gh0strat | 814249cc02eb6f7501cb41a070c60e1546472dc9b3b39ea69794f6435ab303a4

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27-01-2025 12:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_3fa3f1400f551f4cf1b3f81273000a63.exe
Size

192KB
MD5

3fa3f1400f551f4cf1b3f81273000a63
SHA1

e79b7e390c9fd3cf6a0d1d9c7bb45efbf4aaa20a
SHA256

814249cc02eb6f7501cb41a070c60e1546472dc9b3b39ea69794f6435ab303a4
SHA512

d764403bb6f91028bc5a8216365e80a7999b7b5eb72ddb00c2ec10f9f25be4928c4d539659621ed00cd61013d7e8931eb69d91c117286afb2af5cac8db5e9256
SSDEEP

3072:JmbXnWKamWjtz/PiDad2Qq9SDxerZaJWRNjZ8S:eXnWKam+iDW2brf/jZ8

Score

10^/10

gh0strat discovery rat

Malware Config

Signatures

Gh0st RAT payload 4 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023c96-5.dat	family_gh0strat
behavioral2/memory/3616-7-0x0000000010000000-0x0000000010028000-memory.dmp	family_gh0strat
behavioral2/memory/4928-10-0x0000000010000000-0x0000000010028000-memory.dmp	family_gh0strat
behavioral2/memory/1864-13-0x0000000010000000-0x0000000010028000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Deletes itself 1 IoCs

pid	Process
3616	svchost.exe

Loads dropped DLL 3 IoCs

pid	Process
3616	svchost.exe
4928	svchost.exe
1864	svchost.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\ajbyswplyi	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\arprbasimd	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\ajbyswplyi	svchost.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\nuxjg\jgmwu.pic	JaffaCakes118_3fa3f1400f551f4cf1b3f81273000a63.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
728	3616	WerFault.exe	84
4704	4928	WerFault.exe	91
1692	1864	WerFault.exe	95

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_3fa3f1400f551f4cf1b3f81273000a63.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeBackupPrivilege	2260	JaffaCakes118_3fa3f1400f551f4cf1b3f81273000a63.exe
Token: SeRestorePrivilege	2260	JaffaCakes118_3fa3f1400f551f4cf1b3f81273000a63.exe
Token: SeBackupPrivilege	2260	JaffaCakes118_3fa3f1400f551f4cf1b3f81273000a63.exe
Token: SeRestorePrivilege	2260	JaffaCakes118_3fa3f1400f551f4cf1b3f81273000a63.exe
Token: SeBackupPrivilege	2260	JaffaCakes118_3fa3f1400f551f4cf1b3f81273000a63.exe
Token: SeRestorePrivilege	2260	JaffaCakes118_3fa3f1400f551f4cf1b3f81273000a63.exe
Token: SeBackupPrivilege	2260	JaffaCakes118_3fa3f1400f551f4cf1b3f81273000a63.exe
Token: SeRestorePrivilege	2260	JaffaCakes118_3fa3f1400f551f4cf1b3f81273000a63.exe
Token: SeBackupPrivilege	3616	svchost.exe
Token: SeRestorePrivilege	3616	svchost.exe
Token: SeBackupPrivilege	3616	svchost.exe
Token: SeBackupPrivilege	3616	svchost.exe
Token: SeSecurityPrivilege	3616	svchost.exe
Token: SeSecurityPrivilege	3616	svchost.exe
Token: SeBackupPrivilege	3616	svchost.exe
Token: SeBackupPrivilege	3616	svchost.exe
Token: SeSecurityPrivilege	3616	svchost.exe
Token: SeBackupPrivilege	3616	svchost.exe
Token: SeBackupPrivilege	3616	svchost.exe
Token: SeSecurityPrivilege	3616	svchost.exe
Token: SeBackupPrivilege	3616	svchost.exe
Token: SeRestorePrivilege	3616	svchost.exe
Token: SeBackupPrivilege	4928	svchost.exe
Token: SeRestorePrivilege	4928	svchost.exe
Token: SeBackupPrivilege	4928	svchost.exe
Token: SeBackupPrivilege	4928	svchost.exe
Token: SeSecurityPrivilege	4928	svchost.exe
Token: SeSecurityPrivilege	4928	svchost.exe
Token: SeBackupPrivilege	4928	svchost.exe
Token: SeBackupPrivilege	4928	svchost.exe
Token: SeSecurityPrivilege	4928	svchost.exe
Token: SeBackupPrivilege	4928	svchost.exe
Token: SeBackupPrivilege	4928	svchost.exe
Token: SeSecurityPrivilege	4928	svchost.exe
Token: SeBackupPrivilege	4928	svchost.exe
Token: SeRestorePrivilege	4928	svchost.exe
Token: SeBackupPrivilege	1864	svchost.exe
Token: SeRestorePrivilege	1864	svchost.exe
Token: SeBackupPrivilege	1864	svchost.exe
Token: SeBackupPrivilege	1864	svchost.exe
Token: SeSecurityPrivilege	1864	svchost.exe
Token: SeSecurityPrivilege	1864	svchost.exe
Token: SeBackupPrivilege	1864	svchost.exe
Token: SeBackupPrivilege	1864	svchost.exe
Token: SeSecurityPrivilege	1864	svchost.exe
Token: SeBackupPrivilege	1864	svchost.exe
Token: SeBackupPrivilege	1864	svchost.exe
Token: SeSecurityPrivilege	1864	svchost.exe
Token: SeBackupPrivilege	1864	svchost.exe
Token: SeRestorePrivilege	1864	svchost.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3fa3f1400f551f4cf1b3f81273000a63.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3fa3f1400f551f4cf1b3f81273000a63.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2260

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Deletes itself
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3616
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3616 -s 1072
  2⤵
  - Program crash
  PID:728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3616 -ip 3616
1⤵
PID:4084

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 1044
  2⤵
  - Program crash
  PID:4704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4928 -ip 4928
1⤵
PID:3656

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1864
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 1056
  2⤵
  - Program crash
  PID:1692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1864 -ip 1864
1⤵
PID:3976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\svchost.exe.txt

Filesize
306B

MD5
4bce18b8fa6b3fe13fb4e043dee201e5

SHA1
5fc0e69ede2c4099b49bdfd2778338f3bb691218

SHA256
d11b1bdcc5e00634cf25b1f882e6f55b6d790adf9325ba5f65857b5fc67185fd

SHA512
610a32eb16e62757a048069cc4eedf55a753dff952e684a7550134980ad2587e24b8442a229b9837c95b6ed63bafe24d9aeba8dc1eb0b7d4b3728dcaec8650e9

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
204B

MD5
e17a887eadb4f2461d4e8e5c93ab7583

SHA1
43425aadcbce1fb0ca2d52f4ce069f90ea65343b

SHA256
4d6d8b1e9777144e391e3bfe06fbdaea208a98186862c46c65e56fd8a6efcbc4

SHA512
ab48e33df739d44fb3441dbd1e8d39008c569f1842d6de3da82e75b311dc24df4d2d09ddfc66641c490cd4e81144ce9103dd6b6310fda83ef6b0930d30abe99c

Download Submit
\??\c:\progra~2\nuxjg\jgmwu.pic

Filesize
1.2MB

MD5
66d0b63ef559af10eb7df9813cd39d8d

SHA1
d7fa590d0b9d0ba4cb86038f2f004365c5ff8abc

SHA256
f6b05d01c0a653087f2f767375c454ae71968b41324e8defa3602281843bf43b

SHA512
12f27d2f4efa8dd0f749df8b025ca9b105435d7816187d05965f331b20523da28ce40305e8e8667ff264773ffb595b0d543a08183264e7276119b7da2652e323

Download Submit
memory/1864-13-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download
memory/3616-7-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download
memory/4928-10-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download