gh0strat | 9a5344daec90ddea8ba91e6171dec18c38e01bc3689c0927dd972ff00fcc57d9

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2025, 04:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_31ba1aefc69f3bff76e9b06371824a22.exe
Size

102KB
MD5

31ba1aefc69f3bff76e9b06371824a22
SHA1

a622e177e54d352d0553a7b0a9920a28f03131db
SHA256

9a5344daec90ddea8ba91e6171dec18c38e01bc3689c0927dd972ff00fcc57d9
SHA512

e291d360ca3d3b0613e84a96733c836a8ba768d3be4b583677b12ec33a9ca8f75fe0a320ff653b0337233a423d35811ac6d42a27233ba530bd6c8e60a4e15882
SSDEEP

3072:K9betjic/H/iIS/bDrPWi95BU82oKlofTw+qkJJT0:K9beViQH/iIS/b315e8KuLw+pJJ4

Score

10^/10

gh0strat discovery persistence rat

Malware Config

Signatures

Gh0st RAT payload 3 IoCs

resource	yara_rule
behavioral2/memory/3936-0-0x0000000000400000-0x000000000041B000-memory.dmp	family_gh0strat
behavioral2/memory/3936-3-0x0000000000400000-0x000000000041B000-memory.dmp	family_gh0strat
behavioral2/files/0x000c000000023b4b-2.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\HClient\Parameters\ServiceDll = "C:\\Windows\\system32\\server.dll"	JaffaCakes118_31ba1aefc69f3bff76e9b06371824a22.exe

Deletes itself 1 IoCs

pid	Process
4180	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
4180	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\server.dll	JaffaCakes118_31ba1aefc69f3bff76e9b06371824a22.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_31ba1aefc69f3bff76e9b06371824a22.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_31ba1aefc69f3bff76e9b06371824a22.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_31ba1aefc69f3bff76e9b06371824a22.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3936

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\server.dll

Filesize
95KB

MD5
f034cf65e6f3fef58deff708805387b6

SHA1
4fa42ddfda28c1431a92c5efe0f37a856c512b99

SHA256
394ab9b1c1d0f013e07c5fd6bcdeb3df33287b904385bf21743e88bc0fe86c39

SHA512
65d49f18e1f0552b6056d4086a5e49ae64500898ae26bbed299e776937e3577c377e0ab0577bfa72f853f7c70d4a8340a213309146721fec9edc3444281923c0

Download Submit
memory/3936-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3936-3-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download