gh0strat | fc28d3c2a2c6fb864b321d3945418efc9304f6cc8d67bba35a91ea9fb0ea91cf

Analysis

max time kernel
102s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
03/03/2025, 20:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_49044f3317228d55c847413f89e105bb.exe
Size

107KB
MD5

49044f3317228d55c847413f89e105bb
SHA1

9c744beaf3f98efcf4249083aed90551940b8464
SHA256

fc28d3c2a2c6fb864b321d3945418efc9304f6cc8d67bba35a91ea9fb0ea91cf
SHA512

33d30d446d46a023520382b4758451e649bc9f4e4d1706e48dda8ec60e62a654c1045f79e02667ae58aad01c39923a89a118d2fb6c46730eb1d294cab9e2e378
SSDEEP

3072:xsiRdvUIsH596/huzhHqnG78stvR7mPa3s+:BR+35U/ocnk3t5yPWs+

Score

10^/10

gh0strat defense_evasion discovery persistence rat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000d000000023b78-3.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Drivers\beep.sys	JaffaCakes118_49044f3317228d55c847413f89e105bb.exe

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibilityex.dll"	JaffaCakes118_49044f3317228d55c847413f89e105bb.exe

Loads dropped DLL 1 IoCs

pid	Process
224	svchost.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\FastUserSwitchingCompatibilityex.dll	JaffaCakes118_49044f3317228d55c847413f89e105bb.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_49044f3317228d55c847413f89e105bb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 2152	2768	JaffaCakes118_49044f3317228d55c847413f89e105bb.exe	86
PID 2768 wrote to memory of 2152	2768	JaffaCakes118_49044f3317228d55c847413f89e105bb.exe	86
PID 2768 wrote to memory of 2152	2768	JaffaCakes118_49044f3317228d55c847413f89e105bb.exe	86

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_49044f3317228d55c847413f89e105bb.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_49044f3317228d55c847413f89e105bb.exe"
1⤵
- Drops file in Drivers directory
- Server Software Component: Terminal Services DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_49044f3317228d55c847413f89e105bb.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2152

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s FastUserSwitchingCompatibility
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\fastuserswitchingcompatibilityex.dll

Filesize
79KB

MD5
55734df7a86e6cba71c93b4e9325e5c7

SHA1
9aca5e86b3c59cf9b0dc2a737f9bfc477a0895e8

SHA256
cce5e64a7c710465bf7b99b06c76b4ce63c28b98833b9e7371f7cc4b25c7e1ff

SHA512
8067feff8a71dbec0556a813bc3a167b95a89347cfc37d2f8736c5d8bc2038319eb8b79a39af3c72c8137dc9e2d0d8f82989dbcae02a7e085255fe72e7ad13e7

Download Submit