gh0strat | 3393d0c0410fbdbad107a362dffc97c7b67682e6e2d257aa82835a685658b34e

Analysis

max time kernel
94s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2025, 06:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_63ab43ccaaaf369951e14507dd5faca8.exe
Size

95KB
MD5

63ab43ccaaaf369951e14507dd5faca8
SHA1

3ced0f9243d8544ebe450a5087f22875d06c516c
SHA256

3393d0c0410fbdbad107a362dffc97c7b67682e6e2d257aa82835a685658b34e
SHA512

757df7c39578725a73a0970cb81a2766d3dc9d528922690f4adbc87e0c91c4e64f3d71fca4a10e7c9de17aa6cb68959d8cf3bd7e541688e6df1847e62f70a53c
SSDEEP

1536:boJFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prV7g8n+iOQ:bofS4jHS8q/3nTzePCwNUh4E9hgViOQ

Score

10^/10

gh0strat discovery rat

Malware Config

Signatures

Gh0st RAT payload 5 IoCs

resource	yara_rule
behavioral2/files/0x000300000001e72c-15.dat	family_gh0strat
behavioral2/memory/1868-17-0x0000000000400000-0x000000000044C60F-memory.dmp	family_gh0strat
behavioral2/memory/2904-20-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral2/memory/4376-25-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral2/memory/3028-30-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Deletes itself 1 IoCs

pid	Process
1868	mwsnbxvrdd

Executes dropped EXE 1 IoCs

pid	Process
1868	mwsnbxvrdd

Loads dropped DLL 3 IoCs

pid	Process
2904	svchost.exe
4376	svchost.exe
3028	svchost.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ykfldanccs	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\yssfkdpapo	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\yssfkdpapo	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1492	2904	WerFault.exe	92
1444	4376	WerFault.exe	97
4720	3028	WerFault.exe	100

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_63ab43ccaaaf369951e14507dd5faca8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mwsnbxvrdd
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1868	mwsnbxvrdd
1868	mwsnbxvrdd

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeRestorePrivilege	1868	mwsnbxvrdd
Token: SeBackupPrivilege	1868	mwsnbxvrdd
Token: SeBackupPrivilege	1868	mwsnbxvrdd
Token: SeRestorePrivilege	1868	mwsnbxvrdd
Token: SeBackupPrivilege	2904	svchost.exe
Token: SeRestorePrivilege	2904	svchost.exe
Token: SeBackupPrivilege	2904	svchost.exe
Token: SeBackupPrivilege	2904	svchost.exe
Token: SeSecurityPrivilege	2904	svchost.exe
Token: SeSecurityPrivilege	2904	svchost.exe
Token: SeBackupPrivilege	2904	svchost.exe
Token: SeBackupPrivilege	2904	svchost.exe
Token: SeSecurityPrivilege	2904	svchost.exe
Token: SeBackupPrivilege	2904	svchost.exe
Token: SeBackupPrivilege	2904	svchost.exe
Token: SeSecurityPrivilege	2904	svchost.exe
Token: SeBackupPrivilege	2904	svchost.exe
Token: SeRestorePrivilege	2904	svchost.exe
Token: SeBackupPrivilege	4376	svchost.exe
Token: SeRestorePrivilege	4376	svchost.exe
Token: SeBackupPrivilege	4376	svchost.exe
Token: SeBackupPrivilege	4376	svchost.exe
Token: SeSecurityPrivilege	4376	svchost.exe
Token: SeSecurityPrivilege	4376	svchost.exe
Token: SeBackupPrivilege	4376	svchost.exe
Token: SeBackupPrivilege	4376	svchost.exe
Token: SeSecurityPrivilege	4376	svchost.exe
Token: SeBackupPrivilege	4376	svchost.exe
Token: SeBackupPrivilege	4376	svchost.exe
Token: SeSecurityPrivilege	4376	svchost.exe
Token: SeBackupPrivilege	4376	svchost.exe
Token: SeRestorePrivilege	4376	svchost.exe
Token: SeBackupPrivilege	3028	svchost.exe
Token: SeRestorePrivilege	3028	svchost.exe
Token: SeBackupPrivilege	3028	svchost.exe
Token: SeBackupPrivilege	3028	svchost.exe
Token: SeSecurityPrivilege	3028	svchost.exe
Token: SeSecurityPrivilege	3028	svchost.exe
Token: SeBackupPrivilege	3028	svchost.exe
Token: SeBackupPrivilege	3028	svchost.exe
Token: SeSecurityPrivilege	3028	svchost.exe
Token: SeBackupPrivilege	3028	svchost.exe
Token: SeBackupPrivilege	3028	svchost.exe
Token: SeSecurityPrivilege	3028	svchost.exe
Token: SeBackupPrivilege	3028	svchost.exe
Token: SeRestorePrivilege	3028	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 1868	5064	JaffaCakes118_63ab43ccaaaf369951e14507dd5faca8.exe	87
PID 5064 wrote to memory of 1868	5064	JaffaCakes118_63ab43ccaaaf369951e14507dd5faca8.exe	87
PID 5064 wrote to memory of 1868	5064	JaffaCakes118_63ab43ccaaaf369951e14507dd5faca8.exe	87

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_63ab43ccaaaf369951e14507dd5faca8.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_63ab43ccaaaf369951e14507dd5faca8.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5064
- \??\c:\users\admin\appdata\local\mwsnbxvrdd
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_63ab43ccaaaf369951e14507dd5faca8.exe" a -sc:\users\admin\appdata\local\temp\jaffacakes118_63ab43ccaaaf369951e14507dd5faca8.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1868

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 860
  2⤵
  - Program crash
  PID:1492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2904 -ip 2904
1⤵
PID:2624

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4376
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 944
  2⤵
  - Program crash
  PID:1444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4376 -ip 4376
1⤵
PID:2420

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 884
  2⤵
  - Program crash
  PID:4720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3028 -ip 3028
1⤵
PID:1860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\mwsnbxvrdd

Filesize
22.5MB

MD5
981a4dccdeb92261db6e869fb6258e27

SHA1
28dea6c7f65968b12e3ea55b11afde4942547e2a

SHA256
0c83d6e7da523c0282cf7383ccb48f590cb1560ecd92c10e8f5bddb1d1b3b379

SHA512
e3c3dd82cc9edd1857405ba6aad0e10df58162c40962bd7c5ad8e34589a71b9e227be5b02fd236ba0a5695a3f5b4c9d0abad68d7ded60848518019a5254cb3e8

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
202B

MD5
2d4fdeff34f80d3c9bb676351db29877

SHA1
9f9981449ef1cbdc3ea4e6da5f356c2ffbb0537f

SHA256
186ea585b4e78a386bbb7e99445caf8686a3231c4c0b4b12ba0d712bb3926d24

SHA512
f8dd44954e982c2903bab36325061799a1a6699f264d9b1c4ae0061ce2d6a7851470ea41ff6035d20746f6091d5a4b4264c1da03bc88833ed3096e4306d6e0bc

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
303B

MD5
a885dbbb085bfb0c7242c1225d249002

SHA1
02da8689c95781dd75ea1243af4101f829d99a0d

SHA256
2caa840c14760d5971d278d26ab693ecc659327228bf010890badb8c850a6b63

SHA512
68255c3cfb28feddbc2586146ac9cf49396f24c43050c5a380d73f04edde7f0567204735f58cb54faf0122fb2a32b4391629977b6792cedcabee459c5e5dbf92

Download Submit
\??\c:\programdata\application data\storm\update\%sessionname%\htucf.cc3

Filesize
23.1MB

MD5
318b4bff84d7afd93c5590f202203162

SHA1
5aa781eb5da009515c63fe74d93695ee30fb5221

SHA256
4d9544e890bfcb677102d88fe73ce1102fb8fe5a5c87c8343214edb0600664db

SHA512
12103f82b2d4bcc2c76da773d8ecc26e8629186dac6201fa0e4fd71776b09c60808412ff9b65bcdfaacc4a9d3d249e18f752b3dca37ccc0cdb68dd9897f26e2f

Download Submit
memory/1868-17-0x0000000000400000-0x000000000044C60F-memory.dmp

Filesize
305KB

Download
memory/1868-12-0x0000000000400000-0x000000000044C60F-memory.dmp

Filesize
305KB

Download
memory/1868-11-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/2904-18-0x0000000001490000-0x0000000001491000-memory.dmp

Filesize
4KB

Download
memory/2904-20-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/3028-27-0x00000000011F0000-0x00000000011F1000-memory.dmp

Filesize
4KB

Download
memory/3028-30-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/4376-22-0x00000000017D0000-0x00000000017D1000-memory.dmp

Filesize
4KB

Download
memory/4376-25-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/5064-0-0x0000000000400000-0x000000000044C60F-memory.dmp

Filesize
305KB

Download
memory/5064-10-0x0000000000400000-0x000000000044C60F-memory.dmp

Filesize
305KB

Download
memory/5064-2-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download