gh0strat | 056d460fab1b119922b9b356f13d84f698b9ac401e78c62b584de936f1703823

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/05/2026, 08:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
056d460fab1b119922b9b356f13d84f698b9ac401e78c62b584de936f1703823.exe
Size 4.7MB
Sample260509-kwvs8ady2v
SHA256 056d460fab1b119922b9b356f13d84f698b9ac401e78c62b584de936f1703823
MD5 01ad245ef6a40434e5b2248955d194f3
SHA1 19a2b5f39e834333a22ee8b87bce44e6a119232b
SHA512 046208dc16ffdfab5937f0933d9cdf2ab5a29a6753f53436c63acd9f059de8cba1f6111089df37c8e3dba2c496fcae2424998a0c1ca170390c890b5f430a4cfb
SSDEEP 49152:XYREXSVMDi3Vx0bXsPNIULkmp1/j6AeXZG7wmpvGF1IP9z5WuHC4O8b8ITDnl27z:I2SVMD8v0bXsPN5kiQaZ56
TLSH
T18C36C22166D4CFE1D46F1070DC66BAF6912BAE20CF554FCB6E80BE1A35305D2AA3161F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery gh0strat persistence rat

Malware Config

Signatures

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/files/0x002300000002b196-5.dat	family_gh0strat

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\svchcst\Parameters\ServiceDll = "C:\\Windows\\system32\\240642828.bat"	look2.exe

Executes dropped EXE 3 IoCs

pid	Process
2044	look2.exe
340	HD_056d460fab1b119922b9b356f13d84f698b9ac401e78c62b584de936f1703823.exe
3972	svchcst.exe

Loads dropped DLL 3 IoCs

pid	Process
2044	look2.exe
2320	svchost.exe
3972	svchcst.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\240642828.bat	look2.exe
File opened for modification	C:\Windows\SysWOW64\ini.ini	look2.exe
File created	C:\Windows\SysWOW64\svchcst.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchcst.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	look2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HD_056d460fab1b119922b9b356f13d84f698b9ac401e78c62b584de936f1703823.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	056d460fab1b119922b9b356f13d84f698b9ac401e78c62b584de936f1703823.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5048	056d460fab1b119922b9b356f13d84f698b9ac401e78c62b584de936f1703823.exe
5048	056d460fab1b119922b9b356f13d84f698b9ac401e78c62b584de936f1703823.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5048	056d460fab1b119922b9b356f13d84f698b9ac401e78c62b584de936f1703823.exe
5048	056d460fab1b119922b9b356f13d84f698b9ac401e78c62b584de936f1703823.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 2044	5048	056d460fab1b119922b9b356f13d84f698b9ac401e78c62b584de936f1703823.exe	79
PID 5048 wrote to memory of 340	5048	056d460fab1b119922b9b356f13d84f698b9ac401e78c62b584de936f1703823.exe	82
PID 2320 wrote to memory of 3972	2320	svchost.exe	86

C:\Users\Admin\AppData\Local\Temp\056d460fab1b119922b9b356f13d84f698b9ac401e78c62b584de936f1703823.exe
"C:\Users\Admin\AppData\Local\Temp\056d460fab1b119922b9b356f13d84f698b9ac401e78c62b584de936f1703823.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Users\Admin\AppData\Local\Temp\look2.exe
  C:\Users\Admin\AppData\Local\Temp\\look2.exe
  2⤵
  - Server Software Component: Terminal Services DLL
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:2044
- C:\Users\Admin\AppData\Local\Temp\HD_056d460fab1b119922b9b356f13d84f698b9ac401e78c62b584de936f1703823.exe
  C:\Users\Admin\AppData\Local\Temp\HD_056d460fab1b119922b9b356f13d84f698b9ac401e78c62b584de936f1703823.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:340

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "svchcst"
1⤵
PID:3320

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "svchcst"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\SysWOW64\svchcst.exe
  C:\Windows\system32\svchcst.exe "c:\windows\system32\240642828.bat",MainThread
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3972

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k "svchcst"
1⤵
PID:3336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HD_056d460fab1b119922b9b356f13d84f698b9ac401e78c62b584de936f1703823.exe

Path C:\Users\Admin\AppData\Local\Temp\HD_056d460fab1b119922b9b356f13d84f698b9ac401e78c62b584de936f1703823.exe
Size 3.1MB
SHA256 f130b3789962d5c8b59aa250d6f26ad5945928f3905b32bf65aa7bd30348a794
MD5 fb083acd60fe5c3156dc25442be815e3
SHA1 61df59b8f3ebd8b3d29ca3aedc4995e23cacf6d8
SHA512 7147337d2c1006bb15cfa967c9eea6826b63c8d343f866e7454d7368d25019f39e52cf179500810834244c3ca9644d6c0df0b2c3128a9051e9ee6b428fa926f6
SSDEEP 49152:0bXsPNIULkmp1/j6AeXZG7wmpvGF1IP9z5WuHC4O8b8ITDnl27PLhp:0bXsPN5kiQaZ56
TLSH
T14BE5802126D4CFE1D46F20B0DD66BAF6512BAD24CF564FCB6D803E1A35305D2AA31A1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

look2.exe

Path C:\Users\Admin\AppData\Local\Temp\look2.exe
Size 337KB
SHA256 86492ebf2d6f471a5ee92977318d099b3ea86175b5b7ae522237ae01d07a4857
MD5 2f3b6f16e33e28ad75f3fdaef2567807
SHA1 85e907340faf1edfc9210db85a04abd43d21b741
SHA512 db17e99e2df918cfc9ccbe934adfe73f0777ce1ce9f28b57a4b24ecd821efe2e0b976a634853247b77b16627d2bb3af4ba20306059d1d25ef38ffada7da3e3a4
SSDEEP 6144:8IXwWcHnNmZEvB7csAPRZyfQjCfA3lMXm4Y+5bFnWBFopJOU:8IXwDNmZEvJcscRZzjCI1O5W
TLSH
T1B474BF137FE4C8B6C59351324EE25F7AA1F6FE902E224A4333956F0CDD32691963A316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

240642828.bat

Path C:\Windows\SysWOW64\240642828.bat
Size 51KB
SHA256 ba4c6cbf1ca10f6bb3845d1bf0f27ae8b658b8bef623e7d671b03547a2ee4b5f
MD5 f9d820e9e49747a3e96a98357e68f422
SHA1 b6a5cbea76b510a66bfa26823a1913c44063917d
SHA512 389fbea0e187ab2783a2227a5f143c111f2a30154e2d9b273fe38517a6eb2d501c9b51f3f698b54d407921ae9cf17b9fcb4f8cfd4ce6d25458f2abfc557c4068
SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLjJYH5:1dWubF3n9S91BF3fboPJYH5
TLSH
T164333A02EE8D88F5F145177038AA33B6953ABDE036996A931F53DDA5C87B370F12D242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchcst.exe

Path C:\Windows\SysWOW64\svchcst.exe
Size 40KB
SHA256 8dcaeeebef9b9f3d41d295db145ffb3850f309d089c08125c7fa7034db5fd80e
MD5 22bb5bd901d8b25ac5b41edbb7d5053e
SHA1 8a935dd8d7e104fc553ff7e8b54a404f7b079334
SHA512 cc3fb68fd6791a08e4a7d1a8db8d07cfcc8c9b9dceec10b53f0cb7ee86473303a19be4f23e379f84c59e02d0568e7c066e21cd1300f6032dac4ba52f609f62e7
SSDEEP 768:C67uhQpPPp0nnqFk509FRdVcQX6N58hJYim1jLP3RRe:C67uhQpXp0nnqa5093jKNAmB3RR
TLSH
T10C134C02BE88C071DDA114B41A5DB337939DED604B1586D3593887EBAA2D3E39E343DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/340-19-0x0000000001010000-0x00000000010EF000-memory.dmp

Download

memory/2044-13-0x00000000009D0000-0x0000000000AAF000-memory.dmp

Download

memory/2320-27-0x00000000010B0000-0x000000000118F000-memory.dmp

Download

memory/3972-28-0x0000000000F90000-0x000000000106F000-memory.dmp

Download

memory/5048-26-0x0000000000C90000-0x0000000000D6F000-memory.dmp

Download