecurityPrivilege	4612	svchost.exe
Token: SeBackupPrivilege	4612	svchost.exe
Token: SeBackupPrivilege	4612	svchost.exe
Token: SeSecurityPrivilege	4612	svchost.exe
Token: SeBackupPrivilege	4612	svchost.exe
Token: SeBackupPrivilege	4612	svchost.exe
Token: SeSecurityPrivilege	4612	svchost.exe
Token: SeBackupPrivilege	4612	svchost.exe
Token: SeRestorePrivilege	4612	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3636 wrote to memory of 1240	3636	JaffaCakes118_3e3c6096674b01d8ac7bb09ced93adc5.exe	83
PID 3636 wrote to memory of 1240	3636	JaffaCakes118_3e3c6096674b01d8ac7bb09ced93adc5.exe	83
PID 3636 wrote to memory of 1240	3636	JaffaCakes118_3e3c6096674b01d8ac7bb09ced93adc5.exe	83

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3e3c6096674b01d8ac7bb09ced93adc5.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3e3c6096674b01d8ac7bb09ced93adc5.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3636
- \??\c:\users\admin\appdata\local\lqqpisrgpw
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3e3c6096674b01d8ac7bb09ced93adc5.exe" a -sc:\users\admin\appdata\local\temp\jaffacakes118_3e3c6096674b01d8ac7bb09ced93adc5.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1240

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 788
  2⤵
  - Program crash
  PID:2452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3800 -ip 3800
1⤵
PID:2252

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1804
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 1080
  2⤵
  - Program crash
  PID:2372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1804 -ip 1804
1⤵
PID:3908

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4612
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 1052
  2⤵
  - Program crash
  PID:3460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4612 -ip 4612
1⤵
PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\lqqpisrgpw

Filesize
20.4MB

MD5
a245154ed78363902a8e38db001849b0

SHA1
147e4825029d72df518bbfc1018569f3061913f9

SHA256
822fbc897e38e82a3d4131d1165088a13057e0e5f6b6234441fdaf8732adc534

SHA512
6807dec5360d0e35df783430ddadac7a7a4a25a088627f88a062ea85731175fa4e2ceed6198c52435a1792fd1cc87e29771f682029008437a7fa48312828f965

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
202B

MD5
a863a23a35a40b76d4bda33c1f83ed7b

SHA1
1b0230344496db2d009500d7280f06332bed35ec

SHA256
ae8a08852e7305124001a78c226340ee9709fd0e327386912aec25fb83fb0fdb

SHA512
af2562d0e9e48bfe21cd5a768383585195e112263e1ad907ed8c962ee01043c71ec94588e8681fa8b32d5410b76e158c43f48490e122b7d8c330906d657a7e26

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
303B

MD5
be3333f2ec68854eb766f692320dda00

SHA1
48462cc01e67eef77d2d057c94dcdc3d9cd8d3e1

SHA256
c315aed908635b16b5ea2437aba94bf25f7dcccc43ec4ef6309816616448dda2

SHA512
d0f500a19d4fb7d04a1020b8fc587c82f1ba2317f17991eac7bab7557f7c44f25197c1c4a0c6bb70554e580d1764467405cc574e63f87f04857a86bd648347d6

Download Submit
\??\c:\programdata\application data\storm\update\%sessionname%\klmme.cc3

Filesize
20.1MB

MD5
eaec97cf1fe90dac11bf608286d5442b

SHA1
831d5648d15a9c1c0be77865583f84af2f7ce10f

SHA256
5b583ee679331f750dd474a78cc62ab70d909feb2e2619b534149f2adf5c52d8

SHA512
dd0e67a5bc35622879ea03cb0a9cf629376db3b8cd0096e94be4b922faa498758428ffa64948192e78cfb6bc01d7aed14834b87f4c4c3c3fb33e09b985ba2d06

Download Submit
memory/1240-17-0x0000000000400000-0x000000000044E27C-memory.dmp

Filesize
312KB

Download
memory/1240-10-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1240-9-0x0000000000400000-0x000000000044E27C-memory.dmp

Filesize
312KB

Download
memory/1804-25-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/1804-22-0x00000000011E0000-0x00000000011E1000-memory.dmp

Filesize
4KB

Download
memory/3636-12-0x0000000000400000-0x000000000044E27C-memory.dmp

Filesize
312KB

Download
memory/3636-0-0x0000000000400000-0x000000000044E27C-memory.dmp

Filesize
312KB

Download
memory/3636-2-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/3800-18-0x0000000001E40000-0x0000000001E41000-memory.dmp

Filesize
4KB

Download
memory/3800-20-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/4612-27-0x00000000017E0000-0x00000000017E1000-memory.dmp

Filesize
4KB

Download
memory/4612-30-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download