gh0strat | 230f01614f0831bdb042ebb2fc328c778f4c4b0d3d43fca841e835add9601d78

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/03/2025, 20:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_4f9183f4f1ba51f1d663cb7b535fa09a.exe
Size

151KB
MD5

4f9183f4f1ba51f1d663cb7b535fa09a
SHA1

a41e777cf2a500849e694f4478ada4ce968e9b78
SHA256

230f01614f0831bdb042ebb2fc328c778f4c4b0d3d43fca841e835add9601d78
SHA512

0e9b8bbaafa398e30b5627972383f3260f4826dd279ca90af02ba79b250f7ad1697155af778c484568d82466a2d982f648411343a6bcd46863b9f3f54893bf0a
SSDEEP

3072:TS3i7bVEnOr5UP6hKRXuS6S9L3e2ta2OMdj3Ksx9e8o+m:TSKVEnOr5UyhZK973aodj6s3m

Score

10^/10

gh0strat discovery persistence rat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/files/0x0008000000015da1-2.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\360svc\Parameters\ServiceDll = "C:\\Documents and Settings\\Local User\\VQQTrace.dll"	JaffaCakes118_4f9183f4f1ba51f1d663cb7b535fa09a.exe

Deletes itself 1 IoCs

pid	Process
1972	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
1972	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_4f9183f4f1ba51f1d663cb7b535fa09a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2708	JaffaCakes118_4f9183f4f1ba51f1d663cb7b535fa09a.exe
2708	JaffaCakes118_4f9183f4f1ba51f1d663cb7b535fa09a.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4f9183f4f1ba51f1d663cb7b535fa09a.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4f9183f4f1ba51f1d663cb7b535fa09a.exe"
1⤵
- Server Software Component: Terminal Services DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2708

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Local User\VQQTrace.dll

Filesize
111KB

MD5
bb681f48f6850d28e02c3a84b0f4d03d

SHA1
6db330e5e13badaa9059b62f14de44f2044f58f4

SHA256
423db3986e7952a65a6bc45b012ebfb686881c3aefb73260e711f05bc8801819

SHA512
9c7e973d57c339ad651ec3552f6edfc384562d32d4784c912b8e775203e0e1b810b48512c3dea0012fdbd2cd12c81bc27b39d476b739c7068ec981d1640756f0

Download Submit