gh0strat | 3a62c25407891f069edbfd3c218ff8cccd611d71e2da0bee71cecc68924cec42

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/03/2025, 11:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_561bb28056f61048faf596d137adff1f.exe
Size

197KB
MD5

561bb28056f61048faf596d137adff1f
SHA1

832e1db0361c6983c0867c7b1bfb50af72ac1383
SHA256

3a62c25407891f069edbfd3c218ff8cccd611d71e2da0bee71cecc68924cec42
SHA512

0fe8de8c0e4163ca9d9a718c4d48dc30cff2f799977bbb01336907e6e7b1602b663d99e54843bbd9fea7ddb0a39967bcfdd116690b4a88f08d173a10c57ecf5e
SSDEEP

6144:nOVLnWFc/FtsFkVRTl0QdTmNPPYhtUeqPZ:n8LWFq+kV1KIo+hYZ

Score

10^/10

gh0strat discovery rat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/files/0x000a0000000162e4-2.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Loads dropped DLL 3 IoCs

pid	Process
2092	svchost.exe
2408	svchost.exe
2288	svchost.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\%SESSIONNAME%\epusf.pic	JaffaCakes118_561bb28056f61048faf596d137adff1f.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_561bb28056f61048faf596d137adff1f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2380	JaffaCakes118_561bb28056f61048faf596d137adff1f.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	2380	JaffaCakes118_561bb28056f61048faf596d137adff1f.exe
Token: SeBackupPrivilege	2380	JaffaCakes118_561bb28056f61048faf596d137adff1f.exe
Token: SeBackupPrivilege	2380	JaffaCakes118_561bb28056f61048faf596d137adff1f.exe
Token: SeRestorePrivilege	2380	JaffaCakes118_561bb28056f61048faf596d137adff1f.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_561bb28056f61048faf596d137adff1f.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_561bb28056f61048faf596d137adff1f.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2380

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2092

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2408

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k regsvc
1⤵
PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\program files (x86)\%sessionname%\epusf.pic

Filesize
21.0MB

MD5
62ae70d4309455f4f4d846200d241db3

SHA1
c0b6f4b21f16d35d08b17f268f34d355f56ca067

SHA256
58cd2080d31fa886cbeaa97c892fefddb9161e2eab75d5693f9e8889fed5b640

SHA512
6e02060b1221faf3b66da453a4c3dad612677120c06a5d0d6d52b7c855ab574408b8aa79b83a66c4d87425179cf855774537c35d609ab5217b34c8603f60290c

Download Submit