gh0strat | 360b743ed8ea6b169f73844ba6725bfa9db43ebfa1c1894ea97616baaf5d8d6a

Analysis

max time kernel
150s
max time network
139s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
11/03/2025, 02:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

360b743ed8ea6b169f73844ba6725bfa9db43ebfa1c1894ea97616baaf5d8d6a.exe
Size

68KB
MD5

5de81fa0857d4a4d36dec9bd65441ad1
SHA1

a471aea074bb36b0082790d4b8d9dfe5174c1de5
SHA256

360b743ed8ea6b169f73844ba6725bfa9db43ebfa1c1894ea97616baaf5d8d6a
SHA512

a0f1cf24945dc24451f287b1759046a27afe38a837cc56683d8a7d24827b034581ae42eab8f9cb6c572555e7ed7d00ba81029b9d63e8fbd8e51b96baa8858be8
SSDEEP

1536:agi5rqg5TEgCSwOxkWaAvB/GbNmJGy7nO:agMug5TEgC9WSbNmZ7n

Score

10^/10

gh0strat discovery rat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/1936-1-0x0000000010000000-0x000000001000B000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	360b743ed8ea6b169f73844ba6725bfa9db43ebfa1c1894ea97616baaf5d8d6a.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	360b743ed8ea6b169f73844ba6725bfa9db43ebfa1c1894ea97616baaf5d8d6a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	360b743ed8ea6b169f73844ba6725bfa9db43ebfa1c1894ea97616baaf5d8d6a.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1936	360b743ed8ea6b169f73844ba6725bfa9db43ebfa1c1894ea97616baaf5d8d6a.exe
1936	360b743ed8ea6b169f73844ba6725bfa9db43ebfa1c1894ea97616baaf5d8d6a.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1936	360b743ed8ea6b169f73844ba6725bfa9db43ebfa1c1894ea97616baaf5d8d6a.exe

C:\Users\Admin\AppData\Local\Temp\360b743ed8ea6b169f73844ba6725bfa9db43ebfa1c1894ea97616baaf5d8d6a.exe
"C:\Users\Admin\AppData\Local\Temp\360b743ed8ea6b169f73844ba6725bfa9db43ebfa1c1894ea97616baaf5d8d6a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1936-1-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download