gh0strat | f4cc9e1e3dd233cd9fc38f14524787fa9cb15630a68351f33de9c9087eebb44d

Analysis

max time kernel
146s
max time network
138s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/03/2025, 11:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_4d27d809fa2ee20883e49e8bdc9d2150.dll
Size

912KB
MD5

4d27d809fa2ee20883e49e8bdc9d2150
SHA1

64d216af04a3043fb817f848fbc97be62fe15958
SHA256

f4cc9e1e3dd233cd9fc38f14524787fa9cb15630a68351f33de9c9087eebb44d
SHA512

d19e405214f8bc2a7eecb80bc46061b8cb7fd0e362667745f44285babd1452e427130accd6921cacef920656762160602cd8fdb7c1634db67d50fd14a00fd51e
SSDEEP

24576:wEJ17LwBnlm+jSyMhLvhoqQ5gJFCcEwIxSOlgfo:hJ1IQQSFhLezqFGwIxRg

Score

10^/10

gh0strat defense_evasion discovery persistence rat trojan

Malware Config

Signatures

Gh0st RAT payload 4 IoCs

resource	yara_rule
behavioral1/memory/1868-23-0x0000000000400000-0x00000000005F0000-memory.dmp	family_gh0strat
behavioral1/memory/2824-28-0x0000000000400000-0x00000000005F0000-memory.dmp	family_gh0strat
behavioral1/memory/2824-32-0x0000000000400000-0x00000000005F0000-memory.dmp	family_gh0strat
behavioral1/files/0x0009000000015fba-33.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	hrlD671.tmp
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ingvnhoze.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{75EA749F-80DA-4f86-B03A-E234087620C4}\stubpath = "C:\\Windows\\system32\\ingvnhoze.exe"	hrlD671.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{75EA749F-80DA-4f86-B03A-E234087620C4}	hrlD671.tmp

Executes dropped EXE 2 IoCs

pid	Process
1868	hrlD671.tmp
2824	ingvnhoze.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Wine	hrlD671.tmp
Key opened	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Wine	ingvnhoze.exe

Loads dropped DLL 6 IoCs

pid	Process
1248	rundll32.exe
1868	hrlD671.tmp
2824	ingvnhoze.exe
2824	ingvnhoze.exe
2824	ingvnhoze.exe
2560	userinit.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ingvnhoze.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hrlD671.tmp

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ingvnhoze.exe	hrlD671.tmp
File opened for modification	C:\Windows\SysWOW64\ingvnhoze.exe_lang.ini	hrlD671.tmp

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1868	hrlD671.tmp
2824	ingvnhoze.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hrlD671.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ingvnhoze.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	userinit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1868	hrlD671.tmp
1868	hrlD671.tmp
2824	ingvnhoze.exe
2824	ingvnhoze.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1868	hrlD671.tmp
Token: SeDebugPrivilege	2824	ingvnhoze.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 1248	2336	rundll32.exe	31
PID 2336 wrote to memory of 1248	2336	rundll32.exe	31
PID 2336 wrote to memory of 1248	2336	rundll32.exe	31
PID 2336 wrote to memory of 1248	2336	rundll32.exe	31
PID 2336 wrote to memory of 1248	2336	rundll32.exe	31
PID 2336 wrote to memory of 1248	2336	rundll32.exe	31
PID 2336 wrote to memory of 1248	2336	rundll32.exe	31
PID 1248 wrote to memory of 1868	1248	rundll32.exe	32
PID 1248 wrote to memory of 1868	1248	rundll32.exe	32
PID 1248 wrote to memory of 1868	1248	rundll32.exe	32
PID 1248 wrote to memory of 1868	1248	rundll32.exe	32
PID 1248 wrote to memory of 1868	1248	rundll32.exe	32
PID 1248 wrote to memory of 1868	1248	rundll32.exe	32
PID 1248 wrote to memory of 1868	1248	rundll32.exe	32
PID 1868 wrote to memory of 2824	1868	hrlD671.tmp	33
PID 1868 wrote to memory of 2824	1868	hrlD671.tmp	33
PID 1868 wrote to memory of 2824	1868	hrlD671.tmp	33
PID 1868 wrote to memory of 2824	1868	hrlD671.tmp	33
PID 1868 wrote to memory of 2824	1868	hrlD671.tmp	33
PID 1868 wrote to memory of 2824	1868	hrlD671.tmp	33
PID 1868 wrote to memory of 2824	1868	hrlD671.tmp	33
PID 2824 wrote to memory of 2560	2824	ingvnhoze.exe	34
PID 2824 wrote to memory of 2560	2824	ingvnhoze.exe	34
PID 2824 wrote to memory of 2560	2824	ingvnhoze.exe	34
PID 2824 wrote to memory of 2560	2824	ingvnhoze.exe	34
PID 2824 wrote to memory of 2560	2824	ingvnhoze.exe	34
PID 2824 wrote to memory of 2560	2824	ingvnhoze.exe	34
PID 2824 wrote to memory of 2560	2824	ingvnhoze.exe	34
PID 2824 wrote to memory of 2560	2824	ingvnhoze.exe	34

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4d27d809fa2ee20883e49e8bdc9d2150.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4d27d809fa2ee20883e49e8bdc9d2150.dll,#1
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1248
- - C:\Users\Admin\AppData\Local\Temp\hrlD671.tmp
    C:\Users\Admin\AppData\Local\Temp\hrlD671.tmp
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1868
  - - C:\Windows\SysWOW64\ingvnhoze.exe
      C:\Windows\system32\ingvnhoze.exe
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Executes dropped EXE
      Identifies Wine through registry keys
      Loads dropped DLL
      Checks whether UAC is enabled
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2824
    - - C:\Windows\SysWOW64\userinit.exe
        
        userinit.exe
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\259447821_lang.dll

Filesize
122KB

MD5
fff402fd70d621d3d03c74dada741326

SHA1
71fbcf04700b77eff142a0471debceae21337fd2

SHA256
5b172efcad5c7f488064b476381576eea96b7123c8926e5a2003bea1e9e59449

SHA512
4c2473462a13f221cd1c090b5f1e7ea0cc3209d28232626e22f9ad60daa397dfefe0dcb8df474ebbc3e8fe28c9b5d22d0dbdd1e198fa3764512b53f7fbffd8da

Download Submit
C:\Windows\SysWOW64\ingvnhoze.exe

Filesize
902KB

MD5
b6166f5ca620285419b0127be9e76ed6

SHA1
7676cb586dd9f14f9a4544c91205c5209a2c7e6d

SHA256
29c3363059b7db427a0fee3bac13e955b8ac89ab1f41d8543bb736d569d37747

SHA512
282ab5f0bcff1a28e6e68edeb4c7a2d088ee88b2f00d97a3f80564855371e8a713e21a9dbc99e883d34db170193b0a0e051729481becd7edf38c186b02b7451e

Download Submit
\Users\Admin\AppData\Local\Temp\hrlD671.tmp

Filesize
902KB

MD5
4356e7758188f0cad761016f0ac96d92

SHA1
efeee9d485e2584141499f35d770a43fba35ab59

SHA256
deae3fff3c99801bc66eed7b2a0da62b75f056ebbb781134c4cb8431ca48fcf8

SHA512
af4e151d37d78b6aacd166e784fd432a65fbedc0d697ee7bb7e0d9f98f29bef79ff6e354faa943d424a97162a019a9067a9ad818018e68423c804483441d97a9

Download Submit
memory/1248-4-0x0000000002210000-0x0000000002400000-memory.dmp

Filesize
1.9MB

Download
memory/1248-35-0x0000000002210000-0x0000000002400000-memory.dmp

Filesize
1.9MB

Download
memory/1868-7-0x0000000000400000-0x00000000005F0000-memory.dmp

Filesize
1.9MB

Download
memory/1868-8-0x0000000077490000-0x0000000077492000-memory.dmp

Filesize
8KB

Download
memory/1868-9-0x0000000004660000-0x0000000004662000-memory.dmp

Filesize
8KB

Download
memory/1868-10-0x0000000000401000-0x0000000000404000-memory.dmp

Filesize
12KB

Download
memory/1868-24-0x00000000048E0000-0x0000000004AD0000-memory.dmp

Filesize
1.9MB

Download
memory/1868-23-0x0000000000400000-0x00000000005F0000-memory.dmp

Filesize
1.9MB

Download
memory/2560-31-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/2824-27-0x0000000000400000-0x00000000005F0000-memory.dmp

Filesize
1.9MB

Download
memory/2824-32-0x0000000000400000-0x00000000005F0000-memory.dmp

Filesize
1.9MB

Download
memory/2824-28-0x0000000000400000-0x00000000005F0000-memory.dmp

Filesize
1.9MB

Download
memory/2824-25-0x0000000000C70000-0x0000000000E60000-memory.dmp

Filesize
1.9MB

Download
memory/2824-26-0x0000000000C70000-0x0000000000E60000-memory.dmp

Filesize
1.9MB

Download