gh0strat | eb089ca97bfb5884a2aba4f8a6377e4004c26129a58b7ba9d2469cdc31de4cf9

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
28-01-2025 07:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_484b17c7166d3221647faf55d67fbd9f.exe
Size

151KB
MD5

484b17c7166d3221647faf55d67fbd9f
SHA1

3bef6184c8a8e731560485cfdd5187beadbf6cf3
SHA256

eb089ca97bfb5884a2aba4f8a6377e4004c26129a58b7ba9d2469cdc31de4cf9
SHA512

83466a321371069e543319e756d1d069efa6dda0ac89218615556e1389cbd03d3cd691d1a877a2911e4c8a5582cd4cd0807192a190798d23222e78f0e21dbc5c
SSDEEP

3072:QS3i7RVEnOs5eP6hKRXuS6S9L3e2ta2OMdj3Ksx9e8o+x:QSgVEnOs5eyhZK973aodj6s3x

Score

10^/10

gh0strat discovery persistence rat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000015d79-1.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\360svc\Parameters\ServiceDll = "C:\\Documents and Settings\\Local User\\VQQTrace.dll"	JaffaCakes118_484b17c7166d3221647faf55d67fbd9f.exe

Deletes itself 1 IoCs

pid	Process
2460	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
2460	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_484b17c7166d3221647faf55d67fbd9f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
848	JaffaCakes118_484b17c7166d3221647faf55d67fbd9f.exe
848	JaffaCakes118_484b17c7166d3221647faf55d67fbd9f.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_484b17c7166d3221647faf55d67fbd9f.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_484b17c7166d3221647faf55d67fbd9f.exe"
1⤵
- Server Software Component: Terminal Services DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:848

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\documents and settings\local user\vqqtrace.dll

Filesize
111KB

MD5
137b6dd8f9691cc86039d10ca9955400

SHA1
61d2999786fb76a4ec4814327dc129026892ece8

SHA256
be37d2595d839214c27b9874ebf381c25751a974c14e235d10b0e1a012b41956

SHA512
62ed7522572676c4ecd791644ff8da7eea9339e2f6b9f875fbb74bbf895e441bc2a4c07f853ed031c93fdd2190c4d938a76e2411698e3847ccdef79a536e41e6

Download Submit