gh0strat | d1e45db73ab68d07375b6c521647f6d6b8e9289a8a15db84f0d61ecda7d35af9

Analysis

max time kernel
127s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
03/03/2025, 12:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_47069595c0fa4b493cef6c910eae7d95.exe
Size

110KB
MD5

47069595c0fa4b493cef6c910eae7d95
SHA1

ece86121f8647baf1c361318802cd85d004a82e3
SHA256

d1e45db73ab68d07375b6c521647f6d6b8e9289a8a15db84f0d61ecda7d35af9
SHA512

0e8849c482f9a9c000a23459284b074950371edfb0e211c2f4d3f84d1ea6ecd8881cd79a0d2f0bed7d2d3b9333b50dd8e54fa011f088459f6f14fd15eb2598d4
SSDEEP

3072:UsVx3SyG20GE7PPwwR2ecFIDwtlcdqE+Tw3Fk048UEq:JX3SyGhGEzPwzF1lktaw3K047X

Score

10^/10

gh0strat discovery persistence rat

Malware Config

Signatures

Gh0st RAT payload 4 IoCs

resource	yara_rule
behavioral2/memory/640-0-0x0000000000400000-0x000000000041D000-memory.dmp	family_gh0strat
behavioral2/files/0x005a000000023c4e-4.dat	family_gh0strat
behavioral2/memory/640-12-0x0000000000400000-0x000000000041D000-memory.dmp	family_gh0strat
behavioral2/files/0x0008000000023d3f-11.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibilityex.dll"	JaffaCakes118_47069595c0fa4b493cef6c910eae7d95.exe

Loads dropped DLL 2 IoCs

pid	Process
640	JaffaCakes118_47069595c0fa4b493cef6c910eae7d95.exe
1260	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\FastUserSwitchingCompatibilityex.dll	JaffaCakes118_47069595c0fa4b493cef6c910eae7d95.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_47069595c0fa4b493cef6c910eae7d95.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_47069595c0fa4b493cef6c910eae7d95.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_47069595c0fa4b493cef6c910eae7d95.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:640

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s FastUserSwitchingCompatibility
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\240624046_ex.tmp

Filesize
99KB

MD5
f3fa31379e85ca7b7a32929fa5c5e3c2

SHA1
7dc3fc441f7876d8441f32192a2dc8e4f50acb6b

SHA256
57ac56c202431166eb86c79d5f76ace0a5207177882e176c784c5251b8b62970

SHA512
cafccca43bd430186214431072af713c5b1879192b316f15588b3739f397f4d361ec87db939c48fdbd170352dc5c905f1c4c3712a2100af3b562534c4cc56a7d

Download Submit
\??\c:\windows\SysWOW64\fastuserswitchingcompatibilityex.dll

Filesize
99KB

MD5
873d93f17919f6af04134f66c0e1787a

SHA1
e4ea94c91914abf9a11377bd72e0ac48bdebcc7e

SHA256
364575510be12545508f0cf76d3b20c6c75dc2fe4eea5801a7faee03b8580e67

SHA512
b0b9a6db51bae255ca57291696040ab159a1fbfe6a6b3e6443d3299c4bf21413239a30cec4a957e136b198cd69c678ac658d9410f5a95995612d99d4da549ab1

Download Submit
memory/640-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/640-12-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download