gh0strat | 3e5a324a654e7c46ca6bf9bc70a50233d880bc096e0e00e01b3dc25c1b7207c4

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/03/2025, 11:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_46e075ff0edcba5a0195553abc04c9af.exe
Size

198KB
MD5

46e075ff0edcba5a0195553abc04c9af
SHA1

15de1b73fa01ad97099ad2090100ba837a60d0ee
SHA256

3e5a324a654e7c46ca6bf9bc70a50233d880bc096e0e00e01b3dc25c1b7207c4
SHA512

83a852c67fb0a1c633b415271d6886c034095ef094277e36cac1693080960f5a4c431f7fdf6530ec9385ebeccd156c6e6ca8e7aee4135e8ea50151205eda1789
SSDEEP

6144:4OVLnWFcAFtsFkVRTl0QdTmNPPYh7x32m:48LWFv+kV1KIo+Um

Score

10^/10

gh0strat discovery rat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/files/0x000900000001660e-2.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Loads dropped DLL 3 IoCs

pid	Process
2576	svchost.exe
2608	svchost.exe
2568	svchost.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\NetMeeting\%360SD%NNAME%\boecb.cip	JaffaCakes118_46e075ff0edcba5a0195553abc04c9af.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_46e075ff0edcba5a0195553abc04c9af.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2684	taskkill.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2244	JaffaCakes118_46e075ff0edcba5a0195553abc04c9af.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2684	taskkill.exe
Token: SeRestorePrivilege	2244	JaffaCakes118_46e075ff0edcba5a0195553abc04c9af.exe
Token: SeBackupPrivilege	2244	JaffaCakes118_46e075ff0edcba5a0195553abc04c9af.exe
Token: SeBackupPrivilege	2244	JaffaCakes118_46e075ff0edcba5a0195553abc04c9af.exe
Token: SeRestorePrivilege	2244	JaffaCakes118_46e075ff0edcba5a0195553abc04c9af.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2684	2244	JaffaCakes118_46e075ff0edcba5a0195553abc04c9af.exe	30
PID 2244 wrote to memory of 2684	2244	JaffaCakes118_46e075ff0edcba5a0195553abc04c9af.exe	30
PID 2244 wrote to memory of 2684	2244	JaffaCakes118_46e075ff0edcba5a0195553abc04c9af.exe	30
PID 2244 wrote to memory of 2684	2244	JaffaCakes118_46e075ff0edcba5a0195553abc04c9af.exe	30

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_46e075ff0edcba5a0195553abc04c9af.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_46e075ff0edcba5a0195553abc04c9af.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im ZhuDongFangYu.exe /t
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2684

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2576

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2608

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k regsvc
1⤵
PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\program files (x86)\netmeeting\%360sd%nname%\boecb.cip

Filesize
20.1MB

MD5
9f9cb55b513d3ac56cb77ee8c3e60789

SHA1
6f83483334908ecbb8f1c7a54495a0b9d38e3dfa

SHA256
d781d0c35f5f17ee69acd575c4aebc622caf6ba18f43f63560059cd30afc5392

SHA512
767f03b65a0cf3f353fe8d3273705baf0cc3eded93bb19f02ea84e6bcfb6d26916632e5da8e546ca3bc3c63029a723ab955249b2172a28ef27265d77d9e4e204

Download Submit