gh0strat | 0ffcf362ba01ad54b1050a6524f8af5abbf509b070cea29e5cbcc2057a872453

Analysis

max time kernel
93s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
04/03/2025, 16:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_4e68a2a9d5a9da39f109375c1aba46a1.exe
Size

94KB
MD5

4e68a2a9d5a9da39f109375c1aba46a1
SHA1

b21d23bad0cf6bf7a6670ddcbc2cfdf82d9cb9cf
SHA256

0ffcf362ba01ad54b1050a6524f8af5abbf509b070cea29e5cbcc2057a872453
SHA512

b236a97fcab45b3b353444870b3f2094ab9708475f01569e46c6db3f20c656946ead8c0ff076eab6c84f606ac2f8f864ff5d91fac10882fecb67d6d6d4c80218
SSDEEP

1536:f9/qFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prsTAIatN:f9/wS4jHS8q/3nTzePCwNUh4E9sK

Score

10^/10

gh0strat discovery rat

Malware Config

Signatures

Gh0st RAT payload 5 IoCs

resource	yara_rule
behavioral2/files/0x000200000001e91e-15.dat	family_gh0strat
behavioral2/memory/2688-17-0x0000000000400000-0x000000000044C610-memory.dmp	family_gh0strat
behavioral2/memory/1348-20-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral2/memory/1720-25-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral2/memory/1896-30-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Deletes itself 1 IoCs

pid	Process
2688	kxejiyquxy

Executes dropped EXE 1 IoCs

pid	Process
2688	kxejiyquxy

Loads dropped DLL 3 IoCs

pid	Process
1348	svchost.exe
1720	svchost.exe
1896	svchost.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\icjhkeahxi	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\ilwarhcfke	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\ilwarhcfke	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
3480	1348	WerFault.exe	91
3428	1720	WerFault.exe	97
4612	1896	WerFault.exe	100

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kxejiyquxy
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_4e68a2a9d5a9da39f109375c1aba46a1.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2688	kxejiyquxy
2688	kxejiyquxy

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeRestorePrivilege	2688	kxejiyquxy
Token: SeBackupPrivilege	2688	kxejiyquxy
Token: SeBackupPrivilege	2688	kxejiyquxy
Token: SeRestorePrivilege	2688	kxejiyquxy
Token: SeBackupPrivilege	1348	svchost.exe
Token: SeRestorePrivilege	1348	svchost.exe
Token: SeBackupPrivilege	1348	svchost.exe
Token: SeBackupPrivilege	1348	svchost.exe
Token: SeSecurityPrivilege	1348	svchost.exe
Token: SeSecurityPrivilege	1348	svchost.exe
Token: SeBackupPrivilege	1348	svchost.exe
Token: SeBackupPrivilege	1348	svchost.exe
Token: SeSecurityPrivilege	1348	svchost.exe
Token: SeBackupPrivilege	1348	svchost.exe
Token: SeBackupPrivilege	1348	svchost.exe
Token: SeSecurityPrivilege	1348	svchost.exe
Token: SeBackupPrivilege	1348	svchost.exe
Token: SeRestorePrivilege	1348	svchost.exe
Token: SeBackupPrivilege	1720	svchost.exe
Token: SeRestorePrivilege	1720	svchost.exe
Token: SeBackupPrivilege	1720	svchost.exe
Token: SeBackupPrivilege	1720	svchost.exe
Token: SeSecurityPrivilege	1720	svchost.exe
Token: SeSecurityPrivilege	1720	svchost.exe
Token: SeBackupPrivilege	1720	svchost.exe
Token: SeBackupPrivilege	1720	svchost.exe
Token: SeSecurityPrivilege	1720	svchost.exe
Token: SeBackupPrivilege	1720	svchost.exe
Token: SeBackupPrivilege	1720	svchost.exe
Token: SeSecurityPrivilege	1720	svchost.exe
Token: SeBackupPrivilege	1720	svchost.exe
Token: SeRestorePrivilege	1720	svchost.exe
Token: SeBackupPrivilege	1896	svchost.exe
Token: SeRestorePrivilege	1896	svchost.exe
Token: SeBackupPrivilege	1896	svchost.exe
Token: SeBackupPrivilege	1896	svchost.exe
Token: SeSecurityPrivilege	1896	svchost.exe
Token: SeSecurityPrivilege	1896	svchost.exe
Token: SeBackupPrivilege	1896	svchost.exe
Token: SeBackupPrivilege	1896	svchost.exe
Token: SeSecurityPrivilege	1896	svchost.exe
Token: SeBackupPrivilege	1896	svchost.exe
Token: SeBackupPrivilege	1896	svchost.exe
Token: SeSecurityPrivilege	1896	svchost.exe
Token: SeBackupPrivilege	1896	svchost.exe
Token: SeRestorePrivilege	1896	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 2688	3216	JaffaCakes118_4e68a2a9d5a9da39f109375c1aba46a1.exe	88
PID 3216 wrote to memory of 2688	3216	JaffaCakes118_4e68a2a9d5a9da39f109375c1aba46a1.exe	88
PID 3216 wrote to memory of 2688	3216	JaffaCakes118_4e68a2a9d5a9da39f109375c1aba46a1.exe	88

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4e68a2a9d5a9da39f109375c1aba46a1.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4e68a2a9d5a9da39f109375c1aba46a1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3216
- \??\c:\users\admin\appdata\local\kxejiyquxy
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4e68a2a9d5a9da39f109375c1aba46a1.exe" a -sc:\users\admin\appdata\local\temp\jaffacakes118_4e68a2a9d5a9da39f109375c1aba46a1.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2688

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1348
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1348 -s 788
  2⤵
  - Program crash
  PID:3480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1348 -ip 1348
1⤵
PID:3316

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 912
  2⤵
  - Program crash
  PID:3428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1720 -ip 1720
1⤵
PID:324

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1896
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 1064
  2⤵
  - Program crash
  PID:4612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1896 -ip 1896
1⤵
PID:3992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\svchost.exe.txt

Filesize
202B

MD5
eb44c8889d704a5568d01009ede9cea5

SHA1
9c0911a34e8722eb6596792b9bc5c8f826b790d1

SHA256
c57bd76685608dce3e90f1364ebd359fbb2847b38ae5dbd655801b2a22fe42f5

SHA512
3894a22edf3e454fb712c0fba54a8ebcecea09363bd5c990a284db89494a8d42631db0ea49dc712ac4357a352d10936bdec3e1d279c4f1b30cd5073514bf540c

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
261B

MD5
4117ee26ef1324faf03ddfd39073fc74

SHA1
7bbd812dfadcddfc487332f72fc9150b090cd50f

SHA256
93596b048b1ec92a34b962d4bb3c6a09a2049f0aaf819bba1ecf53505992e953

SHA512
e3f620a858a5e1fc3dbaf06ce5c5d030836b9104dfb9793af3e3d89576004f490046f6d2790cf884adeca16063c6ecb38f7974e25981b578fa53cdde2a40b174

Download Submit
\??\c:\programdata\application data\storm\update\%sessionname%\yojul.cc3

Filesize
24.0MB

MD5
fa13340db70d5c2126a28094a602c52f

SHA1
292e388b39b29bc293f061387108234f7030d3d3

SHA256
abda0ae9c5218ecd41f221b1968a2f7d298647475c70eca2063c5e90b3b7ce4d

SHA512
d729320411410d04a19e7e0e084d111c470d2f311e6744ef491a8518b59f5987e811c7f233c01e1e76635118a0c4ebea74371abbb2081759949df7dd0f9eb36e

Download Submit
\??\c:\users\admin\appdata\local\kxejiyquxy

Filesize
23.4MB

MD5
5182c1131bf1d0c5ab190b9b44dc326c

SHA1
7815aeae8b5a3648031cea5486df168403115838

SHA256
e13571b6ff34e72078ed55b790bbd29dda7b6e9160765271e4eb89affeb55483

SHA512
86734ca2943ce7366da188cf0d4435f5d150dd3c1c8d94c4532f7a1214c6c3a943b4c557e5f216593629d824b998489296900984e605cb0de3d22274cf00fa9c

Download Submit
memory/1348-18-0x00000000015D0000-0x00000000015D1000-memory.dmp

Filesize
4KB

Download
memory/1348-20-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/1720-22-0x0000000001DE0000-0x0000000001DE1000-memory.dmp

Filesize
4KB

Download
memory/1720-25-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/1896-27-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

Filesize
4KB

Download
memory/1896-30-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/2688-12-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/2688-9-0x0000000000400000-0x000000000044C610-memory.dmp

Filesize
305KB

Download
memory/2688-17-0x0000000000400000-0x000000000044C610-memory.dmp

Filesize
305KB

Download
memory/3216-0-0x0000000000400000-0x000000000044C610-memory.dmp

Filesize
305KB

Download
memory/3216-8-0x0000000000400000-0x000000000044C610-memory.dmp

Filesize
305KB

Download
memory/3216-2-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download