gh0strat | 51fba53e2918547dac0a7c4f542ca0aec58343a607fad613f2cb749334e86fa9

Analysis

max time kernel
93s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28-01-2025 14:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_4bdc271e491cc879bd8db4913fc9872a.exe
Size

95KB
MD5

4bdc271e491cc879bd8db4913fc9872a
SHA1

c2c56565c9c1bc2e39407d5da4987c275fe7d5b4
SHA256

51fba53e2918547dac0a7c4f542ca0aec58343a607fad613f2cb749334e86fa9
SHA512

4c4286f6abeda9aa95a484e2b0d8a2bb514fd7e6c5249b20a493075e710ea36caef1dbb9dd079d7100fb1a3b674d3bd991e1501f3d76ea85608d6515d7e8685b
SSDEEP

1536:PrFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prgDxxOrL:PFS4jHS8q/3nTzePCwNUh4E9gDxwrL

Score

10^/10

gh0strat discovery rat

Malware Config

Signatures

Gh0st RAT payload 5 IoCs

resource	yara_rule
behavioral2/files/0x000b000000023b9d-14.dat	family_gh0strat
behavioral2/memory/2972-17-0x0000000000400000-0x000000000044E2FC-memory.dmp	family_gh0strat
behavioral2/memory/3260-20-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral2/memory/2352-25-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral2/memory/4488-30-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Deletes itself 1 IoCs

pid	Process
2972	cfrgkpesnc

Executes dropped EXE 1 IoCs

pid	Process
2972	cfrgkpesnc

Loads dropped DLL 3 IoCs

pid	Process
3260	svchost.exe
2352	svchost.exe
4488	svchost.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ckdvinniwg	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\ckdvinniwg	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\csroqqpfjc	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2636	3260	WerFault.exe	85
4932	2352	WerFault.exe	90
1848	4488	WerFault.exe	94

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_4bdc271e491cc879bd8db4913fc9872a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cfrgkpesnc
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2972	cfrgkpesnc
2972	cfrgkpesnc

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeRestorePrivilege	2972	cfrgkpesnc
Token: SeBackupPrivilege	2972	cfrgkpesnc
Token: SeBackupPrivilege	2972	cfrgkpesnc
Token: SeRestorePrivilege	2972	cfrgkpesnc
Token: SeBackupPrivilege	3260	svchost.exe
Token: SeRestorePrivilege	3260	svchost.exe
Token: SeBackupPrivilege	3260	svchost.exe
Token: SeBackupPrivilege	3260	svchost.exe
Token: SeSecurityPrivilege	3260	svchost.exe
Token: SeSecurityPrivilege	3260	svchost.exe
Token: SeBackupPrivilege	3260	svchost.exe
Token: SeBackupPrivilege	3260	svchost.exe
Token: SeSecurityPrivilege	3260	svchost.exe
Token: SeBackupPrivilege	3260	svchost.exe
Token: SeBackupPrivilege	3260	svchost.exe
Token: SeSecurityPrivilege	3260	svchost.exe
Token: SeBackupPrivilege	3260	svchost.exe
Token: SeRestorePrivilege	3260	svchost.exe
Token: SeBackupPrivilege	2352	svchost.exe
Token: SeRestorePrivilege	2352	svchost.exe
Token: SeBackupPrivilege	2352	svchost.exe
Token: SeBackupPrivilege	2352	svchost.exe
Token: SeSecurityPrivilege	2352	svchost.exe
Token: SeSecurityPrivilege	2352	svchost.exe
Token: SeBackupPrivilege	2352	svchost.exe
Token: SeBackupPrivilege	2352	svchost.exe
Token: SeSecurityPrivilege	2352	svchost.exe
Token: SeBackupPrivilege	2352	svchost.exe
Token: SeBackupPrivilege	2352	svchost.exe
Token: SeSecurityPrivilege	2352	svchost.exe
Token: SeBackupPrivilege	2352	svchost.exe
Token: SeRestorePrivilege	2352	svchost.exe
Token: SeBackupPrivilege	4488	svchost.exe
Token: SeRestorePrivilege	4488	svchost.exe
Token: SeBackupPrivilege	4488	svchost.exe
Token: SeBackupPrivilege	4488	svchost.exe
Token: SeSecurityPrivilege	4488	svchost.exe
Token: SeSecurityPrivilege	4488	svchost.exe
Token: SeBackupPrivilege	4488	svchost.exe
Token: SeBackupPrivilege	4488	svchost.exe
Token: SeSecurityPrivilege	4488	svchost.exe
Token: SeBackupPrivilege	4488	svchost.exe
Token: SeBackupPrivilege	4488	svchost.exe
Token: SeSecurityPrivilege	4488	svchost.exe
Token: SeBackupPrivilege	4488	svchost.exe
Token: SeRestorePrivilege	4488	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3904 wrote to memory of 2972	3904	JaffaCakes118_4bdc271e491cc879bd8db4913fc9872a.exe	83
PID 3904 wrote to memory of 2972	3904	JaffaCakes118_4bdc271e491cc879bd8db4913fc9872a.exe	83
PID 3904 wrote to memory of 2972	3904	JaffaCakes118_4bdc271e491cc879bd8db4913fc9872a.exe	83

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4bdc271e491cc879bd8db4913fc9872a.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4bdc271e491cc879bd8db4913fc9872a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3904
- \??\c:\users\admin\appdata\local\cfrgkpesnc
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4bdc271e491cc879bd8db4913fc9872a.exe" a -sc:\users\admin\appdata\local\temp\jaffacakes118_4bdc271e491cc879bd8db4913fc9872a.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2972

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3260
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3260 -s 808
  2⤵
  - Program crash
  PID:2636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3260 -ip 3260
1⤵
PID:1032

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2352
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 1100
  2⤵
  - Program crash
  PID:4932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2352 -ip 2352
1⤵
PID:548

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4488
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 1104
  2⤵
  - Program crash
  PID:1848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4488 -ip 4488
1⤵
PID:2216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\cfrgkpesnc

Filesize
20.8MB

MD5
5d3fe7bb0fc40353691e729cd8b7046d

SHA1
a0a4e296d5730229c28166c80aab88ac310170df

SHA256
dcccc3d1d6a23e823ea8fab0c38f43067a4c67e5c76b772baf92450d4a02d0e4

SHA512
9364a70907866ecce7f3d924fe3f78db11c8939696f7dd515f513fed9951ed50296d83b82ee3f6c5965991127e796a02156c32884f9020b95c61ebd2d1fc86db

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
202B

MD5
617f2a51c1ea2c3604fe351ac736a7f0

SHA1
3c58ed7f41cb84e7397cd2c7d41cb0c78e10c37c

SHA256
3c99a64ef8da43e646d4d19b45af3445fbd2b609d78a635aea0eefa15219f611

SHA512
9351537d24e74b78077766b500f7d19d3e987920423a80f7f151a35bc969e783fb585ebecc3d20afd325d6cb223abd70c8cfccb2cf90b9c7b1031409f8ef2460

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
303B

MD5
0533913d58c796ff67679f02e5df4430

SHA1
904c07730620879cb194e1ea287474dca33ff5a3

SHA256
390afb14bd2cde700fae417a66b137d27faf4539552698fad6517bb3a208c448

SHA512
9263bf42186a08a73bdd6f1c8e8619741183c2a2f549e48463dc0cc244589926cfe1517e49ac17af56f96779a0cda1a3a46de1cebd8a53cef2e4eac87c7f0af6

Download Submit
\??\c:\programdata\application data\storm\update\%sessionname%\mgxdw.cc3

Filesize
19.1MB

MD5
3a5ea341e783d7c19102d338daeded00

SHA1
0aafe1571dc4d4ded1a5e58066ebcec9800cf3f0

SHA256
b588a4d397ec016916902f83e157e696c23412397da2635cd1e53e5e99d95d76

SHA512
1260a0a12ce8348dcc5ae05424465d1585c28e8cd42d5be3ae02a8532914edba7b99c8bc7e518b024c8ef39c0de0192a243dc1c645c865c71e3d1865dd4db71c

Download Submit
memory/2352-25-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/2352-22-0x00000000014A0000-0x00000000014A1000-memory.dmp

Filesize
4KB

Download
memory/2972-11-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/2972-17-0x0000000000400000-0x000000000044E2FC-memory.dmp

Filesize
312KB

Download
memory/2972-8-0x0000000000400000-0x000000000044E2FC-memory.dmp

Filesize
312KB

Download
memory/3260-18-0x0000000000FD0000-0x0000000000FD1000-memory.dmp

Filesize
4KB

Download
memory/3260-20-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/3904-7-0x0000000000400000-0x000000000044E2FC-memory.dmp

Filesize
312KB

Download
memory/3904-0-0x0000000000400000-0x000000000044E2FC-memory.dmp

Filesize
312KB

Download
memory/3904-2-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/4488-27-0x0000000001890000-0x0000000001891000-memory.dmp

Filesize
4KB

Download
memory/4488-30-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download