gh0strat | f200987752822d917a189d55f81cc3d6d6cde94ae303eb893cae02d5c3c797d6

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
03/03/2025, 21:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_4952ffc9a6369cede2dca5be8b5041b1.exe
Size

77KB
MD5

4952ffc9a6369cede2dca5be8b5041b1
SHA1

faaae5347150ba386f53a64f1fffcb345a66043f
SHA256

f200987752822d917a189d55f81cc3d6d6cde94ae303eb893cae02d5c3c797d6
SHA512

3961265413af46226efe9f97967e9d7fc024986375e0282386608e39a35a3766016ae19276abb5c309deea36f98bcf27998b3b8c2ca18f0be5cb9d2d534c8aa6
SSDEEP

1536:ZlzSYoGCDNyXG+otLjbjoFLVZ9w8PjIKehQxJDSMIHRIwC:ZlzhrCOSPoFLXT79ACgIT

Score

10^/10

gh0strat discovery persistence rat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/4808-7-0x0000000010000000-0x0000000010034000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\360svc\Parameters\ServiceDll = "C:\\Documents and Settings\\Local Service\\Service.dll"	JaffaCakes118_4952ffc9a6369cede2dca5be8b5041b1.exe

Loads dropped DLL 3 IoCs

pid	Process
4808	svchost.exe
4808	svchost.exe
4808	svchost.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2660	4808	WerFault.exe	84
4012	4808	WerFault.exe	84
4156	4808	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_4952ffc9a6369cede2dca5be8b5041b1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4952ffc9a6369cede2dca5be8b5041b1.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4952ffc9a6369cede2dca5be8b5041b1.exe"
1⤵
- Server Software Component: Terminal Services DLL
- System Location Discovery: System Language Discovery
PID:1768

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4808
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 572
  2⤵
  - Program crash
  PID:2660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 588
  2⤵
  - Program crash
  PID:4012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 616
  2⤵
  - Program crash
  PID:4156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4808 -ip 4808
1⤵
PID:4648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4808 -ip 4808
1⤵
PID:3472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4808 -ip 4808
1⤵
PID:1376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\documents and settings\local service\service.dll

Filesize
68KB

MD5
f16c3ad60b4ce19b2c9119feeea1abef

SHA1
1d305731af35ddeda61898a79a57df522ebad181

SHA256
49647ceee25f90cb3abcadd3c07428085918671297dc73bbc0d2396ad7e767f3

SHA512
9027265e83097f4026d0f4901fb5c861ff8562e6f2fa61c5a012f9c19e0fc00d193d72001df52b217987a0fd2fadbb9fc6717f994a0bd950153fa931800f31ed

Download Submit
memory/1768-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1768-4-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4808-5-0x0000000010000000-0x0000000010034000-memory.dmp

Filesize
208KB

Download
memory/4808-7-0x0000000010000000-0x0000000010034000-memory.dmp

Filesize
208KB

Download