gh0strat | 8f40b8ada6f8e302cfe5ad346fce51030a51222f4f3531f6909a5bf4ef46c63d

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
02/03/2025, 13:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_409e815d4da4e50bd9138883240675bd.exe
Size

123KB
MD5

409e815d4da4e50bd9138883240675bd
SHA1

fd559b5792ba058067e9d2fa991f608ef30f534a
SHA256

8f40b8ada6f8e302cfe5ad346fce51030a51222f4f3531f6909a5bf4ef46c63d
SHA512

259bc6a08beda5406ae6eb46ebea761e67766b38a63efb0ceae2eed65b09585546900c0bcd7216cf8a860237d209df461d3a671da272f00782a9a1700bcf5a89
SSDEEP

3072:hyLqh2G34W14kXOV33DjOiJLNJMOibU6Lfh+1C:hyLqhr34W1sV33DaewOENLfhT

Score

10^/10

gh0strat discovery rat

Malware Config

Signatures

Gh0st RAT payload 5 IoCs

resource	yara_rule
behavioral1/memory/1796-0-0x0000000000400000-0x0000000000420000-memory.dmp	family_gh0strat
behavioral1/memory/1796-3-0x0000000000400000-0x0000000000420000-memory.dmp	family_gh0strat
behavioral1/files/0x000800000001932a-2.dat	family_gh0strat
behavioral1/memory/1968-5-0x0000000010000000-0x000000001001E000-memory.dmp	family_gh0strat
behavioral1/memory/1968-6-0x0000000010000000-0x000000001001E000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Deletes itself 1 IoCs

pid	Process
1968	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
1968	svchost.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Evroote.dll	JaffaCakes118_409e815d4da4e50bd9138883240675bd.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\plugin_info.ini	JaffaCakes118_409e815d4da4e50bd9138883240675bd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_409e815d4da4e50bd9138883240675bd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1796	JaffaCakes118_409e815d4da4e50bd9138883240675bd.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeBackupPrivilege	1796	JaffaCakes118_409e815d4da4e50bd9138883240675bd.exe
Token: SeRestorePrivilege	1796	JaffaCakes118_409e815d4da4e50bd9138883240675bd.exe
Token: SeBackupPrivilege	1968	svchost.exe
Token: SeRestorePrivilege	1968	svchost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1796	JaffaCakes118_409e815d4da4e50bd9138883240675bd.exe
1796	JaffaCakes118_409e815d4da4e50bd9138883240675bd.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_409e815d4da4e50bd9138883240675bd.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_409e815d4da4e50bd9138883240675bd.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1796

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\program files (x86)\evroote.dll

Filesize
106KB

MD5
d3f701db8a36bc7bd3993b2b4c19b1d5

SHA1
174d7bac73874e6db7e02f52d682f83e1229a25f

SHA256
ac9b8d60d225de30a89a9af0377c5abb8c0596cee90760de7f98f399cb2a968a

SHA512
2ef3169b3e5497c9b44c1d0729a729ff82d5fcbfd909190e693cac1c6203ac07ddd7524b9e6f2d2624258c27b0acc2d2a0683bfdcd52166016a3836ab75dfe56

Download Submit
memory/1796-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1796-3-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1968-5-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/1968-6-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download