gh0strat | f059e8e88b0242263305e172331821bc051ac83e62af6c856c06ae9af11d6b39

Analysis

max time kernel
120s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2025, 07:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_51210ca6a630e9861f566af0209fb45f.exe
Size

96KB
MD5

51210ca6a630e9861f566af0209fb45f
SHA1

7db4bb1299dd15c9eea49b394102aa9e8232411c
SHA256

f059e8e88b0242263305e172331821bc051ac83e62af6c856c06ae9af11d6b39
SHA512

1a34631636d5eb6987f18651195cf81b5fce2ad9f5644a626865fac9003071d6abdde7f814570b348c108da532682cb85fb44fbc57a35e2891b65fa73f8fed05
SSDEEP

3072:9hS4jHS8q/3nTzePCwNUh4E9UFt63Q2/6:9c428q/nTzePCwG7UFo3y

Score

10^/10

gh0strat discovery rat

Malware Config

Signatures

Gh0st RAT payload 5 IoCs

resource	yara_rule
behavioral2/files/0x000c000000023b7e-13.dat	family_gh0strat
behavioral2/memory/228-16-0x0000000000400000-0x000000000044E2DC-memory.dmp	family_gh0strat
behavioral2/memory/1444-19-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral2/memory/3152-24-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral2/memory/3876-29-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Deletes itself 1 IoCs

pid	Process
228	ligripledq

Executes dropped EXE 1 IoCs

pid	Process
228	ligripledq

Loads dropped DLL 3 IoCs

pid	Process
1444	svchost.exe
3152	svchost.exe
3876	svchost.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\twaeqwocwd	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\tfnxyarakx	svchost.exe
File created	C:\Windows\SysWOW64\tfnxyarakx	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\tncqhdtxxt	svchost.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1360	1444	WerFault.exe	93
4736	3152	WerFault.exe	99
2544	3876	WerFault.exe	102

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_51210ca6a630e9861f566af0209fb45f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ligripledq

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
228	ligripledq
228	ligripledq

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeRestorePrivilege	228	ligripledq
Token: SeBackupPrivilege	228	ligripledq
Token: SeBackupPrivilege	228	ligripledq
Token: SeRestorePrivilege	228	ligripledq
Token: SeBackupPrivilege	1444	svchost.exe
Token: SeRestorePrivilege	1444	svchost.exe
Token: SeBackupPrivilege	1444	svchost.exe
Token: SeBackupPrivilege	1444	svchost.exe
Token: SeSecurityPrivilege	1444	svchost.exe
Token: SeSecurityPrivilege	1444	svchost.exe
Token: SeBackupPrivilege	1444	svchost.exe
Token: SeBackupPrivilege	1444	svchost.exe
Token: SeSecurityPrivilege	1444	svchost.exe
Token: SeBackupPrivilege	1444	svchost.exe
Token: SeBackupPrivilege	1444	svchost.exe
Token: SeSecurityPrivilege	1444	svchost.exe
Token: SeBackupPrivilege	1444	svchost.exe
Token: SeRestorePrivilege	1444	svchost.exe
Token: SeBackupPrivilege	3152	svchost.exe
Token: SeRestorePrivilege	3152	svchost.exe
Token: SeBackupPrivilege	3152	svchost.exe
Token: SeBackupPrivilege	3152	svchost.exe
Token: SeSecurityPrivilege	3152	svchost.exe
Token: SeSecurityPrivilege	3152	svchost.exe
Token: SeBackupPrivilege	3152	svchost.exe
Token: SeBackupPrivilege	3152	svchost.exe
Token: SeSecurityPrivilege	3152	svchost.exe
Token: SeBackupPrivilege	3152	svchost.exe
Token: SeBackupPrivilege	3152	svchost.exe
Token: SeSecurityPrivilege	3152	svchost.exe
Token: SeBackupPrivilege	3152	svchost.exe
Token: SeRestorePrivilege	3152	svchost.exe
Token: SeBackupPrivilege	3876	svchost.exe
Token: SeRestorePrivilege	3876	svchost.exe
Token: SeBackupPrivilege	3876	svchost.exe
Token: SeBackupPrivilege	3876	svchost.exe
Token: SeSecurityPrivilege	3876	svchost.exe
Token: SeSecurityPrivilege	3876	svchost.exe
Token: SeBackupPrivilege	3876	svchost.exe
Token: SeBackupPrivilege	3876	svchost.exe
Token: SeSecurityPrivilege	3876	svchost.exe
Token: SeBackupPrivilege	3876	svchost.exe
Token: SeBackupPrivilege	3876	svchost.exe
Token: SeSecurityPrivilege	3876	svchost.exe
Token: SeBackupPrivilege	3876	svchost.exe
Token: SeRestorePrivilege	3876	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 228	2736	JaffaCakes118_51210ca6a630e9861f566af0209fb45f.exe	89
PID 2736 wrote to memory of 228	2736	JaffaCakes118_51210ca6a630e9861f566af0209fb45f.exe	89
PID 2736 wrote to memory of 228	2736	JaffaCakes118_51210ca6a630e9861f566af0209fb45f.exe	89

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_51210ca6a630e9861f566af0209fb45f.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_51210ca6a630e9861f566af0209fb45f.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2736
- \??\c:\users\admin\appdata\local\ligripledq
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_51210ca6a630e9861f566af0209fb45f.exe" a -sc:\users\admin\appdata\local\temp\jaffacakes118_51210ca6a630e9861f566af0209fb45f.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:228

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1444 -s 808
  2⤵
  - Program crash
  PID:1360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1444 -ip 1444
1⤵
PID:2568

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3152
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 940
  2⤵
  - Program crash
  PID:4736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3152 -ip 3152
1⤵
PID:3584

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3876
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3876 -s 748
  2⤵
  - Program crash
  PID:2544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3876 -ip 3876
1⤵
PID:4852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\ligripledq

Filesize
21.6MB

MD5
2935203cca1220041b820ed447797dc9

SHA1
4101537b616a0333efcdfd08bc064df91a1510fe

SHA256
0004946dab0586f918439ac2677aa96158f2a108d1c422c1d86364cc3c83836e

SHA512
a8cf7e51b0cb57e8f90fb6a3c06d236c804f843cc5434e64f18aa5a1faeffde883c72ee378e58ab4b6a6774966a82c1911024e58918b34824b366d30d081f796

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
200B

MD5
21b6566d26656d0f71a5b5957afc9917

SHA1
0d7657ac852abd22386831af43c777c57af977f6

SHA256
56e1efe41ed0f47c8e8b4c06001192af5d92191df6bef136a6084dfeb4f301d4

SHA512
cd7d1a5ec439758ef25bddf828b48b38311272981badad08fb3e833bf71409484ebe4638371ba29b1f508148ad20b637b8f0c0db9c92c2cf280ad076b001bd7f

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
300B

MD5
069131b084082870ba9728a114958eec

SHA1
236332287a02c78a5ffc7c11fdc959ecf625023d

SHA256
81cf8dbbc55f5869fce4bdb6fec64d6a14b7b69456b7590a9df7329ff142d91f

SHA512
0d931e02b1732db4fbc951be6947674c683e71edb130c2151346ed25d55d88bbb33f2f6131e13c3dc5ed7ab6cf1996b9dc4b1fbb13f99b124460efb18dbfd067

Download Submit
\??\c:\programdata\application data\storm\update\%sessionname%\uvild.cc3

Filesize
20.1MB

MD5
89c6ff9b1ab1ec7eae22f81d0c52155f

SHA1
c05a80da2c0a38973e966b2369544c173c6c45ac

SHA256
e7b10187dde987face71e1e67cdd06828297a227afc00a3c8ea3ba691e5615a2

SHA512
3c5bbe53bd22193c1b680af21d4e6642128aa14f8c3ae814ed17f0172b239a0a3759bf5fbf7db87eac70ab521a561fa599d0ca6ba74d212cfa40f8764749aeb5

Download Submit
memory/228-8-0x0000000000400000-0x000000000044E2DC-memory.dmp

Filesize
312KB

Download
memory/228-16-0x0000000000400000-0x000000000044E2DC-memory.dmp

Filesize
312KB

Download
memory/1444-17-0x00000000013A0000-0x00000000013A1000-memory.dmp

Filesize
4KB

Download
memory/1444-19-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/2736-7-0x0000000000400000-0x000000000044E2DC-memory.dmp

Filesize
312KB

Download
memory/2736-0-0x0000000000400000-0x000000000044E2DC-memory.dmp

Filesize
312KB

Download
memory/2736-1-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2736-2-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/3152-21-0x0000000001AA0000-0x0000000001AA1000-memory.dmp

Filesize
4KB

Download
memory/3152-24-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/3876-26-0x0000000001DF0000-0x0000000001DF1000-memory.dmp

Filesize
4KB

Download
memory/3876-29-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download