gh0strat | 760a323400890a26e899c024a89cd5866f3b899ce91f4f823e26906753a1e57b

Analysis

max time kernel
150s
max time network
139s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02/03/2025, 00:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_3c8dfe81b4fede2f5706b2f3bc0c6f28.exe
Size

153KB
MD5

3c8dfe81b4fede2f5706b2f3bc0c6f28
SHA1

190fc6da399724cfdb97e333133516d5853d9a59
SHA256

760a323400890a26e899c024a89cd5866f3b899ce91f4f823e26906753a1e57b
SHA512

a144972cdb69b83e906ec4d29fa94fed2dc45c439c30230ddc8f61579b6df8558487cb6a6c80085d2767d871831872528479d91a742926bf06152de20f736a29
SSDEEP

3072:H0qng8JrY6Cggl67+ToVjtLWg+EgzDPo9RD8IGjA8dw8xUF+ycbEX:H0qDJrn1H7LhGU8UF+/E

Score

10^/10

gh0strat discovery persistence rat

Malware Config

Signatures

Gh0st RAT payload 4 IoCs

resource	yara_rule
behavioral1/memory/2196-0-0x0000000000400000-0x0000000000429000-memory.dmp	family_gh0strat
behavioral1/files/0x0007000000012117-2.dat	family_gh0strat
behavioral1/memory/2188-4-0x0000000010000000-0x0000000010026000-memory.dmp	family_gh0strat
behavioral1/memory/2188-5-0x0000000010000000-0x0000000010026000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\dmservers\Parameters\ServiceDll = "C:\\Windows\\system32\\dmservers.dll"	JaffaCakes118_3c8dfe81b4fede2f5706b2f3bc0c6f28.exe

Deletes itself 1 IoCs

pid	Process
2188	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
2188	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dmservers.dll	JaffaCakes118_3c8dfe81b4fede2f5706b2f3bc0c6f28.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3c8dfe81b4fede2f5706b2f3bc0c6f28.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3c8dfe81b4fede2f5706b2f3bc0c6f28.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Drops file in System32 directory
PID:2196

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\dmservers.dll

Filesize
138KB

MD5
e0983516ad5440ff78816bbfe30c4727

SHA1
b529435381b54b11cd38bb2939f382a96baf87d8

SHA256
014979a28ceba7765374c769df87a69a0208043172ce2820cff1e2aadd94277b

SHA512
e984c370727e5e3007ebaa408d547ade44b3cb601a0579da8c1dd32642f7e9d55a5a1ac27a6496ea0dded0d7a64cad90477f05e119f7b3c09bfc063036dd9351

Download Submit
memory/2188-4-0x0000000010000000-0x0000000010026000-memory.dmp

Filesize
152KB

Download
memory/2188-5-0x0000000010000000-0x0000000010026000-memory.dmp

Filesize
152KB

Download
memory/2196-0-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download