gh0strat | 7916bc3da53236edb952565d17992a0f0c7dce9768ce3f34da20305e2cec22e0

Analysis

max time kernel
150s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2025 08:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_54cb5a87217060c68247c8126baf1716.exe
Size

121KB
MD5

54cb5a87217060c68247c8126baf1716
SHA1

b951fff281a71ddceb9c8d9e8259c6755b444dd9
SHA256

7916bc3da53236edb952565d17992a0f0c7dce9768ce3f34da20305e2cec22e0
SHA512

8347aeafe2f24eab9de4a88ee286485021049b9ebd0e13683b21423cbcc84d12aeda9ec6fe3e0ea0d42dabe047a61be4c115451947509aa4498b8f574e01c070
SSDEEP

3072:AuHc+BZ8zr6pdTHogka9dZZpgci7sOf/LlCnAUJv6Pkb:AEc+L8zr0RHogtJ+9/xGJv1

Score

10^/10

gh0strat discovery persistence rat

Malware Config

Signatures

Gh0st RAT payload 5 IoCs

resource	yara_rule
behavioral2/memory/3064-0-0x0000000000400000-0x0000000000420000-memory.dmp	family_gh0strat
behavioral2/files/0x000a000000023c69-3.dat	family_gh0strat
behavioral2/memory/3064-4-0x0000000000400000-0x0000000000420000-memory.dmp	family_gh0strat
behavioral2/memory/2788-6-0x0000000010000000-0x000000001001D000-memory.dmp	family_gh0strat
behavioral2/memory/2788-7-0x0000000010000000-0x000000001001D000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NETSVCS_0x0\Parameters\ServiceDll = "C:\\Documents and Settings\\Local User\\edrddd.dll"	JaffaCakes118_54cb5a87217060c68247c8126baf1716.exe

Deletes itself 1 IoCs

pid	Process
2788	SVCHOST.EXE

Loads dropped DLL 1 IoCs

pid	Process
2788	SVCHOST.EXE

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_54cb5a87217060c68247c8126baf1716.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SVCHOST.EXE

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_54cb5a87217060c68247c8126baf1716.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_54cb5a87217060c68247c8126baf1716.exe"
1⤵
- Server Software Component: Terminal Services DLL
- System Location Discovery: System Language Discovery
PID:3064

C:\Windows\SysWOW64\SVCHOST.EXE
C:\Windows\SysWOW64\SVCHOST.EXE -K NETSVCS
1⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\documents and settings\local user\edrddd.dll

Filesize
105KB

MD5
f525301f13c4935e899b077d1d63b12e

SHA1
1805d998284364c451f96d0a41129ba26681e2ea

SHA256
8ee52ca31e89c2749f20d3fc680769b2a11e6afd738b09dfc59d247efd9c58af

SHA512
7f6c368d203128888162ce6d82fdf24846507e7bc16199f2be4cd90ebc2dd03c469532c1ec98510bb4a7e82277604be8731064bbd1f23db9ef795e2df6069744

Download Submit
memory/2788-6-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download
memory/2788-7-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download
memory/3064-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3064-4-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download