gh0strat | 8d30ce5493d184708c514d85bb780f1c20d531a627aec19eb3eea9c665ef554e

Analysis

max time kernel
77s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
04/03/2025, 19:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_4f32608087748c0195e635380a7260a4.exe
Size

102KB
MD5

4f32608087748c0195e635380a7260a4
SHA1

daf091316bc0335a92a18f068488131c3186469c
SHA256

8d30ce5493d184708c514d85bb780f1c20d531a627aec19eb3eea9c665ef554e
SHA512

85c640c438d132f857a65ea706cd9253ea5bc524bcd92835e022e1244a65f6fb516384fe0a9b77ce3493b59726a1fdbefd7dce181c0af08be68075bf2a046f19
SSDEEP

3072:OANo4LBzEgpj3P1PzzD6wikkycGHuK7vYy3Hvt:PooBzn71LASuKL3H

Score

10^/10

gh0strat discovery rat

Malware Config

Signatures

Gh0st RAT payload 6 IoCs

resource	yara_rule
behavioral2/memory/4644-1-0x0000000000400000-0x0000000000432000-memory.dmp	family_gh0strat
behavioral2/files/0x000500000001e64d-8.dat	family_gh0strat
behavioral2/memory/4644-11-0x0000000000400000-0x0000000000432000-memory.dmp	family_gh0strat
behavioral2/memory/1892-14-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral2/memory/4720-19-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral2/memory/4540-24-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Deletes itself 1 IoCs

pid	Process
1892	svchost.exe

Loads dropped DLL 3 IoCs

pid	Process
1892	svchost.exe
4720	svchost.exe
4540	svchost.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\kcxupifakf	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\kkmoxlhxwa	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\ktkchfdcwj	svchost.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\%SESSIONNAME%\mnnys.cc3	JaffaCakes118_4f32608087748c0195e635380a7260a4.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
3836	1892	WerFault.exe	92
3604	4720	WerFault.exe	100
1120	4540	WerFault.exe	103

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_4f32608087748c0195e635380a7260a4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4644	JaffaCakes118_4f32608087748c0195e635380a7260a4.exe
4644	JaffaCakes118_4f32608087748c0195e635380a7260a4.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeRestorePrivilege	4644	JaffaCakes118_4f32608087748c0195e635380a7260a4.exe
Token: SeBackupPrivilege	4644	JaffaCakes118_4f32608087748c0195e635380a7260a4.exe
Token: SeBackupPrivilege	4644	JaffaCakes118_4f32608087748c0195e635380a7260a4.exe
Token: SeRestorePrivilege	4644	JaffaCakes118_4f32608087748c0195e635380a7260a4.exe
Token: SeBackupPrivilege	1892	svchost.exe
Token: SeRestorePrivilege	1892	svchost.exe
Token: SeBackupPrivilege	1892	svchost.exe
Token: SeBackupPrivilege	1892	svchost.exe
Token: SeSecurityPrivilege	1892	svchost.exe
Token: SeSecurityPrivilege	1892	svchost.exe
Token: SeBackupPrivilege	1892	svchost.exe
Token: SeBackupPrivilege	1892	svchost.exe
Token: SeSecurityPrivilege	1892	svchost.exe
Token: SeBackupPrivilege	1892	svchost.exe
Token: SeBackupPrivilege	1892	svchost.exe
Token: SeSecurityPrivilege	1892	svchost.exe
Token: SeBackupPrivilege	1892	svchost.exe
Token: SeRestorePrivilege	1892	svchost.exe
Token: SeBackupPrivilege	4720	svchost.exe
Token: SeRestorePrivilege	4720	svchost.exe
Token: SeBackupPrivilege	4720	svchost.exe
Token: SeBackupPrivilege	4720	svchost.exe
Token: SeSecurityPrivilege	4720	svchost.exe
Token: SeSecurityPrivilege	4720	svchost.exe
Token: SeBackupPrivilege	4720	svchost.exe
Token: SeBackupPrivilege	4720	svchost.exe
Token: SeSecurityPrivilege	4720	svchost.exe
Token: SeBackupPrivilege	4720	svchost.exe
Token: SeBackupPrivilege	4720	svchost.exe
Token: SeSecurityPrivilege	4720	svchost.exe
Token: SeBackupPrivilege	4720	svchost.exe
Token: SeRestorePrivilege	4720	svchost.exe
Token: SeBackupPrivilege	4540	svchost.exe
Token: SeRestorePrivilege	4540	svchost.exe
Token: SeBackupPrivilege	4540	svchost.exe
Token: SeBackupPrivilege	4540	svchost.exe
Token: SeSecurityPrivilege	4540	svchost.exe
Token: SeSecurityPrivilege	4540	svchost.exe
Token: SeBackupPrivilege	4540	svchost.exe
Token: SeBackupPrivilege	4540	svchost.exe
Token: SeSecurityPrivilege	4540	svchost.exe
Token: SeBackupPrivilege	4540	svchost.exe
Token: SeBackupPrivilege	4540	svchost.exe
Token: SeSecurityPrivilege	4540	svchost.exe
Token: SeBackupPrivilege	4540	svchost.exe
Token: SeRestorePrivilege	4540	svchost.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4f32608087748c0195e635380a7260a4.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4f32608087748c0195e635380a7260a4.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4644

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Deletes itself
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1892 -s 808
  2⤵
  - Program crash
  PID:3836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1892 -ip 1892
1⤵
PID:2248

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 964
  2⤵
  - Program crash
  PID:3604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4720 -ip 4720
1⤵
PID:1876

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 1104
  2⤵
  - Program crash
  PID:1120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4540 -ip 4540
1⤵
PID:3864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\svchost.exe.txt

Filesize
200B

MD5
6284602448cffb991792417515a50d1a

SHA1
aaba1d268267d2fa1fb072a10681ede46059f76d

SHA256
30eebaa87b3bee89eec2f8891201554001e8ddbebe002306a07b2a2a83a38a8e

SHA512
53fb164341428419ebdb5a42a7b93a31a690b9911bb69a4f5d1c07a8e7a28e6b1226ab4bc3a634f5eea71a488d4980103b7e38db66efc21f813569a30d3ff930

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
300B

MD5
fea2620db657301301ee60199c1a21ec

SHA1
1a8c814c3976619724ef08712e44ef8009d17b45

SHA256
151189eefe6646d3250400fe9fed29c0c1f6cddf5f77a6fed9f2440fd3d3233b

SHA512
8291d96e43e15211dc51ff6edf4f2812db08ea6fc0e39017e5813a94af984c7ad1ad8c6a8a40007e0fdfdb641815315e244130e993bd2ffc74d606b652b58000

Download Submit
\??\c:\program files (x86)\%sessionname%\mnnys.cc3

Filesize
22.0MB

MD5
7b29a22c1d0bf04ca0e4b5a75f7e1842

SHA1
49577280234cbacda43b0616bfd2fbee547d7580

SHA256
737fec5ab2eb9b929f7a606310596f586334f24c50452ccd73f4c2e109a42975

SHA512
0d6bce1680d681bf46d3cddb5ea5699f6811d7c51ed6d940a3961e0c925ad2e71fb111a442024a69f0b45926b0981b23d031fd1d3aba1a8b5b19c094d0b8c995

Download Submit
memory/1892-12-0x00000000015A0000-0x00000000015A1000-memory.dmp

Filesize
4KB

Download
memory/1892-14-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/4540-24-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/4540-21-0x00000000013D0000-0x00000000013D1000-memory.dmp

Filesize
4KB

Download
memory/4644-10-0x0000000000440000-0x000000000045B000-memory.dmp

Filesize
108KB

Download
memory/4644-11-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4644-0-0x0000000000440000-0x000000000045B000-memory.dmp

Filesize
108KB

Download
memory/4644-1-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4720-16-0x00000000013E0000-0x00000000013E1000-memory.dmp

Filesize
4KB

Download
memory/4720-19-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download