gh0strat | 449a1158df3aeb57bd1ae6cb39121495069c6da34c80e5bbc6ad25f518fe2a14

Analysis

max time kernel
96s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2025, 14:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_5fb1e921b2c9aae7c2787b218dc7dadf.exe
Size

95KB
MD5

5fb1e921b2c9aae7c2787b218dc7dadf
SHA1

8c81916e147b6c11a61d05eab00c82272a770964
SHA256

449a1158df3aeb57bd1ae6cb39121495069c6da34c80e5bbc6ad25f518fe2a14
SHA512

bee49d64d7fe6cac132050f06233d4e98dd178b61f696fff7acb8e23e04f4536fedcd96277e32043158ef59e34799fca291291441b937cb1d818766c6762f5c7
SSDEEP

1536:KRFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prfltf5kf:KHS4jHS8q/3nTzePCwNUh4E9fLuf

Score

10^/10

gh0strat discovery rat

Malware Config

Signatures

Gh0st RAT payload 5 IoCs

resource	yara_rule
behavioral2/files/0x000400000001e687-15.dat	family_gh0strat
behavioral2/memory/4312-17-0x0000000000400000-0x000000000044E24C-memory.dmp	family_gh0strat
behavioral2/memory/4868-20-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral2/memory/2044-25-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral2/memory/4928-30-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Deletes itself 1 IoCs

pid	Process
4312	hkeidcrqrj

Executes dropped EXE 1 IoCs

pid	Process
4312	hkeidcrqrj

Loads dropped DLL 3 IoCs

pid	Process
4868	svchost.exe
2044	svchost.exe
4928	svchost.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ikyhmhilfl	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\ismaukkjsg	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\ibbtdnmhfc	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
5008	4868	WerFault.exe	93
1548	2044	WerFault.exe	98
3996	4928	WerFault.exe	101

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_5fb1e921b2c9aae7c2787b218dc7dadf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hkeidcrqrj
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4312	hkeidcrqrj
4312	hkeidcrqrj

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeRestorePrivilege	4312	hkeidcrqrj
Token: SeBackupPrivilege	4312	hkeidcrqrj
Token: SeBackupPrivilege	4312	hkeidcrqrj
Token: SeRestorePrivilege	4312	hkeidcrqrj
Token: SeBackupPrivilege	4868	svchost.exe
Token: SeRestorePrivilege	4868	svchost.exe
Token: SeBackupPrivilege	4868	svchost.exe
Token: SeBackupPrivilege	4868	svchost.exe
Token: SeSecurityPrivilege	4868	svchost.exe
Token: SeSecurityPrivilege	4868	svchost.exe
Token: SeBackupPrivilege	4868	svchost.exe
Token: SeBackupPrivilege	4868	svchost.exe
Token: SeSecurityPrivilege	4868	svchost.exe
Token: SeBackupPrivilege	4868	svchost.exe
Token: SeBackupPrivilege	4868	svchost.exe
Token: SeSecurityPrivilege	4868	svchost.exe
Token: SeBackupPrivilege	4868	svchost.exe
Token: SeRestorePrivilege	4868	svchost.exe
Token: SeBackupPrivilege	2044	svchost.exe
Token: SeRestorePrivilege	2044	svchost.exe
Token: SeBackupPrivilege	2044	svchost.exe
Token: SeBackupPrivilege	2044	svchost.exe
Token: SeSecurityPrivilege	2044	svchost.exe
Token: SeSecurityPrivilege	2044	svchost.exe
Token: SeBackupPrivilege	2044	svchost.exe
Token: SeBackupPrivilege	2044	svchost.exe
Token: SeSecurityPrivilege	2044	svchost.exe
Token: SeBackupPrivilege	2044	svchost.exe
Token: SeBackupPrivilege	2044	svchost.exe
Token: SeSecurityPrivilege	2044	svchost.exe
Token: SeBackupPrivilege	2044	svchost.exe
Token: SeRestorePrivilege	2044	svchost.exe
Token: SeBackupPrivilege	4928	svchost.exe
Token: SeRestorePrivilege	4928	svchost.exe
Token: SeBackupPrivilege	4928	svchost.exe
Token: SeBackupPrivilege	4928	svchost.exe
Token: SeSecurityPrivilege	4928	svchost.exe
Token: SeSecurityPrivilege	4928	svchost.exe
Token: SeBackupPrivilege	4928	svchost.exe
Token: SeBackupPrivilege	4928	svchost.exe
Token: SeSecurityPrivilege	4928	svchost.exe
Token: SeBackupPrivilege	4928	svchost.exe
Token: SeBackupPrivilege	4928	svchost.exe
Token: SeSecurityPrivilege	4928	svchost.exe
Token: SeBackupPrivilege	4928	svchost.exe
Token: SeRestorePrivilege	4928	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 4312	5076	JaffaCakes118_5fb1e921b2c9aae7c2787b218dc7dadf.exe	88
PID 5076 wrote to memory of 4312	5076	JaffaCakes118_5fb1e921b2c9aae7c2787b218dc7dadf.exe	88
PID 5076 wrote to memory of 4312	5076	JaffaCakes118_5fb1e921b2c9aae7c2787b218dc7dadf.exe	88

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5fb1e921b2c9aae7c2787b218dc7dadf.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5fb1e921b2c9aae7c2787b218dc7dadf.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5076
- \??\c:\users\admin\appdata\local\hkeidcrqrj
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5fb1e921b2c9aae7c2787b218dc7dadf.exe" a -sc:\users\admin\appdata\local\temp\jaffacakes118_5fb1e921b2c9aae7c2787b218dc7dadf.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4312

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 1100
  2⤵
  - Program crash
  PID:5008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4868 -ip 4868
1⤵
PID:3312

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 928
  2⤵
  - Program crash
  PID:1548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2044 -ip 2044
1⤵
PID:2836

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 920
  2⤵
  - Program crash
  PID:3996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4928 -ip 4928
1⤵
PID:4380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\hkeidcrqrj

Filesize
19.6MB

MD5
1d2ad2708e6e36387c5aae1f9a84149b

SHA1
503ad9ce48e933e44d797f11749d6a51efcc1f1e

SHA256
0c55e60085c76d0813f92ca64b370e0924b7d4fbe65b0e1768112b8f777ae20d

SHA512
f9e30bdb03ec190ad43c65092c67f3e4b1139bd24019bc94b578609d808c76b97c4bae15cc7a77f376b13482dd1d443d6f369ff661193531562a0221de924dc8

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
202B

MD5
4c92ac80de759c86da87a582b301cc1f

SHA1
2e0b01c2b758e9d0ce9a824c3b55c42cdde95fe7

SHA256
11c5586443c183c45a56a7442edc7fbe47af23c99008ce815bdb71ceec6891ef

SHA512
95ad9c54ee236b06c2bac03cf7335d9f46d65efa733e5626db23bda5655a0f1afb7dce803d7df37721af078487fbfa6ecee8a84c537c2d35feb9940a9e085222

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
303B

MD5
ce1e59ff3a45eeab8f87a0fb82c39db1

SHA1
b7901e0adb9f6d06e7282d348063474ff3ced0a5

SHA256
34de6a2057f14450336360aff46966dc6a9c5e4b4914a4fbac362b6e4922a502

SHA512
b02897eb71f2d395a74acc9512ce9d89fa2eb077fcc3862e15ada8205854db6e782519a3ad36ff54496b2b3cd0a9e6d2bb376afc47ec3f50575a5e44ee9646a1

Download Submit
\??\c:\programdata\application data\storm\update\%sessionname%\icigp.cc3

Filesize
22.1MB

MD5
0812d6a3cf2bb59a7d340c6ae992f95e

SHA1
9aac6a0d67741dab0081e0f79d027954a7153ce7

SHA256
5f16b8f067875f52b9496b3269cbe59a3d9d1641e0e61559f2ce20248b8ff371

SHA512
72c2e343f21a976e1495b10e8d8108e48e95a65f789e3c1e34016b7d2066b2ce55760b579fd4853a7194f1aedacd064f15d3af47c6e40172514ba40e15a6637e

Download Submit
memory/2044-25-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/2044-22-0x00000000017F0000-0x00000000017F1000-memory.dmp

Filesize
4KB

Download
memory/4312-10-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/4312-17-0x0000000000400000-0x000000000044E24C-memory.dmp

Filesize
312KB

Download
memory/4312-7-0x0000000000400000-0x000000000044E24C-memory.dmp

Filesize
312KB

Download
memory/4868-18-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

Filesize
4KB

Download
memory/4868-20-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/4928-27-0x00000000011D0000-0x00000000011D1000-memory.dmp

Filesize
4KB

Download
memory/4928-30-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/5076-0-0x0000000000400000-0x000000000044E24C-memory.dmp

Filesize
312KB

Download
memory/5076-12-0x0000000000400000-0x000000000044E24C-memory.dmp

Filesize
312KB

Download
memory/5076-2-0x00000000001D0000-0x00000000001E0000-memory.dmp

Filesize
64KB

Download