gh0strat | 6f9c0e5a3b240e1be906540b8eb05f8b811800e3f115d592af13553cd38ab5f2

Analysis

max time kernel
150s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
01/03/2025, 05:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_3701baa7bad5238b077f127902c7c6d7.exe
Size

156KB
MD5

3701baa7bad5238b077f127902c7c6d7
SHA1

76bc86e327138565391e7910de0d0487185de57e
SHA256

6f9c0e5a3b240e1be906540b8eb05f8b811800e3f115d592af13553cd38ab5f2
SHA512

074064f24b0e0450fef32db8ec53d947f298b2d204ac15e2b368e19e758b42c247c6b25586ecbd3ccc28d3ccefbe0d1964cac4ad1d18c2d7708d423e7293acf5
SSDEEP

3072:uo0IpeXWit3BHgqVibRj1U9doMigzLe1a7Lt17haeRriuemHC1L:u1weGEWkibRG9dPigz60F11Vriuex1L

Score

10^/10

gh0strat discovery persistence rat

Malware Config

Signatures

Gh0st RAT payload 3 IoCs

resource	yara_rule
behavioral2/files/0x000c000000023be0-1.dat	family_gh0strat
behavioral2/memory/3312-3-0x0000000010000000-0x000000001001E000-memory.dmp	family_gh0strat
behavioral2/memory/3312-4-0x0000000010000000-0x000000001001E000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\rsnet_\Parameters\ServiceDll = "C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\rsnet.dll"	JaffaCakes118_3701baa7bad5238b077f127902c7c6d7.exe

Deletes itself 1 IoCs

pid	Process
3312	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
3312	svchost.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\rsnet.dll	JaffaCakes118_3701baa7bad5238b077f127902c7c6d7.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo	JaffaCakes118_3701baa7bad5238b077f127902c7c6d7.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_3701baa7bad5238b077f127902c7c6d7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3701baa7bad5238b077f127902c7c6d7.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3701baa7bad5238b077f127902c7c6d7.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2356

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\program files\common files\microsoft shared\msinfo\rsnet.dll

Filesize
105KB

MD5
4ca0cb087d6a38b2cd4c87eab9b7d88e

SHA1
7d15fabcfcb314cb263cee2492623adad0cff25f

SHA256
a1ef7c595d3ee7cdda64fbd25a075e608ac37eeca398fd4e10a4f2beb611c3f9

SHA512
9de6822000bb73e0c1aa9e645e88cbc9f546a1ddc1b8b0709f04e5211786620e77d2facc79822ea043efc25eeb94b05c143939d139b2ef14788fc2529cff910a

Download Submit
memory/3312-3-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/3312-4-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download