gh0strat | ddefffb0574016cf79cf05014e1add9cf02eec25bd571a0efb579e47a07158dc

Analysis

max time kernel
150s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 16:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-GameThief.Win32.Magania.djwf.exe
Size 466KB
Sample261006-tz7fvsdv3p
SHA256 ddefffb0574016cf79cf05014e1add9cf02eec25bd571a0efb579e47a07158dc
MD5 ebb3ced3128906ec715c94c05619e37e
SHA1 110caef62b3a8409d56b745b1d56720ee74d1c7c
SHA512 9c772aedad39ce545ceaf0bb0ce5baec27aa2ce9310bb0e8522ac067d06c9bc64e52b78dd3cf833ef1297119e61ee05e0521e841d6ba38934f7698ba6d25113f
SSDEEP 12288:+IZIJ8lG4wxswXC3AwZMiVuhp63OtP38KIqYhw9rrTbep+:1ZIJ8lG4wHXC3AfDtPrnjbbep+
TLSH
T172A423D98A608FFEDA6C9B778403023B5F3B9E4562D95D5BD1EBC820883311D9B1B306
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

aspackv2 defense_evasion discovery gh0strat persistence rat upx

Malware Config

Signatures

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Gh0st RAT payload 6 IoCs

resource	yara_rule
behavioral2/files/0x000600000001b85a-3.dat	family_gh0strat
behavioral2/memory/2080-9-0x0000000000400000-0x0000000000424000-memory.dmp	family_gh0strat
behavioral2/files/0x000c00000001c569-17.dat	family_gh0strat
behavioral2/memory/2080-18-0x0000000000400000-0x0000000000424000-memory.dmp	family_gh0strat
behavioral2/memory/3492-24-0x0000000010000000-0x0000000010021000-memory.dmp	family_gh0strat
behavioral2/memory/3492-41-0x0000000010000000-0x0000000010021000-memory.dmp	family_gh0strat

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\360svc\Parameters\ServiceDll = "C:\\Documents and Settings\\Local User\\ntuser.dll"	server.exe

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c563-13.dat	aspack_v212_v242

Executes dropped EXE 2 IoCs

pid	Process
2080	server.exe
1888	QQ伴侣.exe

Loads dropped DLL 1 IoCs

pid	Process
3492	svchost.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\VSListview.ocx	QQ伴侣.exe
File opened for modification	C:\Windows\SysWOW64\MSWINSCK.OCX	QQ伴侣.exe
File opened for modification	C:\Windows\SysWOW64\MSINET.OCX	QQ伴侣.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
1888	QQ伴侣.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c563-13.dat	upx
behavioral2/memory/1888-21-0x0000000000400000-0x000000000053B000-memory.dmp	upx
behavioral2/memory/1888-25-0x0000000000400000-0x000000000053B000-memory.dmp	upx
behavioral2/memory/1888-26-0x0000000000400000-0x000000000053B000-memory.dmp	upx
behavioral2/memory/1888-33-0x0000000000400000-0x000000000053B000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
712	1888	WerFault.exe	91

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-GameThief.Win32.Magania.djwf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QQ伴侣.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF95099A-7236-4E65-A271-FCC284DD9EAF}\InprocServer32	QQ伴侣.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	QQ伴侣.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	QQ伴侣.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF95099A-7236-4E65-A271-FCC284DD9EAF}	QQ伴侣.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32	QQ伴侣.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}	QQ伴侣.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ = "MSWINSCK.OCX"	QQ伴侣.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\InprocServer32	QQ伴侣.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF95099A-7236-4E65-A271-FCC284DD9EAF}\InprocServer32\ = "VSListview.ocx"	QQ伴侣.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}	QQ伴侣.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\InprocServer32\ = "MSINET.OCX"	QQ伴侣.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1888	QQ伴侣.exe
1888	QQ伴侣.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5932 wrote to memory of 2080	5932	jaffacakes118_Trojan-GameThief.Win32.Magania.djwf.exe	89
PID 5932 wrote to memory of 1888	5932	jaffacakes118_Trojan-GameThief.Win32.Magania.djwf.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-GameThief.Win32.Magania.djwf.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-GameThief.Win32.Magania.djwf.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5932
- C:\Users\Admin\AppData\Local\Temp\server.exe
  "C:\Users\Admin\AppData\Local\Temp\server.exe"
  2⤵
  - Server Software Component: Terminal Services DLL
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2080
- C:\Users\Admin\AppData\Local\Temp\QQ伴侣.exe
  "C:\Users\Admin\AppData\Local\Temp\QQ伴侣.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:1888
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 452
    3⤵
    - Program crash
    PID:712

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k rpcss
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1888 -ip 1888
1⤵
PID:6044

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k rpcss
1⤵
PID:4812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Credential Access

Discovery

Debugger Evasion

T1622

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

QQ伴侣.exe

Path C:\Users\Admin\AppData\Local\Temp\QQ伴侣.exe
Size 368KB
SHA256 2ac8605224bc6537a41596f51b7dfa29753747eca4a566100d87d72f9426b559
MD5 edef8992d01bd551f0dc3e8c5bce1695
SHA1 093a1209a092ad671f13cb4a79f5b17b60584134
SHA512 76ed2f6fc4267c4c062cb6fce36a24ca55e58741f710afda927981c911cb6cb781d77d602867f0c148bf82e00c9025f0a4ad76f0d80c81f47f80fae69016a817
SSDEEP 6144:8Hws/7LbbwoA+tCfrg/bTtkqlSjxojA7qEUKgpAA9WiEZECOgCMOkRK3NGScgIM:8HXfwoA+fTT/kuLQgl4ZECOgCMOkRIY6
TLSH
T1D38422A337EA5298E9892D366117A3013ED14F28CBDA9F1735D13C3B3AB514047E9A1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

server.exe

Path C:\Users\Admin\AppData\Local\Temp\server.exe
Size 134KB
SHA256 0da961dd0d028ed841729dda1a18f8e7e5d9c042f8504678b71740d2c6734cce
MD5 7846eefade27ee8da71198656d6a5c64
SHA1 83ec9a655a9e717e3bef6eb1b08f3f49b76fee51
SHA512 be23f9d17727e29214748873b55f96af45b17ccfe4b1809127e06767f715943da9a3371e4bfb0502b73b4b354f1802922b059419c34373183a6ea7c42ca42502
SSDEEP 3072:LBVASRH1lqfM4TYZesbO4Qg/eilm379BYfiA+SIML+HsZwUD:LBVASLlqfTY4Vjg/eV/Y6hMLru0
TLSH
T168D37D11FA4181FAE664153878EE7B36EA39BC94A6045F873306FE561C73091BF22367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntuser.dll

Path \??\c:\documents and settings\local user\ntuser.dll
Size 119KB
SHA256 a5da4c7f17b2679850168132eeb049a81b765cc99ff511f516f4e431d5652a8a
MD5 4f40bdf76dd78712750811df70f62eae
SHA1 788c2cfefac5e67bca0196ac50bc3a4d3342503b
SHA512 1e545d8c955f36896c3de4b817020c4247df1e588c9628bf42adddb130ab122188b89c7c6c988b189d51927f0356c03461efcfb7a395470be1c924ea56096bc0
SSDEEP 3072:1lqfM4TYZesbO4Qg/eilm379BYfiA+SIML+HsZwUM:1lqfTY4Vjg/eV/Y6hMLruV
TLSH
T105C38D11F68081FEE6A4153478EA7B369B39AC989B045F877307FE951C731A1BB22347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1888-21-0x0000000000400000-0x000000000053B000-memory.dmp

Download

memory/1888-25-0x0000000000400000-0x000000000053B000-memory.dmp

Download

memory/1888-26-0x0000000000400000-0x000000000053B000-memory.dmp

Download

memory/1888-33-0x0000000000400000-0x000000000053B000-memory.dmp

Download

memory/2080-9-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2080-18-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3492-24-0x0000000010000000-0x0000000010021000-memory.dmp

Download

memory/3492-41-0x0000000010000000-0x0000000010021000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads