gh0strat | e35d2512c32019682a0fcc223e5139ca52ff4d8cca184b8235b1fc4fadb760f4

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/03/2025, 19:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_53616e5fe88226e86b5aecdc9299f2e1.exe
Size

188KB
MD5

53616e5fe88226e86b5aecdc9299f2e1
SHA1

a0c1794dc9f497a8d30c8ad64580bd334f670de1
SHA256

e35d2512c32019682a0fcc223e5139ca52ff4d8cca184b8235b1fc4fadb760f4
SHA512

5c244ecc8bc45f4d7f5223d2a8668fd0d25d3efe023681d9a255b6cee5090e729d33553c6e27010c24adf46e3648c8eb36700b0290a0ae4bfd8f2e24afc0955e
SSDEEP

3072:raQ6DgnWX0kdL49APvyfeGynB4YhJ2fwvZavp3ZfuSus5qHsHTl0Fep+0NjP:pAgnWX0wP0cSEjvw5B0UkE

Score

10^/10

gh0strat bootkit discovery persistence rat

Malware Config

Signatures

Gh0st RAT payload 3 IoCs

resource	yara_rule
behavioral1/files/0x0033000000019382-2.dat	family_gh0strat
behavioral1/memory/2996-5-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral1/memory/2996-6-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Loads dropped DLL 1 IoCs

pid	Process
2996	JaffaCakes118_53616e5fe88226e86b5aecdc9299f2e1.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	JaffaCakes118_53616e5fe88226e86b5aecdc9299f2e1.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_53616e5fe88226e86b5aecdc9299f2e1.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	JaffaCakes118_53616e5fe88226e86b5aecdc9299f2e1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	JaffaCakes118_53616e5fe88226e86b5aecdc9299f2e1.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2996	JaffaCakes118_53616e5fe88226e86b5aecdc9299f2e1.exe
2996	JaffaCakes118_53616e5fe88226e86b5aecdc9299f2e1.exe
2996	JaffaCakes118_53616e5fe88226e86b5aecdc9299f2e1.exe
2996	JaffaCakes118_53616e5fe88226e86b5aecdc9299f2e1.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeBackupPrivilege	2996	JaffaCakes118_53616e5fe88226e86b5aecdc9299f2e1.exe
Token: SeRestorePrivilege	2996	JaffaCakes118_53616e5fe88226e86b5aecdc9299f2e1.exe
Token: SeBackupPrivilege	2996	JaffaCakes118_53616e5fe88226e86b5aecdc9299f2e1.exe
Token: SeRestorePrivilege	2996	JaffaCakes118_53616e5fe88226e86b5aecdc9299f2e1.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_53616e5fe88226e86b5aecdc9299f2e1.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_53616e5fe88226e86b5aecdc9299f2e1.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\iyvfm\cwqgu.dlc

Filesize
1.5MB

MD5
f466c7dc02d67cc308c9af33cfe4a238

SHA1
59274dc9943d7d3e2fa770dde6762b9ec5a52a89

SHA256
aaea75c063c5b9d7eb0a424f6dc0fd514a41d67867bd28422349e2db415d6810

SHA512
1ff80b8f75eb82e84023f3e9ea7a14cef0f24fe6086acc923953925c575ed297450f0457a733c0be75c92e22d61ba9422a6950cb8866be86bf950ffeae04999a

Download Submit
memory/2996-5-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/2996-6-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download