gh0strat | 0ed94dd97d1796318a996b2b365f34fb7f1a7b628bc75c8ae5f38b5a0ff620b5

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2025, 21:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_57b9d4c8e561e5787c6cfcfc7aa03503.exe
Size

95KB
MD5

57b9d4c8e561e5787c6cfcfc7aa03503
SHA1

b17af78529930a1b8ca7c0de359d9d942695f4bc
SHA256

0ed94dd97d1796318a996b2b365f34fb7f1a7b628bc75c8ae5f38b5a0ff620b5
SHA512

b98c32a4a28bc3db55e0f10a3e1b307cc3ab6728f70373f1dfbd266255adbb3a88a0b389af4bba62a37bc154c0335422b204eb98b813b08e6551fcfb090ae60d
SSDEEP

1536:GKFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prllACmZQJHcEDE:GQS4jHS8q/3nTzePCwNUh4E9PbjE

Score

10^/10

gh0strat discovery rat

Malware Config

Signatures

Gh0st RAT payload 5 IoCs

resource	yara_rule
behavioral2/files/0x000c000000023c0b-15.dat	family_gh0strat
behavioral2/memory/1892-17-0x0000000000400000-0x000000000044E2DC-memory.dmp	family_gh0strat
behavioral2/memory/1928-20-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral2/memory/1880-25-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral2/memory/3864-30-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Deletes itself 1 IoCs

pid	Process
1892	kxwjpiujlx

Executes dropped EXE 1 IoCs

pid	Process
1892	kxwjpiujlx

Loads dropped DLL 3 IoCs

pid	Process
1928	svchost.exe
1880	svchost.exe
3864	svchost.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mrniufabsf	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\mbbbdidygb	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\mjptllfwtv	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1528	1928	WerFault.exe	95
3516	1880	WerFault.exe	100
1404	3864	WerFault.exe	103

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_57b9d4c8e561e5787c6cfcfc7aa03503.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kxwjpiujlx
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1892	kxwjpiujlx
1892	kxwjpiujlx

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeRestorePrivilege	1892	kxwjpiujlx
Token: SeBackupPrivilege	1892	kxwjpiujlx
Token: SeBackupPrivilege	1892	kxwjpiujlx
Token: SeRestorePrivilege	1892	kxwjpiujlx
Token: SeBackupPrivilege	1928	svchost.exe
Token: SeRestorePrivilege	1928	svchost.exe
Token: SeBackupPrivilege	1928	svchost.exe
Token: SeBackupPrivilege	1928	svchost.exe
Token: SeSecurityPrivilege	1928	svchost.exe
Token: SeSecurityPrivilege	1928	svchost.exe
Token: SeBackupPrivilege	1928	svchost.exe
Token: SeBackupPrivilege	1928	svchost.exe
Token: SeSecurityPrivilege	1928	svchost.exe
Token: SeBackupPrivilege	1928	svchost.exe
Token: SeBackupPrivilege	1928	svchost.exe
Token: SeSecurityPrivilege	1928	svchost.exe
Token: SeBackupPrivilege	1928	svchost.exe
Token: SeRestorePrivilege	1928	svchost.exe
Token: SeBackupPrivilege	1880	svchost.exe
Token: SeRestorePrivilege	1880	svchost.exe
Token: SeBackupPrivilege	1880	svchost.exe
Token: SeBackupPrivilege	1880	svchost.exe
Token: SeSecurityPrivilege	1880	svchost.exe
Token: SeSecurityPrivilege	1880	svchost.exe
Token: SeBackupPrivilege	1880	svchost.exe
Token: SeBackupPrivilege	1880	svchost.exe
Token: SeSecurityPrivilege	1880	svchost.exe
Token: SeBackupPrivilege	1880	svchost.exe
Token: SeBackupPrivilege	1880	svchost.exe
Token: SeSecurityPrivilege	1880	svchost.exe
Token: SeBackupPrivilege	1880	svchost.exe
Token: SeRestorePrivilege	1880	svchost.exe
Token: SeBackupPrivilege	3864	svchost.exe
Token: SeRestorePrivilege	3864	svchost.exe
Token: SeBackupPrivilege	3864	svchost.exe
Token: SeBackupPrivilege	3864	svchost.exe
Token: SeSecurityPrivilege	3864	svchost.exe
Token: SeSecurityPrivilege	3864	svchost.exe
Token: SeBackupPrivilege	3864	svchost.exe
Token: SeBackupPrivilege	3864	svchost.exe
Token: SeSecurityPrivilege	3864	svchost.exe
Token: SeBackupPrivilege	3864	svchost.exe
Token: SeBackupPrivilege	3864	svchost.exe
Token: SeSecurityPrivilege	3864	svchost.exe
Token: SeBackupPrivilege	3864	svchost.exe
Token: SeRestorePrivilege	3864	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 1892	2664	JaffaCakes118_57b9d4c8e561e5787c6cfcfc7aa03503.exe	89
PID 2664 wrote to memory of 1892	2664	JaffaCakes118_57b9d4c8e561e5787c6cfcfc7aa03503.exe	89
PID 2664 wrote to memory of 1892	2664	JaffaCakes118_57b9d4c8e561e5787c6cfcfc7aa03503.exe	89

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_57b9d4c8e561e5787c6cfcfc7aa03503.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_57b9d4c8e561e5787c6cfcfc7aa03503.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2664
- \??\c:\users\admin\appdata\local\kxwjpiujlx
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_57b9d4c8e561e5787c6cfcfc7aa03503.exe" a -sc:\users\admin\appdata\local\temp\jaffacakes118_57b9d4c8e561e5787c6cfcfc7aa03503.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1892

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 788
  2⤵
  - Program crash
  PID:1528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1928 -ip 1928
1⤵
PID:1552

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1880
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1880 -s 772
  2⤵
  - Program crash
  PID:3516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1880 -ip 1880
1⤵
PID:4088

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3864
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3864 -s 1100
  2⤵
  - Program crash
  PID:1404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3864 -ip 3864
1⤵
PID:4712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\svchost.exe.txt

Filesize
202B

MD5
b22d4b5995f71fe864000a1fc87f3e26

SHA1
df2fa165f393b6d19e6c08df6d4cf74e9d2e7828

SHA256
80157c4bd6c655cd496747a3c1c1de8cd4af357feb60ca2781d5e21c9c3b7b76

SHA512
cce92ff1ce43aaa5f278904bf9ce20829e6a257864a6f315102688371fd95d747f1084b52a1e8ce4e6e07321f847d0b274d145c06e258551d5372b70e39b672e

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
303B

MD5
a8c87dc7f428c2567cb702ab73492a28

SHA1
3e8802e143a6628a8692510e3565ce236512b2a8

SHA256
055b000a311969b727ce71987c1183b16f29a7bc5cb18da4fb4141b8b02246b8

SHA512
309f3d9ce8aecfda45adcebb126f8755cc5334e6d30d995aa00ea89d31b3feaab694385f7e026a901f3956d41a8545e0152893b7ea1c4985f9319f13ddc824b0

Download Submit
\??\c:\programdata\application data\storm\update\%sessionname%\wlqcd.cc3

Filesize
20.0MB

MD5
43378d44387f3b9736c09ac271f7d144

SHA1
4ca5eab3c7ae680144694d838b0190fe83be73c2

SHA256
fb5572ec77cffcd7003dc3b5393e13fbdcafa100243889ceff4617d43a694133

SHA512
6f3ecdca874fb187f865ce0b187a23ab8a409699bc4db8fc4415d721499549438a6e4b16b9a9e4b4ad8e442c1505bf00b1b4ae4d24fa87dc71d0a0fb334a5210

Download Submit
\??\c:\users\admin\appdata\local\kxwjpiujlx

Filesize
21.0MB

MD5
d6527c0369295c8aac7cca8359283319

SHA1
bf86fab8175b39f6749a1de45d5abb49fd11d6f1

SHA256
427942e06bb9ee300391faed8d7ae915ecf0bbc7f92cdf28f07c1b0b3dc45fe7

SHA512
a1288ffb1715a31fb2e32180d8d62d820aa924696dd6fb2f664e966436b8342246246ab9278ba34bb95ee7911e6aef9f3e23b336f1daa1bf62b85cf2f47d85fe

Download Submit
memory/1880-25-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/1880-22-0x00000000013D0000-0x00000000013D1000-memory.dmp

Filesize
4KB

Download
memory/1892-12-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1892-17-0x0000000000400000-0x000000000044E2DC-memory.dmp

Filesize
312KB

Download
memory/1892-7-0x0000000000400000-0x000000000044E2DC-memory.dmp

Filesize
312KB

Download
memory/1928-18-0x00000000011D0000-0x00000000011D1000-memory.dmp

Filesize
4KB

Download
memory/1928-20-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/2664-10-0x0000000000400000-0x000000000044E2DC-memory.dmp

Filesize
312KB

Download
memory/2664-0-0x0000000000400000-0x000000000044E2DC-memory.dmp

Filesize
312KB

Download
memory/2664-2-0x00000000001D0000-0x00000000001E0000-memory.dmp

Filesize
64KB

Download
memory/3864-27-0x0000000000FD0000-0x0000000000FD1000-memory.dmp

Filesize
4KB

Download
memory/3864-30-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download