gh0strat | 3f4853b62514c9f3ed4dd8e798605eb284aa21a2b7c506412ef30bae114ec204

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 17:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_3f4853b62514c9f3ed4dd8e798605eb284aa21a2b7c506412ef30bae114ec204.exe
Size 130KB
Sample260925-wb1phssfkd
SHA256 3f4853b62514c9f3ed4dd8e798605eb284aa21a2b7c506412ef30bae114ec204
MD5 b557f2004d7def557bd50799aab48247
SHA1 41fa4f5caba8f6bd064bf61a806cfeb6fc34e02d
SHA512 67d8febd104944bfa45b655a72dafce865ce32f834b045f5ae949fa3800e16f63ada5d292aa9ed345cf2dd57aa14a576844876b55c537f3f23b661798bbc0cce
SSDEEP 3072:U2kiTCHGakO614R51OfUTiWUmdsONtAqGEefz:ULiTCHGaZ6c17NUmKoCqJQz
TLSH
T1B0D37D02FA8540F6E5A5247C14BF773AFA3BEAA846096FC37724DDA54827051F72234B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery gh0strat rat

Malware Config

Signatures

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Gh0st RAT payload 2 IoCs

resource	yara_rule
behavioral2/memory/4636-0-0x0000000000400000-0x0000000000422000-memory.dmp	family_gh0strat
behavioral2/memory/4636-9-0x0000000000400000-0x0000000000422000-memory.dmp	family_gh0strat

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\MyInformations.ini	jaffacakes118_3f4853b62514c9f3ed4dd8e798605eb284aa21a2b7c506412ef30bae114ec204.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_3f4853b62514c9f3ed4dd8e798605eb284aa21a2b7c506412ef30bae114ec204.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2864	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2864	taskkill.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 2864	4636	jaffacakes118_3f4853b62514c9f3ed4dd8e798605eb284aa21a2b7c506412ef30bae114ec204.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_3f4853b62514c9f3ed4dd8e798605eb284aa21a2b7c506412ef30bae114ec204.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_3f4853b62514c9f3ed4dd8e798605eb284aa21a2b7c506412ef30bae114ec204.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /t /im ZhuDongFangYu.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MyInformations.ini

Path C:\Windows\MyInformations.ini
Size 439B
SHA256 855c326ce9c90448bee571ffc263300c9f934ca299f9f7f73ad2c99480e24613
MD5 712176ac66df55835252d02d760ebe59
SHA1 aa4c939085e4ea5a05f0ffc20939ad8be7ca2a06
SHA512 8f2faee2ac65d8d699708777ca67fd7693e1df616b546495223a772409d807eb55bf4b2c72f3721be9062a9c3db7077aefeb3a074c4c9ba3a0396f81dbf4e764
TLSH
T185F0DCA9420144910200E3A304FC99A62DB462AD274CA60CC599C1CACFA0E163798007
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4636-0-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/4636-9-0x0000000000400000-0x0000000000422000-memory.dmp