gh0strat | 613753b800aef07572cb87140339a68bfa832e780e9899a11a7c76ff2f9b704b

Analysis

max time kernel
150s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/05/2026, 17:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
613753b800aef07572cb87140339a68bfa832e780e9899a11a7c76ff2f9b704b.exe
Size 5.4MB
Sample260530-vvpwpact2r
SHA256 613753b800aef07572cb87140339a68bfa832e780e9899a11a7c76ff2f9b704b
MD5 914efd969b440b0a43e86b74bf1c58aa
SHA1 913a159d7c3616f8d68c05f3cdf22c0b249f018f
SHA512 29a0c42599b2617cfff94cac2b6a962812d09859ac90a21bebfe36f84b4da6fe5a3c30d6482b7fa9c4cb447fd3401a1096a4bc0a146844e5a5840b2c3cf47d6a
SSDEEP 98304:G2SVMD8xsDEIE9daFHUkclChP84tRm21oiU4xCaxa6c+mnqgnoju:GHOEIEfE0tlELUAm4x/xa5++qeoj
TLSH
T12B462353BAD184F1C95115308DA66B76D676AF500F22C78BA3D8FE2C7D32281D23B276
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery gh0strat persistence rat

Malware Config

Signatures

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/files/0x001b00000002b3c4-5.dat	family_gh0strat

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\svchcst\Parameters\ServiceDll = "C:\\Windows\\system32\\240657828.bat"	look2.exe

Executes dropped EXE 4 IoCs

pid	Process
4768	look2.exe
4500	HD_613753b800aef07572cb87140339a68bfa832e780e9899a11a7c76ff2f9b704b.exe
4840	360DnsOpt.exe
5036	svchcst.exe

Loads dropped DLL 9 IoCs

pid	Process
4768	look2.exe
4392	svchost.exe
4840	360DnsOpt.exe
4840	360DnsOpt.exe
4840	360DnsOpt.exe
4840	360DnsOpt.exe
4840	360DnsOpt.exe
4840	360DnsOpt.exe
5036	svchcst.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\240657828.bat	look2.exe
File opened for modification	C:\Windows\SysWOW64\ini.ini	look2.exe
File created	C:\Windows\SysWOW64\svchcst.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchcst.exe	svchost.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	613753b800aef07572cb87140339a68bfa832e780e9899a11a7c76ff2f9b704b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	613753b800aef07572cb87140339a68bfa832e780e9899a11a7c76ff2f9b704b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	look2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HD_613753b800aef07572cb87140339a68bfa832e780e9899a11a7c76ff2f9b704b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	360DnsOpt.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4740	613753b800aef07572cb87140339a68bfa832e780e9899a11a7c76ff2f9b704b.exe
4740	613753b800aef07572cb87140339a68bfa832e780e9899a11a7c76ff2f9b704b.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4740	613753b800aef07572cb87140339a68bfa832e780e9899a11a7c76ff2f9b704b.exe
4740	613753b800aef07572cb87140339a68bfa832e780e9899a11a7c76ff2f9b704b.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 4768	4740	613753b800aef07572cb87140339a68bfa832e780e9899a11a7c76ff2f9b704b.exe	80
PID 4740 wrote to memory of 4500	4740	613753b800aef07572cb87140339a68bfa832e780e9899a11a7c76ff2f9b704b.exe	83
PID 4500 wrote to memory of 4840	4500	HD_613753b800aef07572cb87140339a68bfa832e780e9899a11a7c76ff2f9b704b.exe	86
PID 4392 wrote to memory of 5036	4392	svchost.exe	87

C:\Users\Admin\AppData\Local\Temp\613753b800aef07572cb87140339a68bfa832e780e9899a11a7c76ff2f9b704b.exe
"C:\Users\Admin\AppData\Local\Temp\613753b800aef07572cb87140339a68bfa832e780e9899a11a7c76ff2f9b704b.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Users\Admin\AppData\Local\Temp\look2.exe
  C:\Users\Admin\AppData\Local\Temp\\look2.exe
  2⤵
  - Server Software Component: Terminal Services DLL
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:4768
- C:\Users\Admin\AppData\Local\Temp\HD_613753b800aef07572cb87140339a68bfa832e780e9899a11a7c76ff2f9b704b.exe
  C:\Users\Admin\AppData\Local\Temp\HD_613753b800aef07572cb87140339a68bfa832e780e9899a11a7c76ff2f9b704b.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4500
- - C:\Users\Admin\AppData\Local\Temp\~sfx0055126F40\Utils\360DnsOpt.exe
    "C:\Users\Admin\AppData\Local\Temp\~sfx0055126F40\Utils\360DnsOpt.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4840

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "svchcst"
1⤵
PID:1256

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "svchcst"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Windows\SysWOW64\svchcst.exe
  C:\Windows\system32\svchcst.exe "c:\windows\system32\240657828.bat",MainThread
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5036

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k "svchcst"
1⤵
PID:2380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HD_613753b800aef07572cb87140339a68bfa832e780e9899a11a7c76ff2f9b704b.exe

Path C:\Users\Admin\AppData\Local\Temp\HD_613753b800aef07572cb87140339a68bfa832e780e9899a11a7c76ff2f9b704b.exe
Size 4.3MB
SHA256 6c23daad3376d54575a0dbc86f4afc0c89cde3968621a43584ed2b1402774e20
MD5 fa1305fb48a7b59fa46b6a8dda1dee96
SHA1 6459d92b3487dcb2c3d3f5f062d40ea0f88b8480
SHA512 e4931d4f2643ca241f0bde121decf017f01ad9460764d79f2fa83c0b902bd3ac03034842cfbad4b07b98174319ddb605e028b27fab6bbceded0fb9be1ade1d5c
SSDEEP 98304:vDEIE9daFHUkclChP84tRm21oiU4xCaxa6c+mnqgnoju:7EIEfE0tlELUAm4x/xa5++qeoj
TLSH
T1512633A3E6D14575D82219311A4A5FFB0723FEBABD22C3687A891F4C47BD3C181798C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HD_X.dat

Path C:\Users\Admin\AppData\Local\Temp\HD_X.dat
Size 1.2MB
SHA256 0fbed9fa2b45ea1b68973026b793d211b5ee1e97995c1f51d231ad4473a5062a
MD5 ae891d5130827ce60ee897997e0ca88d
SHA1 6bc1230cecc6eaa42961993a28231284920d482d
SHA512 e367225f684462baa3af3fb97b9191cc5d1c904b7062d3acd74436e83056d8bb6be29ebcf4a245e5d649dbaedeeb2c38475fea087435b7c300c7794acbb4bea0
SSDEEP 24576:ZYFbkIsaPiXSVnC7Yp9zkNmZG8RRlnFyzERO8:ZYREXSVMDi3xRN
TLSH
T16945C017BED284F1CA5515308DA66B76D6759F400F22CB87A398FE2C7D32181D63B23A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

look2.exe

Path C:\Users\Admin\AppData\Local\Temp\look2.exe
Size 337KB
SHA256 86492ebf2d6f471a5ee92977318d099b3ea86175b5b7ae522237ae01d07a4857
MD5 2f3b6f16e33e28ad75f3fdaef2567807
SHA1 85e907340faf1edfc9210db85a04abd43d21b741
SHA512 db17e99e2df918cfc9ccbe934adfe73f0777ce1ce9f28b57a4b24ecd821efe2e0b976a634853247b77b16627d2bb3af4ba20306059d1d25ef38ffada7da3e3a4
SSDEEP 6144:8IXwWcHnNmZEvB7csAPRZyfQjCfA3lMXm4Y+5bFnWBFopJOU:8IXwDNmZEvJcscRZzjCI1O5W
TLSH
T1B474BF137FE4C8B6C59351324EE25F7AA1F6FE902E224A4333956F0CDD32691963A316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

360Base.dll

Path C:\Users\Admin\AppData\Local\Temp\~sfx0055126F40\360Base.dll
Size 899KB
SHA256 8c8b6a248a435f66be07ef39531df259d856d32bb829d2a3bc98de4afc5b5983
MD5 3426804666669004fa7c51b9968b2beb
SHA1 5d4fafe436e1f04404010b7b6f2df8e88a78f924
SHA512 a27597dc7fa19047fae3a3f237f227acb22da10630ec838f3f6ec553cad692e595aa85c34a2aee406adedb554bd01cf27fe55e4ed5466b9e8e5c3bfb6b88e4df
SSDEEP 24576:/ZwQ5imQOtR7WrLZilRxfvRNBKwBT2EcMJ+6s:6VC37gdiRxfvRNUuT2EcMYz
TLSH
T1C6159D73E244D1B2CB9E25B48536AF3B0A7EA512071586C7F7802E5FFC522F2663D285
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

360NetBase.dll

Path C:\Users\Admin\AppData\Local\Temp\~sfx0055126F40\360NetBase.dll
Size 362KB
SHA256 e03af46b726df6ef41a49f1bf1a621d996523abd4b88d7019c268cfeffaf9b34
MD5 aae482794aeef220770bf42a4e631f63
SHA1 64c60eab89f0872c510a21258263770ae0b58c45
SHA512 a3df5861ec67c9967eafea3d34276adc5325cd2d7227a7a20b9ad69da6263db18255fa1f79788bfcc78998e425520051d41ce032f2c6abb46c81f33c96f15920
SSDEEP 6144:TP8nhU4yN4FpPCldlwhn1CCd9rRj0Ha6VpU7N/CKqta3MGkRIssjoncveT2:bEhU4y0pPCtqnLQzCIa3IRIsCoXi
TLSH
T1A784AE41FB80C1B2D5862574622AA7775D3AE625A324C4C7E7E00EB9AF503D1E63E34F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

360Util.dll

Path C:\Users\Admin\AppData\Local\Temp\~sfx0055126F40\360Util.dll
Size 577KB
SHA256 9c00ef80033fa101a82c1772723583b6c22abee15bdaa56feb39dd3ff4db6367
MD5 40c98c8518a2c6bf771cd70791402fc5
SHA1 8c14427e6a35a3fe33422f85c60edb1db4fc1bf3
SHA512 84c7fade6944d0a95ee6b680e281b75d4d645373ccf7ccbcc89a8231d0a84eead4387cb491d9421813430644cb7a060207641a7fa34901deb1c20f3b3c9ff3a2
SSDEEP 12288:5J+7l49YDAt8v0zqBp/QK1HqHdUlUntnmWzXnu9gxBaYnq/eUX09L:qZ49gAVUS+qHdUynu9gxBq/jXAL
TLSH
T1FBC4AE2237D1D076E17F0130A95AD37DA6BAF5719A309807F7C80B6D7EB0242BA39607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashReport.dll

Path C:\Users\Admin\AppData\Local\Temp\~sfx0055126F40\CrashReport.dll
Size 268KB
SHA256 ba60c707331fdd9d04645052abe9770720501ce44aebba3476f5626ab2cbb85b
MD5 d8c83ace9a0a9abc3c10bd0bc8f6fee3
SHA1 21bd35a996c073a2d84303117c81bf7342f03057
SHA512 a665426080679bb7bd9e6062d3a255f3aa44e888aa113ae86f40776892160d0466ff184bbc3adebac14a77686c427367b9f75b37e10d513c03cc30a3f6a628fd
SSDEEP 6144:yXh4JSZLJ3TDcxqNyVuPJKN6B1GSvXtlRod:M4JmyVuPkNEhvr8
TLSH
T18C449D117B80C832D69224740597D7763A7ABD714B26CBCB7BD03B796E306D26E3930A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MiniUI.dll

Path C:\Users\Admin\AppData\Local\Temp\~sfx0055126F40\MiniUI.dll
Size 901KB
SHA256 2bf36c7813e8410e2ef442158e4089f5c5fa512684848f421cd4b08f1eca1d23
MD5 043365f793b1672fc80aaebde3b22929
SHA1 be526a544e7af66b573b29ee7100374e9deb9a1f
SHA512 efb94e1447842254992f67ad2bcc8ebd1862894019e612d680a3b69a4ec9aaef787bddd155775842baf225b9dea05feaef37db26808fc8516851f995a0b62530
SSDEEP 24576:SknkGf8llrOq7fCPpIxjwZLWzDgTT0QXd+h:Ss0H7KRIYWz8TTTXd+h
TLSH
T19C15AF2276D5C076C2BF13315C45E72AA7FAF2215E70859B7AD40B2E3E30782D62A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

360DnsOpt.exe

Path C:\Users\Admin\AppData\Local\Temp\~sfx0055126F40\Utils\360DnsOpt.exe
Size 519KB
SHA256 29ff289107b0c1707f9c91a4b5ec5cbcb611df2643747d914c28ea53fdb2cc6b
MD5 a67a8e1299dfdba8b7c2081e14862c43
SHA1 502b9d72c28823948be4da4c8611dbc3640c52b7
SHA512 860defdc8d4cc55a1091ac75705cd4d71cd271b801b05cfe2f7bc8eb3d08e15cfcca0e7656e91113b998761f4fee3bce9d10ceb6e469e1ed6123e1eb146631f0
SSDEEP 12288:YaX9FGOWu40L2iRF5hfiymAzX1SAzZzIg:RcgP5tm81SA5Ig
TLSH
T1F1B4AF11F7A1C072D95342B45D6FD76A6936E6741B2886C3F3C44F2A6DB03C1AE3A24E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.xml

Path C:\Users\Admin\AppData\Local\Temp\~sfx0055126F40\config\config.xml
Size 3KB
SHA256 4d8ce759afa09ef93fbe42b3f27028572497f4b3a6de86aaa83d92eec0e3eccc
MD5 871e0b0b02e22486fa1bc9d174716195
SHA1 f2c811abe0fa3d865f04f53bb176a0817fcccfba
SHA512 3208ecd4f476fd9bda9962351fa09256fc566446c4691f7fadfeb761075ca474f227ffc23e0c11f30d4f56866060e6b89caa53a0651a8db970b5c1616dbbe763
TLSH
T193617E5262FE1229F6F35F54D8B941161F23FD221839C21D4A942E9D481AFD288B2FF7
MD5 SHA1 SHA512 TLSH

Submit Download

defaultskin.ui

Path C:\Users\Admin\AppData\Local\Temp\~sfx0055126F40\config\defaultskin\defaultskin.ui
Size 282KB
SHA256 80ab0b023867f517b21286b49b3c0c3546c115f086acd6bb1cb0ae65eeabedf2
MD5 1ea59a9ecc0cf9ef04684060c4795130
SHA1 795015fc3cb30a61db435a4e4e150365ef4e9af1
SHA512 9c8001d40eafb6d0a53621c1df10a010efcf985489e847572e058eef0767d5251a7cf1a43ccb22c7fab319bf994a9f82227837f2229cd59f1c7f57ef5f1e613a
SSDEEP 6144:JEzEtCeYnMRihVQLirfK6+NVquIWk77nTY:ImCD7uGC6+jIzc
TLSH
T16554C0D3E6805CD6C45A0A37893B51506A38FF5E8170260B16D9B979FEB3EA20C3674F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

miniui.xml

Path C:\Users\Admin\AppData\Local\Temp\~sfx0055126F40\config\defaultskin\miniui.xml
Size 8KB
SHA256 78470a187bf698270269b556f9d2dd1b6def3b4803b78004c9a780f74809d530
MD5 97bb23ec30c1601a62674ea618018ac8
SHA1 d3c4381292da345b79316b0fd0dd30f75a274357
SHA512 fd1fdb08dc70b790e11eba7b201fbedbbe1c477be6cc317a2c620c7f436d674796b3d5aadb9595ad689e84066c751ecc749a64b044d493b1593271d040c13a4e
SSDEEP 96:uqaDq5DF0THCIDUrg8ScjN/cIGuDg0yRqfJyzoJ1sJE0LoyjPRcUwj8jVcxsuJTx:8kYJArDGutyofFmTLoUYuVme76D2h9q
TLSH
T1130293126BFE0108B2B2AF98AFF544A61977FD536C38C61D10511E4F8976E918C92FB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cloudsec3.dll

Path C:\Users\Admin\AppData\Local\Temp\~sfx0055126F40\deepscan\cloudsec3.dll
Size 1.0MB
SHA256 5d437d766ea645cf559761fabbd81481676165e3230838ab2f79ba10da966ca3
MD5 b0b9c8e909948a4fe192d2d0961a9fcf
SHA1 4fa21a9e46280d1d9be159279badbc207578219d
SHA512 06b7a227f6777868612b5d8ac816c94ac280c90a4ca6dc390204f7650f8536e518ae63b8eb2af5026bd77c30820f50aa89d674a52a06cbca03ba6b77b4c08ee2
SSDEEP 24576:LSyr9uClrT1PKoThflm69SzFb2uHqMxk9TF5D:LVjVC+hNm699uHJxOTF5D
TLSH
T118359E40BB99C1B6CF4F26700539D61E612F76561B309BC3E7983E6A9D311C3B63A34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

240657828.bat

Path C:\Windows\SysWOW64\240657828.bat
Size 51KB
SHA256 bbac147420f08694f195f95a06547ee2490c735cb581c470f99dc06d1abf9c81
MD5 94fde7071a1d9398d80a26ff9e1e0a23
SHA1 57e5e818aa6c904ddb51880f3b191e84016c14cd
SHA512 9da4407a64f5a418e5946c949b84acdcb9e75c0cea01acbcd0c14f4f63b2fe8541b16b80678cbff291d2883e7c6aca62baad5e6616ab9dcb8a73e96b669c1417
SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLaJYH5:1dWubF3n9S91BF3fboWJYH5
TLSH
T1CC333A02EE8D88F5F145177038AA33B6953ABDE036996A931F53DDA5C87B370F12D242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchcst.exe

Path C:\Windows\SysWOW64\svchcst.exe
Size 40KB
SHA256 8dcaeeebef9b9f3d41d295db145ffb3850f309d089c08125c7fa7034db5fd80e
MD5 22bb5bd901d8b25ac5b41edbb7d5053e
SHA1 8a935dd8d7e104fc553ff7e8b54a404f7b079334
SHA512 cc3fb68fd6791a08e4a7d1a8db8d07cfcc8c9b9dceec10b53f0cb7ee86473303a19be4f23e379f84c59e02d0568e7c066e21cd1300f6032dac4ba52f609f62e7
SSDEEP 768:C67uhQpPPp0nnqFk509FRdVcQX6N58hJYim1jLP3RRe:C67uhQpXp0nnqa5093jKNAmB3RR
TLSH
T10C134C02BE88C071DDA114B41A5DB337939DED604B1586D3593887EBAA2D3E39E343DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4500-94-0x0000000000400000-0x0000000000E29000-memory.dmp

Download