gh0strat | cd927b9524e76119c5dc6aa14b514b139acdabbff28d8ad157d0199a2828a404

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
11/03/2025, 04:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_635331cf1d1cb5fca3bf38eb5474161d.exe
Size

120KB
MD5

635331cf1d1cb5fca3bf38eb5474161d
SHA1

c12cba8301532c5482fd48c4a8024073371a816b
SHA256

cd927b9524e76119c5dc6aa14b514b139acdabbff28d8ad157d0199a2828a404
SHA512

4eeb86fdc5118d98c4487f149d9a7b662f47d571e8bdc5cc96eff3404b888c10a91365a2dbabce7f14b9029a90b6f02d25d993901c575ca3d10be34e5d642ac2
SSDEEP

3072:SdywFltigc3kQEt0NbW8IizUwj/KKN7M4EvL:SdyuYkftm3Iod/KKBM4C

Score

10^/10

gh0strat discovery persistence rat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/files/0x00080000000120fd-24.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QORSVPdoe\Parameters\ServiceDll	JaffaCakes118_635331cf1d1cb5fca3bf38eb5474161d.exe

Loads dropped DLL 6 IoCs

pid	Process
2328	JaffaCakes118_635331cf1d1cb5fca3bf38eb5474161d.exe
2200	svchost.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\wi259466697nd.temp	JaffaCakes118_635331cf1d1cb5fca3bf38eb5474161d.exe
File created	C:\Program Files (x86)\wi259466712nd.temp	JaffaCakes118_635331cf1d1cb5fca3bf38eb5474161d.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\HowArMe.txt	JaffaCakes118_635331cf1d1cb5fca3bf38eb5474161d.exe
File created	C:\Windows\HowArMe.reg	JaffaCakes118_635331cf1d1cb5fca3bf38eb5474161d.exe
File opened for modification	C:\Windows\MySomeInfo.ini	JaffaCakes118_635331cf1d1cb5fca3bf38eb5474161d.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_635331cf1d1cb5fca3bf38eb5474161d.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2328	JaffaCakes118_635331cf1d1cb5fca3bf38eb5474161d.exe
2328	JaffaCakes118_635331cf1d1cb5fca3bf38eb5474161d.exe
2328	JaffaCakes118_635331cf1d1cb5fca3bf38eb5474161d.exe
2328	JaffaCakes118_635331cf1d1cb5fca3bf38eb5474161d.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	2328	JaffaCakes118_635331cf1d1cb5fca3bf38eb5474161d.exe
Token: SeRestorePrivilege	2328	JaffaCakes118_635331cf1d1cb5fca3bf38eb5474161d.exe
Token: SeDebugPrivilege	2200	svchost.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2816	2200	svchost.exe	31
PID 2200 wrote to memory of 2816	2200	svchost.exe	31
PID 2200 wrote to memory of 2816	2200	svchost.exe	31
PID 2200 wrote to memory of 2816	2200	svchost.exe	31
PID 2200 wrote to memory of 2816	2200	svchost.exe	31
PID 2200 wrote to memory of 2816	2200	svchost.exe	31
PID 2200 wrote to memory of 2816	2200	svchost.exe	31

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_635331cf1d1cb5fca3bf38eb5474161d.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_635331cf1d1cb5fca3bf38eb5474161d.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2328

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe c:\windows\system32\winsys.dll,CodeMain QORSVPdoe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\MySomeInfo.ini

Filesize
373B

MD5
7b5744134c9a6d1a439803f059965b91

SHA1
0ffcb81547211b1deb3727f3d6bc8c8f78d1aa23

SHA256
bc78726e6aecbcb6fb4838666b2d6a01d2acde7eef8dc1d95fddca833d1d9559

SHA512
6ed46381cdb868820f78de5b37c1703c0892dc6ca4612734b64e0a26bc8a3567ccf2e2315602f698b7ea1bfe59c7b9a4ab79fe8320f7efbb3380819d5ce683c5

Download Submit
\??\c:\windows\SysWOW64\winsys.dll

Filesize
20.1MB

MD5
c95ef68061e65d0656fc6e955445ddab

SHA1
e9ae69e4653b48e16b9e6a9663decb5d0f264dc8

SHA256
06075e982cb8c2a360701e64959e23598401e91818828a4d9f0ee92a9ba8227c

SHA512
32fe8d51e9445cddf07da62936a115e83ed52809c3b68a89c28ce48e180a78225c519b9f6c1445b3086040927d1c7e39f44b4f25965371e94b472095a5089acd

Download Submit
\Program Files\Internet Explorer\360liveupdate.dll

Filesize
20.0MB

MD5
4acf56d2080b0b9ea225ef69d526867a

SHA1
bb436f9e0c5d511b43df9232fc5f4945cf49db58

SHA256
cbc4156d1ee4de328144ac83a0053258ff593e1eb9782cd31e1e17df1bf7eaa7

SHA512
4c07e567a6d89869c2de7027140149fb8198957a971c51970f2b45c8dff1faba6d2c86011ec3ccffda183c25537172950f51e534ad7094fa1ed3c0f441a8615a

Download Submit
memory/2328-14-0x0000000010000000-0x0000000010005000-memory.dmp

Filesize
20KB

Download
memory/2328-26-0x0000000010000000-0x0000000010005000-memory.dmp

Filesize
20KB

Download