Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
27-01-2025 12:34
General
-
Target
JaffaCakes118_3f9d6dcc5ecc15be183c3b3f999bd8d8.exe
-
Size
82KB
-
MD5
3f9d6dcc5ecc15be183c3b3f999bd8d8
-
SHA1
ad8f0bfa542fe20335967fc0ccc20b32524e7a1c
-
SHA256
55088f908115710fad9e9d04efe9eec06ee0a16bca9453b75683f452cbd72114
-
SHA512
4bc5305f63a879cc4003a949f1381cc1c55fbeda97b53453e2651267cc196664f4a5c3623327fa893bc96973d145b9ac8bae7c88f92d81aeb4eb53ae7720eb81
-
SSDEEP
1536:Io48KAfHKom0RK2zuOpfS4BL99L9Rm8hOW7bdQdkA7ZrrAPh:DWeqovR5zuOpfJnL9f5bOdT7ZXi
Malware Config
Signatures
-
Gh0st RAT payload 3 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
Deletes itself 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Drops file in Program Files directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: LoadsDriver 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3f9d6dcc5ecc15be183c3b3f999bd8d8.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3f9d6dcc5ecc15be183c3b3f999bd8d8.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
101KB
MD592ae02dac610f816fb2de1f992e72916
SHA1adbfdcd5f9a227df039da2998f24754cfe03c0c7
SHA256535e1fa0e2a27ba57113908f881cd0baa50b5f38fe9de6ea40fd5bd9b2736f4d
SHA512506dea9755a720c9ef25cbaa6441cb4bd39f05048ea5b8385df68f8aca7969b1f372ad36c988cae6e4a5b7eb508424464367d0dfe9f78afbb1419d84bf64f15f
-
Filesize
99B
MD55c61a951276063c4dfcb686e64f4375f
SHA1b5c083c37a8bc6269c46c2083f2d6bcd10396e50
SHA2564217ff8e727f5c328106ffaa135f6b52fcf3ea65ca6683bc89e77fc75d320f86
SHA512636c20221433399e81810f80b5baef6bb5adba6b722418145cde1830a22590fa28bc65bdf8c5e98c6ef56d7df173eb90244764b76067b2ad2dc3dbb2ebe94839
-
Filesize
5.8MB
MD579244d262f0891d75352050166933424
SHA1807782c78decd0ef224358396ea2b5e19049f289
SHA25659a2fe91961fe27a7c6e86fec58e2924c42dcf7aa2fc0ae728a7799769833ee6
SHA512ac693d02d8a346c2087d91626d157de52ae21b91ff16d5492ecf9abdc24d787435637c37f848eea2f16d2a5063e4ed3890c1f6cc29b83bf2723fc80b9d09ca19
-
Filesize
232KB
-
Filesize
4KB
-
Filesize
232KB
