gh0strat | c96bfc649217a0fb2eaece236045811f90541e1bdc51ccfea6ef36ae8815189c

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-01-2025 02:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_45ba6caa5572a6225389c43211a86dde.exe
Size

162KB
MD5

45ba6caa5572a6225389c43211a86dde
SHA1

b879389549fbf78805e08ece748a2ce1fb9fc138
SHA256

c96bfc649217a0fb2eaece236045811f90541e1bdc51ccfea6ef36ae8815189c
SHA512

16523074eb23d52584390d3951c0e964f58396be94473d496c99622eed25d6c151843efdc99b4573b363b6c40e7e756b94b44f92c52da5e1a693343958d19d4c
SSDEEP

3072:Qlwm0GXFhSlRWyyP9OUmoWOQ7XO1nD9qeUR91cNKcqyWd9civlt58/iSn5:QlGRW59OtoWOQ7+pRKpc0Drdzvlt58/l

Score

10^/10

gh0strat discovery persistence rat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000012118-7.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Boot or Logon Autostart Execution: Active Setup 2 TTPs 3 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{egofpspj-kzaz-ehgx-knka-kcljualubafv}	userinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{egofpspj-kzaz-ehgx-knka-kcljualubafv}\ = "ÏµÍ³ÉèÖÃ"	userinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{egofpspj-kzaz-ehgx-knka-kcljualubafv}\stubpath = "þÿÿÿX"	userinit.exe

Loads dropped DLL 1 IoCs

pid	Process
2844	userinit.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_45ba6caa5572a6225389c43211a86dde.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	userinit.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1628	JaffaCakes118_45ba6caa5572a6225389c43211a86dde.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1628	JaffaCakes118_45ba6caa5572a6225389c43211a86dde.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 2844	1628	JaffaCakes118_45ba6caa5572a6225389c43211a86dde.exe	30
PID 1628 wrote to memory of 2844	1628	JaffaCakes118_45ba6caa5572a6225389c43211a86dde.exe	30
PID 1628 wrote to memory of 2844	1628	JaffaCakes118_45ba6caa5572a6225389c43211a86dde.exe	30
PID 1628 wrote to memory of 2844	1628	JaffaCakes118_45ba6caa5572a6225389c43211a86dde.exe	30
PID 1628 wrote to memory of 2844	1628	JaffaCakes118_45ba6caa5572a6225389c43211a86dde.exe	30
PID 1628 wrote to memory of 2844	1628	JaffaCakes118_45ba6caa5572a6225389c43211a86dde.exe	30
PID 1628 wrote to memory of 2844	1628	JaffaCakes118_45ba6caa5572a6225389c43211a86dde.exe	30
PID 1628 wrote to memory of 2844	1628	JaffaCakes118_45ba6caa5572a6225389c43211a86dde.exe	30

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_45ba6caa5572a6225389c43211a86dde.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_45ba6caa5572a6225389c43211a86dde.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\userinit.exe
  userinit.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\259439350_lang.dll

Filesize
114KB

MD5
90eb059a001679781cbf9d605294c386

SHA1
72ce0eb09ca733b83225879b6d528aed7d3e8389

SHA256
b97e8f3c128b2c1b296e687e7235dea2b0c34f9a3fb9842834a8a2651a7ea626

SHA512
a2a8b98a57b0e5d3a6df21071f91dd5dcd1559960e9f51d1907fa1d7fa89bba8cd75cea19da50720544b2d1b264b8f9fb638acff98ebb1cc38f007441fc4b6e1

Download Submit
memory/1628-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1628-1-0x0000000000020000-0x0000000000033000-memory.dmp

Filesize
76KB

Download
memory/1628-6-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1628-2-0x0000000000020000-0x0000000000033000-memory.dmp

Filesize
76KB

Download
memory/2844-5-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download