gh0strat | 808d7208df6cebd677121c2dd9ed0e322ebc50e885132252dbb49f0a65d9b71f

Analysis

max time kernel
93s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
01/03/2025, 11:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_38b3d5d7debf9de1512e8423940f065e.exe
Size

95KB
MD5

38b3d5d7debf9de1512e8423940f065e
SHA1

48df0dda0b3ec8b69a7f8cbc002142be71838917
SHA256

808d7208df6cebd677121c2dd9ed0e322ebc50e885132252dbb49f0a65d9b71f
SHA512

deae428fbbc8a234c7e70724d25c88d4a334995911d3fbe4ebba6c68f9efca2b0d6a81f6e83ce834663670fe7392103db622261b59042311fc891b7db709532b
SSDEEP

1536:hG0qFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prDX6qlRBlT:hPwS4jHS8q/3nTzePCwNUh4E9DX1zT

Score

10^/10

gh0strat discovery rat

Malware Config

Signatures

Gh0st RAT payload 5 IoCs

resource	yara_rule
behavioral2/files/0x000d000000023b92-15.dat	family_gh0strat
behavioral2/memory/1012-17-0x0000000000400000-0x000000000044C610-memory.dmp	family_gh0strat
behavioral2/memory/3908-20-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral2/memory/3624-25-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral2/memory/1620-30-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Deletes itself 1 IoCs

pid	Process
1012	muhjtjypev

Executes dropped EXE 1 IoCs

pid	Process
1012	muhjtjypev

Loads dropped DLL 3 IoCs

pid	Process
3908	svchost.exe
3624	svchost.exe
1620	svchost.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rbppxmltmt	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\rjndhghyme	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\rrbvpjjway	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
628	3908	WerFault.exe	96
4536	3624	WerFault.exe	101
1460	1620	WerFault.exe	104

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_38b3d5d7debf9de1512e8423940f065e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	muhjtjypev

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1012	muhjtjypev
1012	muhjtjypev

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeRestorePrivilege	1012	muhjtjypev
Token: SeBackupPrivilege	1012	muhjtjypev
Token: SeBackupPrivilege	1012	muhjtjypev
Token: SeRestorePrivilege	1012	muhjtjypev
Token: SeBackupPrivilege	3908	svchost.exe
Token: SeRestorePrivilege	3908	svchost.exe
Token: SeBackupPrivilege	3908	svchost.exe
Token: SeBackupPrivilege	3908	svchost.exe
Token: SeSecurityPrivilege	3908	svchost.exe
Token: SeSecurityPrivilege	3908	svchost.exe
Token: SeBackupPrivilege	3908	svchost.exe
Token: SeBackupPrivilege	3908	svchost.exe
Token: SeSecurityPrivilege	3908	svchost.exe
Token: SeBackupPrivilege	3908	svchost.exe
Token: SeBackupPrivilege	3908	svchost.exe
Token: SeSecurityPrivilege	3908	svchost.exe
Token: SeBackupPrivilege	3908	svchost.exe
Token: SeRestorePrivilege	3908	svchost.exe
Token: SeBackupPrivilege	3624	svchost.exe
Token: SeRestorePrivilege	3624	svchost.exe
Token: SeBackupPrivilege	3624	svchost.exe
Token: SeBackupPrivilege	3624	svchost.exe
Token: SeSecurityPrivilege	3624	svchost.exe
Token: SeSecurityPrivilege	3624	svchost.exe
Token: SeBackupPrivilege	3624	svchost.exe
Token: SeBackupPrivilege	3624	svchost.exe
Token: SeSecurityPrivilege	3624	svchost.exe
Token: SeBackupPrivilege	3624	svchost.exe
Token: SeBackupPrivilege	3624	svchost.exe
Token: SeSecurityPrivilege	3624	svchost.exe
Token: SeBackupPrivilege	3624	svchost.exe
Token: SeRestorePrivilege	3624	svchost.exe
Token: SeBackupPrivilege	1620	svchost.exe
Token: SeRestorePrivilege	1620	svchost.exe
Token: SeBackupPrivilege	1620	svchost.exe
Token: SeBackupPrivilege	1620	svchost.exe
Token: SeSecurityPrivilege	1620	svchost.exe
Token: SeSecurityPrivilege	1620	svchost.exe
Token: SeBackupPrivilege	1620	svchost.exe
Token: SeBackupPrivilege	1620	svchost.exe
Token: SeSecurityPrivilege	1620	svchost.exe
Token: SeBackupPrivilege	1620	svchost.exe
Token: SeBackupPrivilege	1620	svchost.exe
Token: SeSecurityPrivilege	1620	svchost.exe
Token: SeBackupPrivilege	1620	svchost.exe
Token: SeRestorePrivilege	1620	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 1012	2188	JaffaCakes118_38b3d5d7debf9de1512e8423940f065e.exe	91
PID 2188 wrote to memory of 1012	2188	JaffaCakes118_38b3d5d7debf9de1512e8423940f065e.exe	91
PID 2188 wrote to memory of 1012	2188	JaffaCakes118_38b3d5d7debf9de1512e8423940f065e.exe	91

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_38b3d5d7debf9de1512e8423940f065e.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_38b3d5d7debf9de1512e8423940f065e.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2188
- \??\c:\users\admin\appdata\local\muhjtjypev
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_38b3d5d7debf9de1512e8423940f065e.exe" a -sc:\users\admin\appdata\local\temp\jaffacakes118_38b3d5d7debf9de1512e8423940f065e.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1012

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 1080
  2⤵
  - Program crash
  PID:628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3908 -ip 3908
1⤵
PID:900

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3624
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3624 -s 1048
  2⤵
  - Program crash
  PID:4536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3624 -ip 3624
1⤵
PID:2260

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 1100
  2⤵
  - Program crash
  PID:1460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1620 -ip 1620
1⤵
PID:1352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\muhjtjypev

Filesize
23.6MB

MD5
d6366061d41e97ea8f207e623eae2aac

SHA1
79ad0f42cbaa2209d32824c1d160d847b48eb14d

SHA256
30b3f189c31824a1045231bcb8e4553be7bd815e5bb6f3852d68cf121d5ec095

SHA512
b2201def0632b346cf6e43a434dff6a2664443ee3897682fc93d8b557d34ba95b7314210a135f9e2ab95f578b6653e9ebac38a08b684c34ddd7aa12aa27a8ffb

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
202B

MD5
89a1142664652ad63e0b71b775ca0f23

SHA1
e725712468381186eb059fceae135209cb820975

SHA256
a56cb60ea9a52e45236b95bf87978efc363299b1dd2bd0c5831247f854e1e99b

SHA512
216e6819e6eab1cf48ee258e301b1e869fbc05c6887f4a0ed38a5fcfcbe17b322b57c672f5f2fc3a54f0b853ed1f68fc430571805f38bb2daf839a68efeca010

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
303B

MD5
0e0f4cb18594227bfe8e1d75d52ecf65

SHA1
7cf8f888a3bacc412bf6c824c581725009c267ff

SHA256
195b2141ac64990e0199157734f1ed85a2026c86d112b0a3a05367649708a0ef

SHA512
1759ba6b201d1bd241ed93e12b196d0da5aada94654bb5ebbbc2807ba07b066ee74ec7aaf4d85af6a9d4f18e9287dacf0a983e79da06d84a5d6303bfafbb098f

Download Submit
\??\c:\programdata\application data\storm\update\%sessionname%\kmxvf.cc3

Filesize
24.1MB

MD5
b8ab18ba61a9d0ff724f83b8f36ef5b3

SHA1
91c339b6931e7370afbaead5d79e5b9225d14a95

SHA256
31994b0e9b74df17cd958514a01565741f8cc1940856022effd3ce1f97165638

SHA512
e2ea706bce0300e89ab5c4ccaa03fa29213eda90af9ef3c32179a7dc0cc6d5583b918c7e1f36f6668de33a37dab144c1f08002671439103678368a012cb08d58

Download Submit
memory/1012-9-0x0000000000400000-0x000000000044C610-memory.dmp

Filesize
305KB

Download
memory/1012-12-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1012-17-0x0000000000400000-0x000000000044C610-memory.dmp

Filesize
305KB

Download
memory/1620-30-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/1620-27-0x0000000001BE0000-0x0000000001BE1000-memory.dmp

Filesize
4KB

Download
memory/2188-0-0x0000000000400000-0x000000000044C610-memory.dmp

Filesize
305KB

Download
memory/2188-2-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/2188-7-0x0000000000400000-0x000000000044C610-memory.dmp

Filesize
305KB

Download
memory/3624-25-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/3624-22-0x00000000015F0000-0x00000000015F1000-memory.dmp

Filesize
4KB

Download
memory/3908-20-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/3908-18-0x0000000001800000-0x0000000001801000-memory.dmp

Filesize
4KB

Download