gh0strat | 9d1f09dd59f62ee1257719b9bbb556db8ba3216fa44ab8c4eef3fac89af6e934

Analysis

max time kernel
74s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
04/03/2025, 01:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_4a645da063a3e3244074883e93ddabb0.exe
Size

93KB
MD5

4a645da063a3e3244074883e93ddabb0
SHA1

0f24b6e1ccae92fbc981c95fae2511ef0d90dd1d
SHA256

9d1f09dd59f62ee1257719b9bbb556db8ba3216fa44ab8c4eef3fac89af6e934
SHA512

bc8a9513ffbe52ab883d0b67bd865d0fa3de5178a5fc562e82a84b5d8180706415168b1196d84ac12304a43087f952f12d6daf8f2734e8f29ddb0a5900eba865
SSDEEP

1536:m9H2fmB8MY/uKqNf03QlM2Eu3u0oyttqdnxt9HNgop6Vng35S9xz+W719IclkI:m9Hp6MY/uKqR0ga2A0Za10gJSXiWZ9T

Score

10^/10

gh0strat discovery rat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/4048-14-0x0000000000400000-0x000000000044DC4D-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Deletes itself 1 IoCs

pid	Process
4048	mggmukymkj

Executes dropped EXE 1 IoCs

pid	Process
4048	mggmukymkj

Program crash 1 IoCs

pid	pid_target	Process	procid_target
628	4048	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_4a645da063a3e3244074883e93ddabb0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mggmukymkj

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4048	mggmukymkj
4048	mggmukymkj

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	4048	mggmukymkj
Token: SeBackupPrivilege	4048	mggmukymkj
Token: SeBackupPrivilege	4048	mggmukymkj
Token: SeRestorePrivilege	4048	mggmukymkj

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 4048	1240	JaffaCakes118_4a645da063a3e3244074883e93ddabb0.exe	90
PID 1240 wrote to memory of 4048	1240	JaffaCakes118_4a645da063a3e3244074883e93ddabb0.exe	90
PID 1240 wrote to memory of 4048	1240	JaffaCakes118_4a645da063a3e3244074883e93ddabb0.exe	90

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4a645da063a3e3244074883e93ddabb0.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4a645da063a3e3244074883e93ddabb0.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1240
- \??\c:\users\admin\appdata\local\mggmukymkj
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4a645da063a3e3244074883e93ddabb0.exe" a -sc:\users\admin\appdata\local\temp\jaffacakes118_4a645da063a3e3244074883e93ddabb0.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4048
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 20
    3⤵
    - Program crash
    PID:628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4048 -ip 4048
1⤵
PID:936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\mggmukymkj

Filesize
19.6MB

MD5
3653f8a9cc3edff65077355f236cab9c

SHA1
a7c4dcabd5d23fdb18fe827afaf6ee2abab37b12

SHA256
942e24655c7b5f1d49ef0a6e5a99a9a899d006826ea08d580e25d455409b721b

SHA512
358db42fa1e28ca0fb7a4b4df0f449a2c5f380fe8a3940075f2bc5896440116265ef4a1e75ce5ef898131d80dcbe173e0762b53909919d07a2f753798f0a8dca

Download Submit
memory/1240-0-0x0000000000400000-0x000000000044DC4D-memory.dmp

Filesize
311KB

Download
memory/1240-1-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download
memory/1240-2-0x0000000000400000-0x000000000044DC4D-memory.dmp

Filesize
311KB

Download
memory/1240-7-0x0000000000400000-0x000000000044DC4D-memory.dmp

Filesize
311KB

Download
memory/4048-11-0x0000000000480000-0x0000000000481000-memory.dmp

Filesize
4KB

Download
memory/4048-10-0x0000000000400000-0x000000000044DC4D-memory.dmp

Filesize
311KB

Download
memory/4048-9-0x0000000000400000-0x000000000044DC4D-memory.dmp

Filesize
311KB

Download
memory/4048-14-0x0000000000400000-0x000000000044DC4D-memory.dmp

Filesize
311KB

Download