gh0strat | 2a9868299a50d7fc4776e4848c20fe29645143eaa11cf8385b017cc076f8a9d7

Analysis

max time kernel
93s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2025, 03:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_62d30a0fb6d882c87f76f5884995a403.exe
Size

95KB
MD5

62d30a0fb6d882c87f76f5884995a403
SHA1

e3a71cf27afabea262351a1ae4b57fe8519a75d0
SHA256

2a9868299a50d7fc4776e4848c20fe29645143eaa11cf8385b017cc076f8a9d7
SHA512

a6393e1a1d0c341a5be8027b36aab46e7203750e84047aee961b8c4614f0050dfdeb8c0286d62555fb51c016b209542886d8e9d631f9cea21d7088d3212cc88a
SSDEEP

1536:SYFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prFm2d11V:SKS4jHS8q/3nTzePCwNUh4E9Fm2d11V

Score

10^/10

gh0strat discovery rat

Malware Config

Signatures

Gh0st RAT payload 5 IoCs

resource	yara_rule
behavioral2/files/0x000200000001e922-15.dat	family_gh0strat
behavioral2/memory/3116-17-0x0000000000400000-0x000000000044E478-memory.dmp	family_gh0strat
behavioral2/memory/4900-20-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral2/memory/3688-25-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral2/memory/3180-30-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Deletes itself 1 IoCs

pid	Process
3116	jrmlievtrt

Executes dropped EXE 1 IoCs

pid	Process
3116	jrmlievtrt

Loads dropped DLL 3 IoCs

pid	Process
4900	svchost.exe
3688	svchost.exe
3180	svchost.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\uejfurhcde	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\uejfurhcde	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\umxxdujypy	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2648	4900	WerFault.exe	96
2600	3688	WerFault.exe	100
2488	3180	WerFault.exe	103

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_62d30a0fb6d882c87f76f5884995a403.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jrmlievtrt
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3116	jrmlievtrt
3116	jrmlievtrt

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeRestorePrivilege	3116	jrmlievtrt
Token: SeBackupPrivilege	3116	jrmlievtrt
Token: SeBackupPrivilege	3116	jrmlievtrt
Token: SeRestorePrivilege	3116	jrmlievtrt
Token: SeBackupPrivilege	4900	svchost.exe
Token: SeRestorePrivilege	4900	svchost.exe
Token: SeBackupPrivilege	4900	svchost.exe
Token: SeBackupPrivilege	4900	svchost.exe
Token: SeSecurityPrivilege	4900	svchost.exe
Token: SeSecurityPrivilege	4900	svchost.exe
Token: SeBackupPrivilege	4900	svchost.exe
Token: SeBackupPrivilege	4900	svchost.exe
Token: SeSecurityPrivilege	4900	svchost.exe
Token: SeBackupPrivilege	4900	svchost.exe
Token: SeBackupPrivilege	4900	svchost.exe
Token: SeSecurityPrivilege	4900	svchost.exe
Token: SeBackupPrivilege	4900	svchost.exe
Token: SeRestorePrivilege	4900	svchost.exe
Token: SeBackupPrivilege	3688	svchost.exe
Token: SeRestorePrivilege	3688	svchost.exe
Token: SeBackupPrivilege	3688	svchost.exe
Token: SeBackupPrivilege	3688	svchost.exe
Token: SeSecurityPrivilege	3688	svchost.exe
Token: SeSecurityPrivilege	3688	svchost.exe
Token: SeBackupPrivilege	3688	svchost.exe
Token: SeBackupPrivilege	3688	svchost.exe
Token: SeSecurityPrivilege	3688	svchost.exe
Token: SeBackupPrivilege	3688	svchost.exe
Token: SeBackupPrivilege	3688	svchost.exe
Token: SeSecurityPrivilege	3688	svchost.exe
Token: SeBackupPrivilege	3688	svchost.exe
Token: SeRestorePrivilege	3688	svchost.exe
Token: SeBackupPrivilege	3180	svchost.exe
Token: SeRestorePrivilege	3180	svchost.exe
Token: SeBackupPrivilege	3180	svchost.exe
Token: SeBackupPrivilege	3180	svchost.exe
Token: SeSecurityPrivilege	3180	svchost.exe
Token: SeSecurityPrivilege	3180	svchost.exe
Token: SeBackupPrivilege	3180	svchost.exe
Token: SeBackupPrivilege	3180	svchost.exe
Token: SeSecurityPrivilege	3180	svchost.exe
Token: SeBackupPrivilege	3180	svchost.exe
Token: SeBackupPrivilege	3180	svchost.exe
Token: SeSecurityPrivilege	3180	svchost.exe
Token: SeBackupPrivilege	3180	svchost.exe
Token: SeRestorePrivilege	3180	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3780 wrote to memory of 3116	3780	JaffaCakes118_62d30a0fb6d882c87f76f5884995a403.exe	90
PID 3780 wrote to memory of 3116	3780	JaffaCakes118_62d30a0fb6d882c87f76f5884995a403.exe	90
PID 3780 wrote to memory of 3116	3780	JaffaCakes118_62d30a0fb6d882c87f76f5884995a403.exe	90

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_62d30a0fb6d882c87f76f5884995a403.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_62d30a0fb6d882c87f76f5884995a403.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3780
- \??\c:\users\admin\appdata\local\jrmlievtrt
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_62d30a0fb6d882c87f76f5884995a403.exe" a -sc:\users\admin\appdata\local\temp\jaffacakes118_62d30a0fb6d882c87f76f5884995a403.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3116

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4900
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4900 -s 860
  2⤵
  - Program crash
  PID:2648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4900 -ip 4900
1⤵
PID:3268

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3688
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 832
  2⤵
  - Program crash
  PID:2600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3688 -ip 3688
1⤵
PID:4388

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3180
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 928
  2⤵
  - Program crash
  PID:2488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3180 -ip 3180
1⤵
PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\jrmlievtrt

Filesize
24.2MB

MD5
c653416c6fa2c7c83146d85c30b87725

SHA1
6e61532105e67dad06e96c2e1b60bb4b4e0b86b6

SHA256
78efb6384be8560324a8d9b2e74b1f620f36a906240da72eb4d4d9a3b5f7a443

SHA512
e8174cf9cd2f04dc917c62140cc000d45b1cd6af42a217785905181e91f447470ba7c0075b2469b5f7556a7d208230a84e078297bbe6426117140c38238c2f6c

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
200B

MD5
afa156e0977d346f5350c43226f8df1b

SHA1
f1c25fc032d1f180346ec54b5bad73b5f6c7ed21

SHA256
d209cc0169cc00518c8a5da9b063fd1be3834699c3b4efac3c10723d43468553

SHA512
4f28b37870e6ea1c8677019144e0c24be34492e98d2543cb4a50bb5fba91edca62768266d788aade6e39768383f895fd52148846275381d12cfe653628887053

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
300B

MD5
f6db951493c2fa46c5bda07f3fb9df78

SHA1
441d1236bef59394b96ad60685cdd6c636f5a0ff

SHA256
aa98710d45b2ef53f5006b8e8129148416ee1f91dd5e73f29feaabefd07d0fe7

SHA512
502c7d564ba7f89951379d77b7ada6d1b27858c7aeb1d7dc11125c9ead5b251094e404ed6e4cf3a0fe66b6f2e080a68f3fbf624f770246da9bb6a75649741d98

Download Submit
\??\c:\programdata\application data\storm\update\%sessionname%\ymnuf.cc3

Filesize
21.0MB

MD5
097ec4c460cbad4a562d362ddc3ecd59

SHA1
4c204f78abcd75aef45d5a0e1bdaa9b29a00412e

SHA256
2373199400e3e2119d6029c91eca66b72c54f7bd898cf0eb43ec00a8447c0229

SHA512
1e7d771962a9d4803f37abea34cba2a7dc006fb8678afc8f562145dc77e626ff1eb62f00d0bcb5e4ea46d3e9ebe0f17f19e949bd8b6eb152623fe74489d67bdd

Download Submit
memory/3116-7-0x0000000000400000-0x000000000044E478-memory.dmp

Filesize
313KB

Download
memory/3116-12-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/3116-17-0x0000000000400000-0x000000000044E478-memory.dmp

Filesize
313KB

Download
memory/3180-30-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/3180-27-0x00000000017F0000-0x00000000017F1000-memory.dmp

Filesize
4KB

Download
memory/3688-25-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/3688-22-0x0000000001E80000-0x0000000001E81000-memory.dmp

Filesize
4KB

Download
memory/3780-10-0x0000000000400000-0x000000000044E478-memory.dmp

Filesize
313KB

Download
memory/3780-0-0x0000000000400000-0x000000000044E478-memory.dmp

Filesize
313KB

Download
memory/3780-2-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/4900-20-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/4900-18-0x00000000011E0000-0x00000000011E1000-memory.dmp

Filesize
4KB

Download