gh0strat | 4999fe6aa48881f685dc24d7883007ec661b2b2c88147e7bf4dd0281634cab96

Analysis

max time kernel
92s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28-01-2025 06:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_47bed904c5d80f6d5c94c14454b56018.exe
Size

96KB
MD5

47bed904c5d80f6d5c94c14454b56018
SHA1

f6818e0a15fc5d6162d90adff96094fb231db0ca
SHA256

4999fe6aa48881f685dc24d7883007ec661b2b2c88147e7bf4dd0281634cab96
SHA512

6e3956175eff21ddfe02b823d13b795b5c2ba844b35e5fac4756279295421144aebfa1f3a374d02615c43b31f595302614b06667c9e39f597708933c477b12f5
SSDEEP

1536:SHFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prkdrU0OBSBX:SxS4jHS8q/3nTzePCwNUh4E9kLOBS9

Score

10^/10

gh0strat discovery rat

Malware Config

Signatures

Gh0st RAT payload 5 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023cab-14.dat	family_gh0strat
behavioral2/memory/4812-16-0x0000000000400000-0x000000000044E318-memory.dmp	family_gh0strat
behavioral2/memory/612-19-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral2/memory/1772-24-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral2/memory/3836-29-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Deletes itself 1 IoCs

pid	Process
4812	hlintqtoko

Executes dropped EXE 1 IoCs

pid	Process
4812	hlintqtoko

Loads dropped DLL 3 IoCs

pid	Process
612	svchost.exe
1772	svchost.exe
3836	svchost.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ccqoobybmq	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\ckocxutfma	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\cscugxwdau	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1392	612	WerFault.exe	83
3292	1772	WerFault.exe	87
2364	3836	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_47bed904c5d80f6d5c94c14454b56018.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hlintqtoko
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4812	hlintqtoko
4812	hlintqtoko

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeRestorePrivilege	4812	hlintqtoko
Token: SeBackupPrivilege	4812	hlintqtoko
Token: SeBackupPrivilege	4812	hlintqtoko
Token: SeRestorePrivilege	4812	hlintqtoko
Token: SeBackupPrivilege	612	svchost.exe
Token: SeRestorePrivilege	612	svchost.exe
Token: SeBackupPrivilege	612	svchost.exe
Token: SeBackupPrivilege	612	svchost.exe
Token: SeSecurityPrivilege	612	svchost.exe
Token: SeSecurityPrivilege	612	svchost.exe
Token: SeBackupPrivilege	612	svchost.exe
Token: SeBackupPrivilege	612	svchost.exe
Token: SeSecurityPrivilege	612	svchost.exe
Token: SeBackupPrivilege	612	svchost.exe
Token: SeBackupPrivilege	612	svchost.exe
Token: SeSecurityPrivilege	612	svchost.exe
Token: SeBackupPrivilege	612	svchost.exe
Token: SeRestorePrivilege	612	svchost.exe
Token: SeBackupPrivilege	1772	svchost.exe
Token: SeRestorePrivilege	1772	svchost.exe
Token: SeBackupPrivilege	1772	svchost.exe
Token: SeBackupPrivilege	1772	svchost.exe
Token: SeSecurityPrivilege	1772	svchost.exe
Token: SeSecurityPrivilege	1772	svchost.exe
Token: SeBackupPrivilege	1772	svchost.exe
Token: SeBackupPrivilege	1772	svchost.exe
Token: SeSecurityPrivilege	1772	svchost.exe
Token: SeBackupPrivilege	1772	svchost.exe
Token: SeBackupPrivilege	1772	svchost.exe
Token: SeSecurityPrivilege	1772	svchost.exe
Token: SeBackupPrivilege	1772	svchost.exe
Token: SeRestorePrivilege	1772	svchost.exe
Token: SeBackupPrivilege	3836	svchost.exe
Token: SeRestorePrivilege	3836	svchost.exe
Token: SeBackupPrivilege	3836	svchost.exe
Token: SeBackupPrivilege	3836	svchost.exe
Token: SeSecurityPrivilege	3836	svchost.exe
Token: SeSecurityPrivilege	3836	svchost.exe
Token: SeBackupPrivilege	3836	svchost.exe
Token: SeBackupPrivilege	3836	svchost.exe
Token: SeSecurityPrivilege	3836	svchost.exe
Token: SeBackupPrivilege	3836	svchost.exe
Token: SeBackupPrivilege	3836	svchost.exe
Token: SeSecurityPrivilege	3836	svchost.exe
Token: SeBackupPrivilege	3836	svchost.exe
Token: SeRestorePrivilege	3836	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 4812	2492	JaffaCakes118_47bed904c5d80f6d5c94c14454b56018.exe	82
PID 2492 wrote to memory of 4812	2492	JaffaCakes118_47bed904c5d80f6d5c94c14454b56018.exe	82
PID 2492 wrote to memory of 4812	2492	JaffaCakes118_47bed904c5d80f6d5c94c14454b56018.exe	82

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_47bed904c5d80f6d5c94c14454b56018.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_47bed904c5d80f6d5c94c14454b56018.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2492
- \??\c:\users\admin\appdata\local\hlintqtoko
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_47bed904c5d80f6d5c94c14454b56018.exe" a -sc:\users\admin\appdata\local\temp\jaffacakes118_47bed904c5d80f6d5c94c14454b56018.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4812

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:612
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 612 -s 1092
  2⤵
  - Program crash
  PID:1392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 612 -ip 612
1⤵
PID:4972

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1772 -s 932
  2⤵
  - Program crash
  PID:3292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1772 -ip 1772
1⤵
PID:4976

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3836
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3836 -s 1076
  2⤵
  - Program crash
  PID:2364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3836 -ip 3836
1⤵
PID:320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\hlintqtoko

Filesize
23.8MB

MD5
b16008132e93e5a0d5a18f7c7fc71254

SHA1
58e644fb7050576292bc7c52d2a4f136b8e36678

SHA256
38221288ee9cc413a184a861d32458685f0bb627b8c809e02a843a7face6aa11

SHA512
4a65c4ac33b448e5adfaa7f6c413091175f30a06aee48b85584abc1f144af0b7eb7232b2c903ba3c68255d25f70f2b30555b0185590d964aa0a5ac310e4a8622

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
202B

MD5
8bd9022f8f525366a3eadfd9abf326ea

SHA1
d80c062f0591072864c9bf793a20daaf43c61ea4

SHA256
3db83bf6fed496e959d21aab672f6ab167ca55f997770721dcda736c8cfc90d3

SHA512
b5a3cf22d0d2f150246248aef124fc445b12f7a810dff3303e9519829ebb2c09c451d5ada7b6d561c7c2ba45877dadb270a7e911fc0bbba524a3a9a3464fd425

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
303B

MD5
c56dcaf8a345b647c593e2dc4ebcf0b8

SHA1
de10cca0cddbe9f05690e99461bba6cf924595d4

SHA256
685cb90f2c8e452f6111c8f407ac618aa335c310701f033646d5867dd9c6e2f3

SHA512
ac9fa54a5f3cef90a7ef23bd829691082ef1b4e0da0f0cfec61153591ba0e0ff22cdfb8cd33534ee949f779df3a45bd29afd17666f516e7bec01f3ec838f716d

Download Submit
\??\c:\programdata\application data\storm\update\%sessionname%\xdlsy.cc3

Filesize
22.1MB

MD5
55377304640f844ccc059955fae0995d

SHA1
fd56e8e8add5d373135720275fcc21127279f7c9

SHA256
050b23f44a1e97be885546dc19fb13f719820a54fbab2db14b53772d0fb73916

SHA512
8f648b2e5ac7d52d359f1ee737b85a48ab9794ff00b7600ea2be21488f8741bf9900d155a0f867e81d2dc0fb0dcd2fed66a8f2b4478ac1aaaa702f42cdaa01af

Download Submit
memory/612-19-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/612-17-0x0000000001580000-0x0000000001581000-memory.dmp

Filesize
4KB

Download
memory/1772-24-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/1772-21-0x0000000001700000-0x0000000001701000-memory.dmp

Filesize
4KB

Download
memory/2492-7-0x0000000000400000-0x000000000044E318-memory.dmp

Filesize
312KB

Download
memory/2492-0-0x0000000000400000-0x000000000044E318-memory.dmp

Filesize
312KB

Download
memory/2492-2-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/3836-26-0x00000000015F0000-0x00000000015F1000-memory.dmp

Filesize
4KB

Download
memory/3836-29-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/4812-16-0x0000000000400000-0x000000000044E318-memory.dmp

Filesize
312KB

Download
memory/4812-11-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/4812-8-0x0000000000400000-0x000000000044E318-memory.dmp

Filesize
312KB

Download