gh0strat | 3e8cc60745e9f927533721ebe6cb480b69c884656154a3b73758920d7a01275b

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/03/2025, 10:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_4cc864f606390d06fec82486754341ae.exe
Size

192KB
MD5

4cc864f606390d06fec82486754341ae
SHA1

93d2758444a6eda0936b9137d880117cc564604c
SHA256

3e8cc60745e9f927533721ebe6cb480b69c884656154a3b73758920d7a01275b
SHA512

2d910268876fce6a7ec0a2cadfe2ddcfdbe380949a5d0146db28d59159e07b9f2bf17b074f19c707aa2dcc578fc6a977862eedcf854a13b1a2fc81a96bcca16f
SSDEEP

3072:OQk3DH+bK+snWjvUJFMKkj8aPBHA40qcVWhUXYvpSVxoTVrbMzYiw/mEFVc:OQkTH+bpsnWjvEkrPadqc6UIvK6jtm

Score

10^/10

gh0strat discovery rat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/files/0x0009000000012117-2.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Loads dropped DLL 3 IoCs

pid	Process
2724	svchost.exe
2808	svchost.exe
2712	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\nlcyf.cc3	JaffaCakes118_4cc864f606390d06fec82486754341ae.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_4cc864f606390d06fec82486754341ae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2316	JaffaCakes118_4cc864f606390d06fec82486754341ae.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	2316	JaffaCakes118_4cc864f606390d06fec82486754341ae.exe
Token: SeBackupPrivilege	2316	JaffaCakes118_4cc864f606390d06fec82486754341ae.exe
Token: SeBackupPrivilege	2316	JaffaCakes118_4cc864f606390d06fec82486754341ae.exe
Token: SeRestorePrivilege	2316	JaffaCakes118_4cc864f606390d06fec82486754341ae.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4cc864f606390d06fec82486754341ae.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4cc864f606390d06fec82486754341ae.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2316

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2724

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2808

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k regsvc
1⤵
PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\nlcyf.cc3

Filesize
19.0MB

MD5
92e8ca4dad8f2119f661937c91704ee2

SHA1
b91972bc407396b6901ad880cad6723751194e0b

SHA256
394b43b9c046d7490ee2f70b763ebd345c1b7bd6f90fd1aa6b5d80908a6cf695

SHA512
f03d03aafbff812c26e4e69defd3592a68e99a0b296e0c05e82c8b6123a70b432d0eab2275c97909ff39546358d0e90118462fbb39871d4b3aa6112a84fe3f66

Download Submit