gh0strat | d470f1478bb30da81214d07d734f518b41cb94175126235a71a18711d5eb65b1

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-01-2025 10:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_49d79e5755b7e017171b88114e96dff4.exe
Size

251KB
MD5

49d79e5755b7e017171b88114e96dff4
SHA1

83c0ca7c3818703f37fde49b30ad74d48576d6cd
SHA256

d470f1478bb30da81214d07d734f518b41cb94175126235a71a18711d5eb65b1
SHA512

97cef2851ffa95272e9a4227cf7b19d6005e31d6de04be34bf306c70278167b4a9584738e34f7516183443c2a83895df6ff07a7a7ff1d1142afcb90cd3b2ea1c
SSDEEP

3072:vlrH2jK+6lRdC9JoXMsJEYQJvMnTST/Okcw3QEe5dx7KFFh:vUK+6lvCUXqY2UT6Kwg95Gl

Score

10^/10

gh0strat discovery rat

Malware Config

Signatures

Gh0st RAT payload 5 IoCs

resource	yara_rule
behavioral1/memory/3020-0-0x0000000000400000-0x0000000000440000-memory.dmp	family_gh0strat
behavioral1/memory/3020-4-0x0000000000400000-0x0000000000440000-memory.dmp	family_gh0strat
behavioral1/files/0x0009000000016d36-5.dat	family_gh0strat
behavioral1/memory/2376-7-0x0000000010000000-0x0000000010024000-memory.dmp	family_gh0strat
behavioral1/memory/2376-8-0x0000000010000000-0x0000000010024000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Deletes itself 1 IoCs

pid	Process
2376	rundll32.exe

Loads dropped DLL 1 IoCs

pid	Process
2376	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_49d79e5755b7e017171b88114e96dff4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3020	JaffaCakes118_49d79e5755b7e017171b88114e96dff4.exe
3020	JaffaCakes118_49d79e5755b7e017171b88114e96dff4.exe
3020	JaffaCakes118_49d79e5755b7e017171b88114e96dff4.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe
2376	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2376	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2504	3020	JaffaCakes118_49d79e5755b7e017171b88114e96dff4.exe	30
PID 3020 wrote to memory of 2504	3020	JaffaCakes118_49d79e5755b7e017171b88114e96dff4.exe	30
PID 3020 wrote to memory of 2504	3020	JaffaCakes118_49d79e5755b7e017171b88114e96dff4.exe	30
PID 3020 wrote to memory of 2504	3020	JaffaCakes118_49d79e5755b7e017171b88114e96dff4.exe	30
PID 2504 wrote to memory of 2376	2504	cmd.exe	32
PID 2504 wrote to memory of 2376	2504	cmd.exe	32
PID 2504 wrote to memory of 2376	2504	cmd.exe	32
PID 2504 wrote to memory of 2376	2504	cmd.exe	32
PID 2504 wrote to memory of 2376	2504	cmd.exe	32
PID 2504 wrote to memory of 2376	2504	cmd.exe	32
PID 2504 wrote to memory of 2376	2504	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_49d79e5755b7e017171b88114e96dff4.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_49d79e5755b7e017171b88114e96dff4.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c rundll32.exe C:\Windows\temp\cmss.dat hi
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Windows\temp\cmss.dat hi
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\temp\cmss.dat

Filesize
1.1MB

MD5
b7ab782bc73008f5158d873c6873d2af

SHA1
47b55cef1fba7aa0bb688f28f09de62c42562f91

SHA256
b8e27aa17fcaf7b7388fb8293146ec3ade0beef73a9135eafc53867db4d59b33

SHA512
ff7a7aac6a6f69bc3649ccdad3051fbe2ffd721b1d1387de9b0f7b16a749d25549dc82fd1b69eea208f8173a97e7e6371fedaf905448f03badafe32a8ca122ea

Download Submit
memory/2376-7-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download
memory/2376-8-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download
memory/3020-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3020-4-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download