gh0strat | a38a2a72aa15db5f17d99667153830c35b35fbf9b784af97872f9f6c2148f8aa

Analysis

max time kernel
94s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28-01-2025 15:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_4c593c700580ea3d1a21b559a62c7c42.exe
Size

95KB
MD5

4c593c700580ea3d1a21b559a62c7c42
SHA1

4c24e8a90611db00deb7b8d59ff41ecaaf377730
SHA256

a38a2a72aa15db5f17d99667153830c35b35fbf9b784af97872f9f6c2148f8aa
SHA512

07965f26bf693d85b46ea92d20ef722525bcc1d008f6e26cffaf386ae8b499b2bcec3af590b8473d12e7df09f5f59a2232e2c921526fef94cb78fb9d524b4e04
SSDEEP

1536:zMFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8pr/ztQrOGS:zeS4jHS8q/3nTzePCwNUh4E9/z2r/S

Score

10^/10

gh0strat discovery rat

Malware Config

Signatures

Gh0st RAT payload 5 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023c9f-14.dat	family_gh0strat
behavioral2/memory/5084-16-0x0000000000400000-0x000000000044E344-memory.dmp	family_gh0strat
behavioral2/memory/1500-19-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral2/memory/844-24-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral2/memory/2640-29-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Deletes itself 1 IoCs

pid	Process
5084	mnykrorhko

Executes dropped EXE 1 IoCs

pid	Process
5084	mnykrorhko

Loads dropped DLL 3 IoCs

pid	Process
1500	svchost.exe
844	svchost.exe
2640	svchost.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\bmfvwvsmki	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\butofyukwe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\bdhincxiky	svchost.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4184	1500	WerFault.exe	91
316	844	WerFault.exe	98
2284	2640	WerFault.exe	102

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mnykrorhko
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_4c593c700580ea3d1a21b559a62c7c42.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5084	mnykrorhko
5084	mnykrorhko

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeRestorePrivilege	5084	mnykrorhko
Token: SeBackupPrivilege	5084	mnykrorhko
Token: SeBackupPrivilege	5084	mnykrorhko
Token: SeRestorePrivilege	5084	mnykrorhko
Token: SeBackupPrivilege	1500	svchost.exe
Token: SeRestorePrivilege	1500	svchost.exe
Token: SeBackupPrivilege	1500	svchost.exe
Token: SeBackupPrivilege	1500	svchost.exe
Token: SeSecurityPrivilege	1500	svchost.exe
Token: SeSecurityPrivilege	1500	svchost.exe
Token: SeBackupPrivilege	1500	svchost.exe
Token: SeBackupPrivilege	1500	svchost.exe
Token: SeSecurityPrivilege	1500	svchost.exe
Token: SeBackupPrivilege	1500	svchost.exe
Token: SeBackupPrivilege	1500	svchost.exe
Token: SeSecurityPrivilege	1500	svchost.exe
Token: SeBackupPrivilege	1500	svchost.exe
Token: SeRestorePrivilege	1500	svchost.exe
Token: SeBackupPrivilege	844	svchost.exe
Token: SeRestorePrivilege	844	svchost.exe
Token: SeBackupPrivilege	844	svchost.exe
Token: SeBackupPrivilege	844	svchost.exe
Token: SeSecurityPrivilege	844	svchost.exe
Token: SeSecurityPrivilege	844	svchost.exe
Token: SeBackupPrivilege	844	svchost.exe
Token: SeBackupPrivilege	844	svchost.exe
Token: SeSecurityPrivilege	844	svchost.exe
Token: SeBackupPrivilege	844	svchost.exe
Token: SeBackupPrivilege	844	svchost.exe
Token: SeSecurityPrivilege	844	svchost.exe
Token: SeBackupPrivilege	844	svchost.exe
Token: SeRestorePrivilege	844	svchost.exe
Token: SeBackupPrivilege	2640	svchost.exe
Token: SeRestorePrivilege	2640	svchost.exe
Token: SeBackupPrivilege	2640	svchost.exe
Token: SeBackupPrivilege	2640	svchost.exe
Token: SeSecurityPrivilege	2640	svchost.exe
Token: SeSecurityPrivilege	2640	svchost.exe
Token: SeBackupPrivilege	2640	svchost.exe
Token: SeBackupPrivilege	2640	svchost.exe
Token: SeSecurityPrivilege	2640	svchost.exe
Token: SeBackupPrivilege	2640	svchost.exe
Token: SeBackupPrivilege	2640	svchost.exe
Token: SeSecurityPrivilege	2640	svchost.exe
Token: SeBackupPrivilege	2640	svchost.exe
Token: SeRestorePrivilege	2640	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 5084	2804	JaffaCakes118_4c593c700580ea3d1a21b559a62c7c42.exe	83
PID 2804 wrote to memory of 5084	2804	JaffaCakes118_4c593c700580ea3d1a21b559a62c7c42.exe	83
PID 2804 wrote to memory of 5084	2804	JaffaCakes118_4c593c700580ea3d1a21b559a62c7c42.exe	83

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4c593c700580ea3d1a21b559a62c7c42.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4c593c700580ea3d1a21b559a62c7c42.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2804
- \??\c:\users\admin\appdata\local\mnykrorhko
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4c593c700580ea3d1a21b559a62c7c42.exe" a -sc:\users\admin\appdata\local\temp\jaffacakes118_4c593c700580ea3d1a21b559a62c7c42.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5084

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1500
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 1088
  2⤵
  - Program crash
  PID:4184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1500 -ip 1500
1⤵
PID:1288

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:844
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 844 -s 1092
  2⤵
  - Program crash
  PID:316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 844 -ip 844
1⤵
PID:2348

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 920
  2⤵
  - Program crash
  PID:2284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2640 -ip 2640
1⤵
PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\svchost.exe.txt

Filesize
202B

MD5
4508fb960ee014765ef75e72daec994e

SHA1
3204a2d016dd9f08ede9c9c243c5eec5714c76da

SHA256
7c663fb59241fb01c1be756c1b51f1029cd45ee148001a0f1c6f0e957e8f2e3f

SHA512
f3c03aabee6ea6e1b012acfe22bfc2580b7f9265a901b7351dfc718636f190a51c0e28f3aab43abb076fee112892cf557a04c350ce53d7cead37b099f24c9e04

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
303B

MD5
7839db652ae98ec2f46dffd8f8d5c248

SHA1
8d59ebf640caa4ab29e12b24a29ad00b154e2ebd

SHA256
29bb3b78cb113aae7df001f75900db5826be25f36cc7dd96df5c6ad87bbe5ec0

SHA512
b0aa424da118aa54f34ba4b4f05c366737aff762810e68ef4c542fe6fb678c3d1bd41e5d35424a17d97689c91892e2e3be4883e0a47fc1aa2544837734b35f62

Download Submit
\??\c:\programdata\application data\storm\update\%sessionname%\ufyrq.cc3

Filesize
20.1MB

MD5
4ca098474f0b42141d43bd75408f872b

SHA1
4221ba85e17d58bbc43a27dafff33d29207c5613

SHA256
d0d29cc15b6042e9ee2213f38709714482fce6f3fb7bf5894469ecb33ea1a747

SHA512
c40d6bfacec9bcb591674b64d301cb501f7247bcee67e88900212dbe9b43c717d741507f2cb70732ce26578fe7dd7564232c98c5a98a74386eb08449b78e7026

Download Submit
\??\c:\users\admin\appdata\local\mnykrorhko

Filesize
23.0MB

MD5
05162d99d42af843bd4942f4baf89433

SHA1
38e8f0fa6fdf58e59ee1afeeaa2a1f56549a702e

SHA256
f884075a2e7f46af7dc7c382ca1d34f59bde57bef781c1f9ca9bc25bc0a50927

SHA512
e4e0c80d0548750db5486e0a5816cef4f2587dc4b0e5c00ea2efcf344ee50e40b5d594996e8d74f7b18aba7742481a214c811604d74adb61bee5300d064a0448

Download Submit
memory/844-24-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/844-21-0x00000000013D0000-0x00000000013D1000-memory.dmp

Filesize
4KB

Download
memory/1500-19-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/1500-17-0x0000000001580000-0x0000000001581000-memory.dmp

Filesize
4KB

Download
memory/2640-29-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/2640-26-0x0000000001A80000-0x0000000001A81000-memory.dmp

Filesize
4KB

Download
memory/2804-0-0x0000000000400000-0x000000000044E344-memory.dmp

Filesize
312KB

Download
memory/2804-10-0x0000000000400000-0x000000000044E344-memory.dmp

Filesize
312KB

Download
memory/2804-2-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/5084-11-0x0000000000400000-0x000000000044E344-memory.dmp

Filesize
312KB

Download
memory/5084-16-0x0000000000400000-0x000000000044E344-memory.dmp

Filesize
312KB

Download