gh0strat | 013a6ef13631bcbc7d4066b1c53708cc29e3018a15c37be806a5af0b7f17eede

Analysis

max time kernel
125s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/03/2025, 12:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_471250fe301b8d2be6ce2145e8a2e6e7.exe
Size

232KB
MD5

471250fe301b8d2be6ce2145e8a2e6e7
SHA1

f8e702cb5be6012b3fdc5bab79225d2389ad0610
SHA256

013a6ef13631bcbc7d4066b1c53708cc29e3018a15c37be806a5af0b7f17eede
SHA512

cebe86eb2352a1939c9fd268a170f32f1aeffd981c4a3667c810ecec380cafefddf6f216526aae2c2addf054ee6a8bcc28c260f2c13aee08629e8c10239edd3f
SSDEEP

3072:3qVYtrjsN9NhlcOAeT4WWDQ8KKwirALVd8R1ttfH3qgnT7s:6KtnsN9Nvc6DWECwyGX8R1P3H7s

Score

10^/10

gh0strat discovery persistence rat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/files/0x0008000000016dd2-4.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\V2011 = "C:\\WINDOWS\\V2011.exe"	JaffaCakes118_471250fe301b8d2be6ce2145e8a2e6e7.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\V2011.exe	JaffaCakes118_471250fe301b8d2be6ce2145e8a2e6e7.exe
File opened for modification	C:\WINDOWS\V2011.exe	JaffaCakes118_471250fe301b8d2be6ce2145e8a2e6e7.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_471250fe301b8d2be6ce2145e8a2e6e7.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2428	JaffaCakes118_471250fe301b8d2be6ce2145e8a2e6e7.exe
2428	JaffaCakes118_471250fe301b8d2be6ce2145e8a2e6e7.exe
2428	JaffaCakes118_471250fe301b8d2be6ce2145e8a2e6e7.exe
2428	JaffaCakes118_471250fe301b8d2be6ce2145e8a2e6e7.exe
2428	JaffaCakes118_471250fe301b8d2be6ce2145e8a2e6e7.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2428	JaffaCakes118_471250fe301b8d2be6ce2145e8a2e6e7.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2428	JaffaCakes118_471250fe301b8d2be6ce2145e8a2e6e7.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_471250fe301b8d2be6ce2145e8a2e6e7.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_471250fe301b8d2be6ce2145e8a2e6e7.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Temp\2011.exe

Filesize
232KB

MD5
471250fe301b8d2be6ce2145e8a2e6e7

SHA1
f8e702cb5be6012b3fdc5bab79225d2389ad0610

SHA256
013a6ef13631bcbc7d4066b1c53708cc29e3018a15c37be806a5af0b7f17eede

SHA512
cebe86eb2352a1939c9fd268a170f32f1aeffd981c4a3667c810ecec380cafefddf6f216526aae2c2addf054ee6a8bcc28c260f2c13aee08629e8c10239edd3f

Download Submit