gh0strat | 0266c61236b0ada15d7b2141555398ebe14c70b2b836bed49e624bbcd7004531

Analysis

max time kernel
126s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
01/03/2025, 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_390de04570dc1151bb6e94b73fffe9b0.exe
Size

91KB
MD5

390de04570dc1151bb6e94b73fffe9b0
SHA1

381829d8086eee00349f885ebd6953ffb5f296d1
SHA256

0266c61236b0ada15d7b2141555398ebe14c70b2b836bed49e624bbcd7004531
SHA512

d0d9297a084e2113a92f812167f2c684c076baeb186e97ece5c6627a21ca67c1744f6f464cb4478201dbd8d2f31b3dc6be052713d58ababf529ffbc15be642ed
SSDEEP

1536:Qxe2q7nxZ785AIdeTRh0XhDq74rGNQF+U5xMPPc0c8HFpHuvSj38BN+x6SAS:Qxeh7ZIdeTRhH7mF+U5xMPE0c8HFln7/

Score

10^/10

gh0strat discovery rat

Malware Config

Signatures

Gh0st RAT payload 9 IoCs

resource	yara_rule
behavioral2/memory/1928-2-0x0000000000400000-0x0000000000465000-memory.dmp	family_gh0strat
behavioral2/memory/1960-8-0x0000000000400000-0x0000000000465000-memory.dmp	family_gh0strat
behavioral2/memory/1928-12-0x0000000000400000-0x0000000000465000-memory.dmp	family_gh0strat
behavioral2/memory/1960-9-0x0000000000400000-0x0000000000465000-memory.dmp	family_gh0strat
behavioral2/files/0x000300000001e725-15.dat	family_gh0strat
behavioral2/memory/1960-17-0x0000000000400000-0x0000000000465000-memory.dmp	family_gh0strat
behavioral2/memory/4312-20-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral2/memory/1640-25-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral2/memory/4840-30-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Deletes itself 1 IoCs

pid	Process
1960	iquhcwlryo

Executes dropped EXE 1 IoCs

pid	Process
1960	iquhcwlryo

Loads dropped DLL 3 IoCs

pid	Process
4312	svchost.exe
1640	svchost.exe
4840	svchost.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\cyofkimgkw	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\chcyslpewr	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\cpqrborckm	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\StormII\%SESSIONNAME%\ilsnk.cc3	iquhcwlryo

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2648	4312	WerFault.exe	93
3356	1640	WerFault.exe	98
3444	4840	WerFault.exe	101

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iquhcwlryo
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_390de04570dc1151bb6e94b73fffe9b0.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1960	iquhcwlryo
1960	iquhcwlryo

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeRestorePrivilege	1960	iquhcwlryo
Token: SeBackupPrivilege	1960	iquhcwlryo
Token: SeBackupPrivilege	1960	iquhcwlryo
Token: SeRestorePrivilege	1960	iquhcwlryo
Token: SeBackupPrivilege	4312	svchost.exe
Token: SeRestorePrivilege	4312	svchost.exe
Token: SeBackupPrivilege	4312	svchost.exe
Token: SeBackupPrivilege	4312	svchost.exe
Token: SeSecurityPrivilege	4312	svchost.exe
Token: SeSecurityPrivilege	4312	svchost.exe
Token: SeBackupPrivilege	4312	svchost.exe
Token: SeBackupPrivilege	4312	svchost.exe
Token: SeSecurityPrivilege	4312	svchost.exe
Token: SeBackupPrivilege	4312	svchost.exe
Token: SeBackupPrivilege	4312	svchost.exe
Token: SeSecurityPrivilege	4312	svchost.exe
Token: SeBackupPrivilege	4312	svchost.exe
Token: SeRestorePrivilege	4312	svchost.exe
Token: SeBackupPrivilege	1640	svchost.exe
Token: SeRestorePrivilege	1640	svchost.exe
Token: SeBackupPrivilege	1640	svchost.exe
Token: SeBackupPrivilege	1640	svchost.exe
Token: SeSecurityPrivilege	1640	svchost.exe
Token: SeSecurityPrivilege	1640	svchost.exe
Token: SeBackupPrivilege	1640	svchost.exe
Token: SeBackupPrivilege	1640	svchost.exe
Token: SeSecurityPrivilege	1640	svchost.exe
Token: SeBackupPrivilege	1640	svchost.exe
Token: SeBackupPrivilege	1640	svchost.exe
Token: SeSecurityPrivilege	1640	svchost.exe
Token: SeBackupPrivilege	1640	svchost.exe
Token: SeRestorePrivilege	1640	svchost.exe
Token: SeBackupPrivilege	4840	svchost.exe
Token: SeRestorePrivilege	4840	svchost.exe
Token: SeBackupPrivilege	4840	svchost.exe
Token: SeBackupPrivilege	4840	svchost.exe
Token: SeSecurityPrivilege	4840	svchost.exe
Token: SeSecurityPrivilege	4840	svchost.exe
Token: SeBackupPrivilege	4840	svchost.exe
Token: SeBackupPrivilege	4840	svchost.exe
Token: SeSecurityPrivilege	4840	svchost.exe
Token: SeBackupPrivilege	4840	svchost.exe
Token: SeBackupPrivilege	4840	svchost.exe
Token: SeSecurityPrivilege	4840	svchost.exe
Token: SeBackupPrivilege	4840	svchost.exe
Token: SeRestorePrivilege	4840	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 1960	1928	JaffaCakes118_390de04570dc1151bb6e94b73fffe9b0.exe	88
PID 1928 wrote to memory of 1960	1928	JaffaCakes118_390de04570dc1151bb6e94b73fffe9b0.exe	88
PID 1928 wrote to memory of 1960	1928	JaffaCakes118_390de04570dc1151bb6e94b73fffe9b0.exe	88

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_390de04570dc1151bb6e94b73fffe9b0.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_390de04570dc1151bb6e94b73fffe9b0.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1928
- \??\c:\users\admin\appdata\local\iquhcwlryo
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_390de04570dc1151bb6e94b73fffe9b0.exe" a -sc:\users\admin\appdata\local\temp\jaffacakes118_390de04570dc1151bb6e94b73fffe9b0.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1960

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4312
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 1080
  2⤵
  - Program crash
  PID:2648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4312 -ip 4312
1⤵
PID:4248

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 1104
  2⤵
  - Program crash
  PID:3356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1640 -ip 1640
1⤵
PID:3532

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4840
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 1020
  2⤵
  - Program crash
  PID:3444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4840 -ip 4840
1⤵
PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\iquhcwlryo

Filesize
24.8MB

MD5
ba6a77b3bfbfb9c98d0f0c03d5abb96f

SHA1
e9955a63f512063b3da9f479f83f3c6165233ef3

SHA256
5954d9ec4624406c1573d961c55745093f917c187b67875d5091daf9a740f704

SHA512
ea075bce4484d8bff0042ea303d94fde97af7f405313591bccc7e15123442947adcef2ec130fd12feb073f899f6a62957708ed0b3ecfc6f1641f131b7d07ee6f

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
200B

MD5
1dbaf7657f324f23f78250ab5bfee44b

SHA1
9426a15ecc3270cf32012c277910159db5ab1b03

SHA256
ddda8c4dad640e00deef56eaa4d98a76c0a00e8b39ae36f2a8cf65cfb1f444a0

SHA512
ecd99bddd97ca516922539b5a307d6f2802c46207ae0ae39740762ccbe6a0034b8249ccfc015219d59f1c09952e1b80b6932f760288d3f52ecf3508c2c74f1c4

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
258B

MD5
4f4b7e79923763ae19ca75eb3ad3d218

SHA1
7589a3b0acf827ce45f7ec9ac4eefc45bea6deec

SHA256
853ad0afeda394cf08c557a05d70ff126a124150330d781623ec2ae16a69d74c

SHA512
b3b9b277c0c5733f29d7188f75dd8c840c2495a96f5cb23ad8cd5768948a19411a82fdd3d81f39580354e7f552d38048bd978f239c6f660ddae0300de3c23516

Download Submit
\??\c:\program files (x86)\stormii\%sessionname%\ilsnk.cc3

Filesize
24.1MB

MD5
e8a8ba8e5038d202dd96c714f2e402c4

SHA1
b9064a71ab901b19529dc88f6576e06ebd1e2278

SHA256
cb0c4e174f0c0502f0dc32d9daaeb91b9835e32fd59bdd553d55b929281e21dc

SHA512
0d60559445cdeb2d941c612186d526d7221b985ec41af38dedfd19b0f987c743b92bec0b8aa946f0e0c4922998d997044f52e903339a2c2e5829076deebb1fea

Download Submit
memory/1640-22-0x0000000001840000-0x0000000001841000-memory.dmp

Filesize
4KB

Download
memory/1640-25-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/1928-1-0x0000000000480000-0x0000000000481000-memory.dmp

Filesize
4KB

Download
memory/1928-2-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/1928-12-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/1928-0-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/1960-9-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/1960-17-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/1960-10-0x00000000004A0000-0x00000000004A1000-memory.dmp

Filesize
4KB

Download
memory/1960-11-0x00000000004A0000-0x00000000004A1000-memory.dmp

Filesize
4KB

Download
memory/1960-8-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/4312-18-0x00000000015D0000-0x00000000015D1000-memory.dmp

Filesize
4KB

Download
memory/4312-20-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/4840-27-0x00000000013F0000-0x00000000013F1000-memory.dmp

Filesize
4KB

Download
memory/4840-30-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download