gh0strat | 22e198688165496c82dced60fd7c40b988f8b8655fd1d5216a7888abae31d03d

Analysis

max time kernel
94s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2025, 18:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_60ac8d1d1dab910ea8482856dd87e1b5.exe
Size

95KB
MD5

60ac8d1d1dab910ea8482856dd87e1b5
SHA1

5bc7956bdcc612ee140f7a813230b1f4bdddd9d1
SHA256

22e198688165496c82dced60fd7c40b988f8b8655fd1d5216a7888abae31d03d
SHA512

8bb36c5fc202c1d8bbce9ce4f7b4bc5c925c6dcd468b95533a3b7fd810d555713615c2e054446766e03f06f4646bce69851a7e8fdc2524392e681a09f3cfef85
SSDEEP

1536:NHFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prRj9kIW:NxS4jHS8q/3nTzePCwNUh4E9RpkIW

Score

10^/10

gh0strat discovery rat

Malware Config

Signatures

Gh0st RAT payload 5 IoCs

resource	yara_rule
behavioral2/files/0x000300000001e724-15.dat	family_gh0strat
behavioral2/memory/4988-17-0x0000000000400000-0x000000000044E2E4-memory.dmp	family_gh0strat
behavioral2/memory/4520-20-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral2/memory/4916-25-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral2/memory/3432-30-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Deletes itself 1 IoCs

pid	Process
4988	ghuyxpodow

Executes dropped EXE 1 IoCs

pid	Process
4988	ghuyxpodow

Loads dropped DLL 3 IoCs

pid	Process
4520	svchost.exe
4916	svchost.exe
3432	svchost.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\qvjudqfhcn	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\qexnlthfpi	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\qmmhtwkdcd	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1108	4520	WerFault.exe	95
4804	4916	WerFault.exe	101
4416	3432	WerFault.exe	104

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_60ac8d1d1dab910ea8482856dd87e1b5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ghuyxpodow

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4988	ghuyxpodow
4988	ghuyxpodow

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeRestorePrivilege	4988	ghuyxpodow
Token: SeBackupPrivilege	4988	ghuyxpodow
Token: SeBackupPrivilege	4988	ghuyxpodow
Token: SeRestorePrivilege	4988	ghuyxpodow
Token: SeBackupPrivilege	4520	svchost.exe
Token: SeRestorePrivilege	4520	svchost.exe
Token: SeBackupPrivilege	4520	svchost.exe
Token: SeBackupPrivilege	4520	svchost.exe
Token: SeSecurityPrivilege	4520	svchost.exe
Token: SeSecurityPrivilege	4520	svchost.exe
Token: SeBackupPrivilege	4520	svchost.exe
Token: SeBackupPrivilege	4520	svchost.exe
Token: SeSecurityPrivilege	4520	svchost.exe
Token: SeBackupPrivilege	4520	svchost.exe
Token: SeBackupPrivilege	4520	svchost.exe
Token: SeSecurityPrivilege	4520	svchost.exe
Token: SeBackupPrivilege	4520	svchost.exe
Token: SeRestorePrivilege	4520	svchost.exe
Token: SeBackupPrivilege	4916	svchost.exe
Token: SeRestorePrivilege	4916	svchost.exe
Token: SeBackupPrivilege	4916	svchost.exe
Token: SeBackupPrivilege	4916	svchost.exe
Token: SeSecurityPrivilege	4916	svchost.exe
Token: SeSecurityPrivilege	4916	svchost.exe
Token: SeBackupPrivilege	4916	svchost.exe
Token: SeBackupPrivilege	4916	svchost.exe
Token: SeSecurityPrivilege	4916	svchost.exe
Token: SeBackupPrivilege	4916	svchost.exe
Token: SeBackupPrivilege	4916	svchost.exe
Token: SeSecurityPrivilege	4916	svchost.exe
Token: SeBackupPrivilege	4916	svchost.exe
Token: SeRestorePrivilege	4916	svchost.exe
Token: SeBackupPrivilege	3432	svchost.exe
Token: SeRestorePrivilege	3432	svchost.exe
Token: SeBackupPrivilege	3432	svchost.exe
Token: SeBackupPrivilege	3432	svchost.exe
Token: SeSecurityPrivilege	3432	svchost.exe
Token: SeSecurityPrivilege	3432	svchost.exe
Token: SeBackupPrivilege	3432	svchost.exe
Token: SeBackupPrivilege	3432	svchost.exe
Token: SeSecurityPrivilege	3432	svchost.exe
Token: SeBackupPrivilege	3432	svchost.exe
Token: SeBackupPrivilege	3432	svchost.exe
Token: SeSecurityPrivilege	3432	svchost.exe
Token: SeBackupPrivilege	3432	svchost.exe
Token: SeRestorePrivilege	3432	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 4988	1740	JaffaCakes118_60ac8d1d1dab910ea8482856dd87e1b5.exe	89
PID 1740 wrote to memory of 4988	1740	JaffaCakes118_60ac8d1d1dab910ea8482856dd87e1b5.exe	89
PID 1740 wrote to memory of 4988	1740	JaffaCakes118_60ac8d1d1dab910ea8482856dd87e1b5.exe	89

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_60ac8d1d1dab910ea8482856dd87e1b5.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_60ac8d1d1dab910ea8482856dd87e1b5.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1740
- \??\c:\users\admin\appdata\local\ghuyxpodow
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_60ac8d1d1dab910ea8482856dd87e1b5.exe" a -sc:\users\admin\appdata\local\temp\jaffacakes118_60ac8d1d1dab910ea8482856dd87e1b5.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4988

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4520
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4520 -s 1048
  2⤵
  - Program crash
  PID:1108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4520 -ip 4520
1⤵
PID:3144

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4916
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4916 -s 1104
  2⤵
  - Program crash
  PID:4804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4916 -ip 4916
1⤵
PID:460

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3432
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3432 -s 948
  2⤵
  - Program crash
  PID:4416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3432 -ip 3432
1⤵
PID:4088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\svchost.exe.txt

Filesize
204B

MD5
fa8789153207f0bc7bf835206b344ae9

SHA1
4d0a0fa56cd9cfb3ac868d03f37b7daa5dc44b9b

SHA256
5a8bf98dea9fc4a54927c37d65d55f7f72d8b4ee10513cfe96347069a4c3e844

SHA512
5d7f1ce64a4948cef9174ff6ea9ef3e25dd2764b80335ae9342cba91c868f47d8d3e475d13022d3bbfab9974c5291f0e9d8e316302334161933ea7e798454bc6

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
306B

MD5
1ac8289cc7d178c30cecdc0ed43f56fc

SHA1
6e86ed549fc648e16f4dd01559b67ef5f7d539da

SHA256
24ef6855d0b7f2abe797bc773d7ddd4453f902277670b5a1c059647d9ec86c5d

SHA512
1ea0df95799c6bc8b1eaad06ee0203eab9b41fb684b7715b6d0aae40d243bea8b49ea11cf8522507945fde37943f2450ec9b96c108add2a32c1a351be172236b

Download Submit
\??\c:\programdata\application data\storm\update\%sessionname%\wslgt.cc3

Filesize
23.0MB

MD5
6599da5f69cedc24b05b89e79256649c

SHA1
5fc07434af849ae5718c7fe9490d10a4eb6ddcc2

SHA256
c96ff3721cf3c7cf6f55d0625d81ab9e9170c437f5f090aee35a736bcd5bc1f7

SHA512
0f8c7535a42e4b52ed6a538944dc3ba20a1e8870f55bf14f14cbeeeb38b1dda0287be9ffb75160453a0b81088776096039679e571d3b9881160270ed59942b03

Download Submit
\??\c:\users\admin\appdata\local\ghuyxpodow

Filesize
24.9MB

MD5
b8a95a3b872103a241bbd09df837e67d

SHA1
2cea10b1dc5c4dd0b55dc5703f738508cb614851

SHA256
a75011588ecb177f6921fd852fb2782377615ebd7b83a0523167cc31a5f452d6

SHA512
028b9fce6018558e0b7b69ef6147dd77a0bed7ed761703aff9653e0d7ff5a972f25b5bd251e9303678bd632428021786dea4e5585e1a69f5b1fdd2147285be2d

Download Submit
memory/1740-2-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1740-10-0x0000000000400000-0x000000000044E2E4-memory.dmp

Filesize
312KB

Download
memory/1740-0-0x0000000000400000-0x000000000044E2E4-memory.dmp

Filesize
312KB

Download
memory/3432-30-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/3432-27-0x0000000001AC0000-0x0000000001AC1000-memory.dmp

Filesize
4KB

Download
memory/4520-18-0x0000000001BE0000-0x0000000001BE1000-memory.dmp

Filesize
4KB

Download
memory/4520-20-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/4916-25-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/4916-22-0x00000000020D0000-0x00000000020D1000-memory.dmp

Filesize
4KB

Download
memory/4988-17-0x0000000000400000-0x000000000044E2E4-memory.dmp

Filesize
312KB

Download
memory/4988-11-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/4988-12-0x0000000000400000-0x000000000044E2E4-memory.dmp

Filesize
312KB

Download