gh0strat | 0c2a866840db38ad25d601078e184aa6461da2e7a5b7e7f8eb9cdb60db91361a

Analysis

max time kernel
96s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2025, 09:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_55ded9bd9e12ad04e15717d92365a258.exe
Size

95KB
MD5

55ded9bd9e12ad04e15717d92365a258
SHA1

d38e33dc662677e242836df848cfa0698069584b
SHA256

0c2a866840db38ad25d601078e184aa6461da2e7a5b7e7f8eb9cdb60db91361a
SHA512

c263318f16a461875e19f1755ba1483df0afb1282989d5a6a6b2bfdbdbcdea06ec376d1b1f7255de04d800f5f1e547faa060f353cf5faa1509ee3602216443eb
SSDEEP

1536:cJFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prSynvajHhWx:cfS4jHS8q/3nTzePCwNUh4E9SyCjHhWx

Score

10^/10

gh0strat discovery rat

Malware Config

Signatures

Gh0st RAT payload 5 IoCs

resource	yara_rule
behavioral2/files/0x00060000000229c7-15.dat	family_gh0strat
behavioral2/memory/2828-17-0x0000000000400000-0x000000000044E35C-memory.dmp	family_gh0strat
behavioral2/memory/512-20-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral2/memory/3340-25-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral2/memory/456-30-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Deletes itself 1 IoCs

pid	Process
2828	nodpidtfdu

Executes dropped EXE 1 IoCs

pid	Process
2828	nodpidtfdu

Loads dropped DLL 3 IoCs

pid	Process
512	svchost.exe
3340	svchost.exe
456	svchost.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\ddlcshsaie	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\dmjqcboein	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\duxjkeqcui	svchost.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
440	512	WerFault.exe	95
4580	3340	WerFault.exe	99
4332	456	WerFault.exe	104

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_55ded9bd9e12ad04e15717d92365a258.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nodpidtfdu
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2828	nodpidtfdu
2828	nodpidtfdu

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeRestorePrivilege	2828	nodpidtfdu
Token: SeBackupPrivilege	2828	nodpidtfdu
Token: SeBackupPrivilege	2828	nodpidtfdu
Token: SeRestorePrivilege	2828	nodpidtfdu
Token: SeBackupPrivilege	512	svchost.exe
Token: SeRestorePrivilege	512	svchost.exe
Token: SeBackupPrivilege	512	svchost.exe
Token: SeBackupPrivilege	512	svchost.exe
Token: SeSecurityPrivilege	512	svchost.exe
Token: SeSecurityPrivilege	512	svchost.exe
Token: SeBackupPrivilege	512	svchost.exe
Token: SeBackupPrivilege	512	svchost.exe
Token: SeSecurityPrivilege	512	svchost.exe
Token: SeBackupPrivilege	512	svchost.exe
Token: SeBackupPrivilege	512	svchost.exe
Token: SeSecurityPrivilege	512	svchost.exe
Token: SeBackupPrivilege	512	svchost.exe
Token: SeRestorePrivilege	512	svchost.exe
Token: SeBackupPrivilege	3340	svchost.exe
Token: SeRestorePrivilege	3340	svchost.exe
Token: SeBackupPrivilege	3340	svchost.exe
Token: SeBackupPrivilege	3340	svchost.exe
Token: SeSecurityPrivilege	3340	svchost.exe
Token: SeSecurityPrivilege	3340	svchost.exe
Token: SeBackupPrivilege	3340	svchost.exe
Token: SeBackupPrivilege	3340	svchost.exe
Token: SeSecurityPrivilege	3340	svchost.exe
Token: SeBackupPrivilege	3340	svchost.exe
Token: SeBackupPrivilege	3340	svchost.exe
Token: SeSecurityPrivilege	3340	svchost.exe
Token: SeBackupPrivilege	3340	svchost.exe
Token: SeRestorePrivilege	3340	svchost.exe
Token: SeBackupPrivilege	456	svchost.exe
Token: SeRestorePrivilege	456	svchost.exe
Token: SeBackupPrivilege	456	svchost.exe
Token: SeBackupPrivilege	456	svchost.exe
Token: SeSecurityPrivilege	456	svchost.exe
Token: SeSecurityPrivilege	456	svchost.exe
Token: SeBackupPrivilege	456	svchost.exe
Token: SeBackupPrivilege	456	svchost.exe
Token: SeSecurityPrivilege	456	svchost.exe
Token: SeBackupPrivilege	456	svchost.exe
Token: SeBackupPrivilege	456	svchost.exe
Token: SeSecurityPrivilege	456	svchost.exe
Token: SeBackupPrivilege	456	svchost.exe
Token: SeRestorePrivilege	456	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 2828	2712	JaffaCakes118_55ded9bd9e12ad04e15717d92365a258.exe	89
PID 2712 wrote to memory of 2828	2712	JaffaCakes118_55ded9bd9e12ad04e15717d92365a258.exe	89
PID 2712 wrote to memory of 2828	2712	JaffaCakes118_55ded9bd9e12ad04e15717d92365a258.exe	89

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_55ded9bd9e12ad04e15717d92365a258.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_55ded9bd9e12ad04e15717d92365a258.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2712
- \??\c:\users\admin\appdata\local\nodpidtfdu
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_55ded9bd9e12ad04e15717d92365a258.exe" a -sc:\users\admin\appdata\local\temp\jaffacakes118_55ded9bd9e12ad04e15717d92365a258.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2828

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 512 -s 1088
  2⤵
  - Program crash
  PID:440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 512 -ip 512
1⤵
PID:3644

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3340 -s 884
  2⤵
  - Program crash
  PID:4580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3340 -ip 3340
1⤵
PID:4448

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:456
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 1032
  2⤵
  - Program crash
  PID:4332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 456 -ip 456
1⤵
PID:4520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\nodpidtfdu

Filesize
21.3MB

MD5
b327c3df8724c23f0b152dbba61c7b11

SHA1
8a65d9a11aa8ac942cdf87efc4c7517ac18cf77d

SHA256
b6961bec85c0ebeab204b69d67cd4a660f961da5931d3f72f9a59c4ad63e5562

SHA512
c20dc111b8bf5631a882d3cc6624a5754212a44b9953e2e5d8f54456606c9580f5a4d03d7bce38d2da71f90441186617077219a4798d9b3c13b5463e04252a4d

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
198B

MD5
e6b13b89495b46d03ff723e2a5b65ae0

SHA1
25f30e1e0cae86cf10167d71baf5b9517ca9d9ab

SHA256
acaef45e83a8903c6c2e322fcb72cf8dfcc13865a0ff4504bc6e48222804fc96

SHA512
a01260225881a5eb734b57303f217740db1b8f9c9a86154ba939d12b9ebdb73fc5bf6383455107941ee28a7e8b33c9ba8bb05655f05ea128fc69a8b3c99d1f27

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
297B

MD5
3cac46c5c4c99e59706edfe24a6da4c3

SHA1
b96a594a48b23d0f0817356fb1761a390f646fc7

SHA256
db04c95b200304237dd35e3f8caca975e837c25f76478f902f0d5f40e6ddb757

SHA512
fefbf027c33035e418ee256f4c72fcb188cae20702003dca6d6a60e642c72acf63817a42c0f7ae4bac8194492db83d429f025990a494ebef585af66789505719

Download Submit
\??\c:\programdata\application data\storm\update\%sessionname%\qrtxn.cc3

Filesize
19.0MB

MD5
ace800ca6c78dac6ac04a13a3562ee48

SHA1
9095e103870ec4d3ae50453d75866eff4d15a1c0

SHA256
dd723541b224dcc35a158ef58ba8a8f3faf1a5bae0f5d2d9e2339a11059ac0bb

SHA512
30a1b655f5687878e3c38a848f89915c4d0cd9c72bee7a72ba8602564913d6131cd47d5df105b1110c3c892687eee4dee8697df11799abe9cecbf3e5cc62fe5e

Download Submit
memory/456-30-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/456-27-0x00000000017E0000-0x00000000017E1000-memory.dmp

Filesize
4KB

Download
memory/512-18-0x00000000017D0000-0x00000000017D1000-memory.dmp

Filesize
4KB

Download
memory/512-20-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/2712-2-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/2712-10-0x0000000000400000-0x000000000044E35C-memory.dmp

Filesize
312KB

Download
memory/2712-0-0x0000000000400000-0x000000000044E35C-memory.dmp

Filesize
312KB

Download
memory/2828-12-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/2828-17-0x0000000000400000-0x000000000044E35C-memory.dmp

Filesize
312KB

Download
memory/2828-7-0x0000000000400000-0x000000000044E35C-memory.dmp

Filesize
312KB

Download
memory/3340-25-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/3340-22-0x00000000007F0000-0x00000000007F1000-memory.dmp

Filesize
4KB

Download