gh0strat | e35d2512c32019682a0fcc223e5139ca52ff4d8cca184b8235b1fc4fadb760f4

Analysis

max time kernel
95s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2025, 19:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_53616e5fe88226e86b5aecdc9299f2e1.exe
Size

188KB
MD5

53616e5fe88226e86b5aecdc9299f2e1
SHA1

a0c1794dc9f497a8d30c8ad64580bd334f670de1
SHA256

e35d2512c32019682a0fcc223e5139ca52ff4d8cca184b8235b1fc4fadb760f4
SHA512

5c244ecc8bc45f4d7f5223d2a8668fd0d25d3efe023681d9a255b6cee5090e729d33553c6e27010c24adf46e3648c8eb36700b0290a0ae4bfd8f2e24afc0955e
SSDEEP

3072:raQ6DgnWX0kdL49APvyfeGynB4YhJ2fwvZavp3ZfuSus5qHsHTl0Fep+0NjP:pAgnWX0wP0cSEjvw5B0UkE

Score

10^/10

gh0strat discovery rat

Malware Config

Signatures

Gh0st RAT payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000700000001dabd-2.dat	family_gh0strat
behavioral2/memory/1752-6-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Loads dropped DLL 1 IoCs

pid	Process
1752	JaffaCakes118_53616e5fe88226e86b5aecdc9299f2e1.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
316	1752	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_53616e5fe88226e86b5aecdc9299f2e1.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeBackupPrivilege	1752	JaffaCakes118_53616e5fe88226e86b5aecdc9299f2e1.exe
Token: SeRestorePrivilege	1752	JaffaCakes118_53616e5fe88226e86b5aecdc9299f2e1.exe
Token: SeBackupPrivilege	1752	JaffaCakes118_53616e5fe88226e86b5aecdc9299f2e1.exe
Token: SeRestorePrivilege	1752	JaffaCakes118_53616e5fe88226e86b5aecdc9299f2e1.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_53616e5fe88226e86b5aecdc9299f2e1.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_53616e5fe88226e86b5aecdc9299f2e1.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1752
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 908
  2⤵
  - Program crash
  PID:316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1752 -ip 1752
1⤵
PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\hdboq\vmfqi.dlc

Filesize
1.0MB

MD5
e96d569a7dff881c14b461a2792aaa52

SHA1
9f9c0219c46a78c16e148f8c2b33b08441f5ecab

SHA256
f18e3724cee2d9637642f33488e70833c50f7b2e6454f0847b63345d0bb22c77

SHA512
7bac6e6073325c7159a980c442dc53b6a524a87d2c635b4c6f1fa37bc8043c2f05949fa1ee65e471658d78aa15c9304e357091852d4918ddaf153c5cca680d7e

Download Submit
memory/1752-6-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download