gh0strat | d785d599b4c918c3e644138e4a8a58db8e18e4cba1263f525cf46a00b88a5d25

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
13/03/2026, 06:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-03-13_16ec005d1ec69476b53b45427a2de383_coinminer_elex_runningrat_wannacry_zxshell.exe
Size 196KB
Sample260313-hm5kysbs3w
SHA256 d785d599b4c918c3e644138e4a8a58db8e18e4cba1263f525cf46a00b88a5d25
MD5 16ec005d1ec69476b53b45427a2de383
SHA1 8734719c16e88e55d5c4ee1d5f6f7b1d412cdb15
SHA512 0a522cb40b97e2f96fcc28b3483d7fb596f9cfc44d7c69d2b4d21ce05a4667ac6cb25bea62692fbec98f91ae30664986ffa9e4d9700816e620f483af59ee51db
SSDEEP 1536:gFhqEA70HzLJksPEOajozLElnqiO2cb+g4h7DsSp9:gjXTLJkQ7zAV3DT7
TLSH
T156140582A3D02512F1AF3B706975133A4A793CB51F2582EFF2D6C54E18799E1AE7070B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery gh0strat runningrat persistence rat upx

Malware Config

Extracted

Family

runningrat

192.252.180.88

Extracted

Family

gh0strat

192.252.180.88

Signatures

Gh0st RAT payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000d000000027002-2.dat	family_gh0strat
behavioral2/memory/2716-7-0x0000000000400000-0x0000000000431000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat
RunningRat
RunningRat is a remote access trojan first seen in 2018.
rat runningrat

RunningRat payload 1 IoCs

resource	yara_rule
behavioral2/memory/2716-0-0x0000000000400000-0x0000000000431000-memory.dmp	family_runningrat

Runningrat family
runningrat

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/memory/2716-0-0x0000000000400000-0x0000000000431000-memory.dmp	UPX
behavioral2/memory/2716-7-0x0000000000400000-0x0000000000431000-memory.dmp	UPX

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\hypersvc\Parameters\ServiceDll = "C:\\Windows\\SysWOW64\\240641671.dll"	2026-03-13_16ec005d1ec69476b53b45427a2de383_coinminer_elex_runningrat_wannacry_zxshell.exe

Executes dropped EXE 1 IoCs

pid	Process
1812	hypersvc.exe

Loads dropped DLL 3 IoCs

pid	Process
2716	2026-03-13_16ec005d1ec69476b53b45427a2de383_coinminer_elex_runningrat_wannacry_zxshell.exe
4548	svchost.exe
1812	hypersvc.exe

Creates a Windows Service
persistence

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\240641671.dll	2026-03-13_16ec005d1ec69476b53b45427a2de383_coinminer_elex_runningrat_wannacry_zxshell.exe
File created	C:\Windows\SysWOW64\hypersvc.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\hypersvc.exe	svchost.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2716-0-0x0000000000400000-0x0000000000431000-memory.dmp	upx
behavioral2/memory/2716-7-0x0000000000400000-0x0000000000431000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hypersvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-03-13_16ec005d1ec69476b53b45427a2de383_coinminer_elex_runningrat_wannacry_zxshell.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5060	cmd.exe
5096	PING.EXE

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	hypersvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	hypersvc.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum	hypersvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	hypersvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	hypersvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	hypersvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7"	hypersvc.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5096	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2716	2026-03-13_16ec005d1ec69476b53b45427a2de383_coinminer_elex_runningrat_wannacry_zxshell.exe
2716	2026-03-13_16ec005d1ec69476b53b45427a2de383_coinminer_elex_runningrat_wannacry_zxshell.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe
1812	hypersvc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2716	2026-03-13_16ec005d1ec69476b53b45427a2de383_coinminer_elex_runningrat_wannacry_zxshell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2716	2026-03-13_16ec005d1ec69476b53b45427a2de383_coinminer_elex_runningrat_wannacry_zxshell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 5060	2716	2026-03-13_16ec005d1ec69476b53b45427a2de383_coinminer_elex_runningrat_wannacry_zxshell.exe	82
PID 5060 wrote to memory of 5096	5060	cmd.exe	84
PID 4548 wrote to memory of 1812	4548	svchost.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-03-13_16ec005d1ec69476b53b45427a2de383_coinminer_elex_runningrat_wannacry_zxshell.exe
"C:\Users\Admin\AppData\Local\Temp\2026-03-13_16ec005d1ec69476b53b45427a2de383_coinminer_elex_runningrat_wannacry_zxshell.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\Admin\AppData\Local\Temp\2026-03-13_16ec005d1ec69476b53b45427a2de383_coinminer_elex_runningrat_wannacry_zxshell.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:5060
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5096

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "hypersvc"
1⤵
PID:5644

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "hypersvc"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Windows\SysWOW64\hypersvc.exe
  C:\Windows\system32\hypersvc.exe "c:\windows\System32\240641671.dll",MainThread
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1812

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k "hypersvc"
1⤵
PID:2940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

240641671.dll

Path C:\Windows\SysWOW64\240641671.dll
Size 37KB
SHA256 94d42650aea3c126f99e428191cb9b99e39cb78aaab9db3fca575ba6ae16b3c5
MD5 54112ce99fedb67a747178dedfcc3855
SHA1 739187e6a54b8b463e8bda5bda32ef5a0525c512
SHA512 4380b8af4921fda3a591f8c535578ce805aac1cc5c29cc1a5a6541abee9eb68e19387158ccfd2f278d352f1b847854966670fdd3591c73a1835bc1ae63546e01
SSDEEP 768:ZesiLUI0PPZrmzsXAUWjNCHmhzoVBvxamBT8TiuKmLHdaqA7PZ:QRUdrm4fWjNxKBhx7ulu7
TLSH
T14C033B0AE55CC0F7E25817707859277F6ABDADAF12691E6A4FA3DD6904B3260F10C307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hypersvc.exe

Path C:\Windows\SysWOW64\hypersvc.exe
Size 40KB
SHA256 8dcaeeebef9b9f3d41d295db145ffb3850f309d089c08125c7fa7034db5fd80e
MD5 22bb5bd901d8b25ac5b41edbb7d5053e
SHA1 8a935dd8d7e104fc553ff7e8b54a404f7b079334
SHA512 cc3fb68fd6791a08e4a7d1a8db8d07cfcc8c9b9dceec10b53f0cb7ee86473303a19be4f23e379f84c59e02d0568e7c066e21cd1300f6032dac4ba52f609f62e7
SSDEEP 768:C67uhQpPPp0nnqFk509FRdVcQX6N58hJYim1jLP3RRe:C67uhQpXp0nnqa5093jKNAmB3RR
TLSH
T10C134C02BE88C071DDA114B41A5DB337939DED604B1586D3593887EBAA2D3E39E343DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1812-12-0x0000000002A70000-0x0000000002B4A000-memory.dmp

Download

memory/2716-0-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2716-7-0x0000000000400000-0x0000000000431000-memory.dmp

Download