gh0strat | 99956cd96a220cdec3f3e7c65bf40e504d62b878733ec84cc4d6d0bc78d8741e

Analysis

max time kernel
150s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
04/03/2025, 11:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

941破解58G宇宙加速器/941破解58G宇宙加速器.exe
Size

1.5MB
MD5

d5016ca94c3e3beac7631c6fa23c5b6e
SHA1

3b74eaf4d380723accd848072ccbde71dcf58e93
SHA256

2aef16116d3b4b82dcbc7a7b57a7ee06521656d36d396e0d865b5deb70a103aa
SHA512

794aef7305195d8cc44e1c39978014673bcf21a22c2c435b4eff8a9cbc5d2a8db944ddd396cf5ba860b261fef6062b37be18c05b38be7931c9d50c59a35936ad
SSDEEP

24576:2l3rNrwWD2ZmXJAcDEjrbnhlbh+GPdW5hvZdM/N5Xp:2l3prC05IfnhJhFeRap

Score

10^/10

gh0strat discovery rat upx

Malware Config

Signatures

Gh0st RAT payload 3 IoCs

resource	yara_rule
behavioral2/files/0x000400000001da5b-51.dat	family_gh0strat
behavioral2/files/0x000400000001da5d-56.dat	family_gh0strat
behavioral2/files/0x000b00000001edb1-65.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Executes dropped EXE 1 IoCs

pid	Process
5040	shurufa.ime

Loads dropped DLL 2 IoCs

pid	Process
5040	shurufa.ime
3160	svchost.exe

UPX packed file 27 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1012-0-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1012-47-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1012-29-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1012-17-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1012-44-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1012-42-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1012-39-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1012-38-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1012-35-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1012-33-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1012-31-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1012-48-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1012-27-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1012-25-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1012-23-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1012-21-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1012-19-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1012-9-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1012-5-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1012-15-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1012-13-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1012-11-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1012-7-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1012-4-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1012-3-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1012-2-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1012-55-0x0000000010000000-0x000000001003D000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Smhk\Fmanekhgi.pic	shurufa.ime
File created	C:\Program Files (x86)\Smhk\Fmanekhgi.pic	shurufa.ime

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4280	1012	WerFault.exe	85
1976	1012	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	941破解58G宇宙加速器.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shurufa.ime
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe
3160	svchost.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeBackupPrivilege	5040	shurufa.ime
Token: SeRestorePrivilege	5040	shurufa.ime
Token: SeBackupPrivilege	5040	shurufa.ime
Token: SeRestorePrivilege	5040	shurufa.ime
Token: SeBackupPrivilege	5040	shurufa.ime
Token: SeRestorePrivilege	5040	shurufa.ime
Token: SeBackupPrivilege	5040	shurufa.ime
Token: SeRestorePrivilege	5040	shurufa.ime

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1012	941破解58G宇宙加速器.exe
1012	941破解58G宇宙加速器.exe
1012	941破解58G宇宙加速器.exe
1012	941破解58G宇宙加速器.exe
1012	941破解58G宇宙加速器.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1012 wrote to memory of 5040	1012	941破解58G宇宙加速器.exe	86
PID 1012 wrote to memory of 5040	1012	941破解58G宇宙加速器.exe	86
PID 1012 wrote to memory of 5040	1012	941破解58G宇宙加速器.exe	86

C:\Users\Admin\AppData\Local\Temp\941破解58G宇宙加速器\941破解58G宇宙加速器.exe
"C:\Users\Admin\AppData\Local\Temp\941破解58G宇宙加速器\941破解58G宇宙加速器.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1012
- C:\shurufa.ime
  C:\shurufa.ime
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1012 -s 1560
  2⤵
  - Program crash
  PID:4280
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1012 -s 1560
  2⤵
  - Program crash
  PID:1976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1012 -ip 1012
1⤵
PID:2036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1012 -ip 1012
1⤵
PID:3936

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k imgsvc
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\2926500.dll

Filesize
105KB

MD5
7a042c27a00168bdc1f6df253b0d3ce2

SHA1
02c05a9b57b6c1a818b6293ed359cc692b6d80e0

SHA256
249a3c708069773bc120fa63ca9a68c510e773c7fcdfc7936cc464272b73cfdb

SHA512
4bdfc5a595d046af5564e619adfce34f7e9ca34d8fecab57c5ff39dd20f8fb8ee1463753c47e29203953c6fc21a7f192ac66129aefa05b7ed0736968c76b8983

Download Submit
C:\shurufa.ime

Filesize
210KB

MD5
7dfe7ce5e70121590352fb96cf1e61b1

SHA1
3ae79222d4124e468b7addf4119a98dc5b45d995

SHA256
6533fa9a4b8ce9d90b56f5868f8e552616e5977b1cb02add30601faec5cfc62f

SHA512
dd735e510de16acdad734be1a7a27006b73603a9d66afd12a46ad8a5d96c00bd5068c5fa2ad36864c618b9eafdf0546d10aea2c6a800b4c3a16b7ee99c9d490e

Download Submit
\??\c:\NT_Path.jpg

Filesize
29B

MD5
1302486cf18b600eba72911e43154734

SHA1
265bf408efa8bd6b650d2cc5e92acec4f17cfd8e

SHA256
b13241d4023b961429d16605c61374dc9f5ee4bd1238cf33d5246c7a0458d522

SHA512
b40ce2403f083a520c27ac90c81948e3468dcb3a82af404dd7149cc57116e78ae479746bab8092416d5167cb9a46cda5b42825b16e0065d5dc81c7a9f74f0a94

Download Submit
\??\c:\program files (x86)\smhk\fmanekhgi.pic

Filesize
17.5MB

MD5
f39251d318a4b14be2204228f3d2572f

SHA1
e9902231cd559434789c1bd524b5b92fa895c57a

SHA256
af963b63b2209f299349989765aa191b6081e52ff612273ac8ef08b8ff39bb2e

SHA512
0c4199ef677fa85e52348bcb2db8db5cd287d2dd03b28403cba444efb125f596e716d9f0c35d566e6357a33c9e9502f9dd79822e6e0504691e08d57bda1f72df

Download Submit
memory/1012-23-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1012-9-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1012-39-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1012-38-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1012-35-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1012-33-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1012-31-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1012-48-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1012-27-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1012-25-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1012-0-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1012-21-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1012-19-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1012-42-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1012-5-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1012-15-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1012-13-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1012-11-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1012-7-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1012-4-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1012-3-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1012-2-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1012-44-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1012-55-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1012-17-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1012-29-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1012-47-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download