gh0strat | 9f8c346bb1c5255f9bb3db9fe865c0f9bbd1f41945ee111bafeb6bbfe411fa23

Analysis

max time kernel
150s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2025, 01:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_6292b90393a38f5a19a9183a82c3e9a9.exe
Size

105KB
MD5

6292b90393a38f5a19a9183a82c3e9a9
SHA1

73af5a2d77a3e54250862d181d68268f0da3e5f1
SHA256

9f8c346bb1c5255f9bb3db9fe865c0f9bbd1f41945ee111bafeb6bbfe411fa23
SHA512

c143766addc8de6e813d3a67f3ac68fe45b5b53a6f26a655e7c974ad48d0a8eed34e4245b61d947436dd5aad1a8d81da51d4a9d2c63b5359ed8474da2607e9e5
SSDEEP

3072:F8G6SyGxDPgaiT/t0nijg1DBIM9SlWATw+DkUhcUEdWr:+lSyGtorT/10DC2SlWAw+gUhbS0

Score

10^/10

gh0strat discovery persistence rat

Malware Config

Signatures

Gh0st RAT payload 3 IoCs

resource	yara_rule
behavioral2/memory/784-0-0x0000000000400000-0x000000000041C000-memory.dmp	family_gh0strat
behavioral2/files/0x0008000000023d3d-4.dat	family_gh0strat
behavioral2/memory/784-5-0x0000000000400000-0x000000000041C000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibilityex.dll"	JaffaCakes118_6292b90393a38f5a19a9183a82c3e9a9.exe

Deletes itself 1 IoCs

pid	Process
2840	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
2840	svchost.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	svchost.exe
File opened for modification	C:\Windows\SysWOW64\FastUserSwitchingCompatibilityex.dll	JaffaCakes118_6292b90393a38f5a19a9183a82c3e9a9.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6292b90393a38f5a19a9183a82c3e9a9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6292b90393a38f5a19a9183a82c3e9a9.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6292b90393a38f5a19a9183a82c3e9a9.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:784

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s FastUserSwitchingCompatibility
1⤵
- Deletes itself
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\fastuserswitchingcompatibilityex.dll

Filesize
95KB

MD5
2a33aafcf360d513943815e5d2f31c19

SHA1
f94afc83c31a08f2206547c1ac24286a015b0e5d

SHA256
c1bf5c1077753eb62b3354648b042978b89fe14e502944103f423795963bbec2

SHA512
e5ea7b8f4c644e1715b853b81638558fe71f7b247258bd5551a0eea17da15b6efce2d527702a349515c2bf09ebafd12e7ece1ee6fafc979249908f9491c0e70a

Download Submit
memory/784-0-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/784-5-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download