gh0strat | 34859d155fe05092852d0aad662f05a74be9bafce5967066100555e952ad2f44

Analysis

max time kernel
150s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 19:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
34859d155fe05092852d0aad662f05a74be9bafce5967066100555e952ad2f44.exe
Size 4.4MB
Sample260722-xsd3hsba69
SHA256 34859d155fe05092852d0aad662f05a74be9bafce5967066100555e952ad2f44
MD5 d135f2fcbd889e0d511461a18a78bd63
SHA1 8b1adf671cf52f1162b6af2a80d08c552e08d982
SHA512 6f9f725f9011ae2c4683eb2f3edd54a242753bd758189fda434577615b76555a76f4093a8f00ee91e0a60eeb39c3a848efe9d9025620cc83dc341194d974cfdd
SSDEEP 98304:gh4wADmvQP1dAoBj+CkQ/XpJntX60y4f3ARZ+8ISGRN7AF7gvkDDN/ckjhl:g2Nj6CkQ/XBX60HlPP7cVNUkV
TLSH
T13F26E0E0798E7D7AC817153188B7F2FAB37DA734073481D7516CA62A7D322823625D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery gh0strat rat

Malware Config

Signatures

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Gh0st RAT payload 4 IoCs

resource	yara_rule
behavioral2/memory/5584-23-0x0000000000400000-0x000000000086D000-memory.dmp	family_gh0strat
behavioral2/memory/4584-36-0x0000000010000000-0x000000001007E000-memory.dmp	family_gh0strat
behavioral2/memory/4584-37-0x0000000000A40000-0x0000000000A5F000-memory.dmp	family_gh0strat
behavioral2/memory/4584-49-0x0000000010000000-0x000000001007E000-memory.dmp	family_gh0strat

Executes dropped EXE 2 IoCs

pid	Process
2660	rundll32.exe
4584	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
4584	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4584 set thread context of 3636	4584	svchost.exe	93

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	34859d155fe05092852d0aad662f05a74be9bafce5967066100555e952ad2f44.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	34859d155fe05092852d0aad662f05a74be9bafce5967066100555e952ad2f44.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Modifies data under HKEY_USERS 24 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\DirectInput	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\DirectInput\SVCHOST.EXED95D7BAD0000D030	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\DirectInput\MostRecentApplication\Id = "SVCHOST.EXED95D7BAD0000D030"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\应用程序向导生成的本地应用程序	34859d155fe05092852d0aad662f05a74be9bafce5967066100555e952ad2f44.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\DirectInput\SVCHOST.EXED95D7BAD0000D030\Name = "SVCHOST.EXE"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\DirectInput\MostRecentApplication\Version = 00080000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\DirectInput	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties\PrivateProperties	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\DirectInput\VID_0222&PID_0001\Calibration	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\DirectInput\VID_0222&PID_0001\Calibration\0\GUID = 00301ee40886f1118001444553540000	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\DirectInput\SVCHOST.EXED95D7BAD0000D030\UsesMapper = 00000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\DirectInput\MostRecentApplication	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\应用程序向导生成的本地应用程序\GandyDraw	34859d155fe05092852d0aad662f05a74be9bafce5967066100555e952ad2f44.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\应用程序向导生成的本地应用程序\GandyDraw\Settings	34859d155fe05092852d0aad662f05a74be9bafce5967066100555e952ad2f44.exe
Key created	\REGISTRY\USER\.DEFAULT\System	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\DirectInput\VID_0222&PID_0001	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\DirectInput\VID_0222&PID_0001\Calibration\0	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\DirectInput\VID_0222&PID_0001\DeviceInstances	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\DirectInput\MostRecentApplication\Name = "SVCHOST.EXE"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\DirectInput\MostRecentApplication\MostRecentStart = 39feb0440d1add01	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\应用程序向导生成的本地应用程序\GandyDraw\Recent File List	34859d155fe05092852d0aad662f05a74be9bafce5967066100555e952ad2f44.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4156	34859d155fe05092852d0aad662f05a74be9bafce5967066100555e952ad2f44.exe
4156	34859d155fe05092852d0aad662f05a74be9bafce5967066100555e952ad2f44.exe
5584	34859d155fe05092852d0aad662f05a74be9bafce5967066100555e952ad2f44.exe
5584	34859d155fe05092852d0aad662f05a74be9bafce5967066100555e952ad2f44.exe
2660	rundll32.exe
2660	rundll32.exe
3636	svchost.exe
3636	svchost.exe
2660	rundll32.exe
2660	rundll32.exe
2660	rundll32.exe
2660	rundll32.exe
3636	svchost.exe
3636	svchost.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5584	34859d155fe05092852d0aad662f05a74be9bafce5967066100555e952ad2f44.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4156	34859d155fe05092852d0aad662f05a74be9bafce5967066100555e952ad2f44.exe
Token: SeDebugPrivilege	2660	rundll32.exe
Token: SeDebugPrivilege	4584	svchost.exe
Token: SeDebugPrivilege	3636	svchost.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4156	34859d155fe05092852d0aad662f05a74be9bafce5967066100555e952ad2f44.exe
4156	34859d155fe05092852d0aad662f05a74be9bafce5967066100555e952ad2f44.exe
5584	34859d155fe05092852d0aad662f05a74be9bafce5967066100555e952ad2f44.exe
5584	34859d155fe05092852d0aad662f05a74be9bafce5967066100555e952ad2f44.exe
3636	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 4584	2660	rundll32.exe	92
PID 4584 wrote to memory of 3636	4584	svchost.exe	93
PID 4584 wrote to memory of 3636	4584	svchost.exe	93

C:\Users\Admin\AppData\Local\Temp\34859d155fe05092852d0aad662f05a74be9bafce5967066100555e952ad2f44.exe
"C:\Users\Admin\AppData\Local\Temp\34859d155fe05092852d0aad662f05a74be9bafce5967066100555e952ad2f44.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4156
- C:\Users\Admin\AppData\Local\Temp\34859d155fe05092852d0aad662f05a74be9bafce5967066100555e952ad2f44.exe
  "C:\Users\Admin\AppData\Local\Temp\34859d155fe05092852d0aad662f05a74be9bafce5967066100555e952ad2f44.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  - Suspicious use of SetWindowsHookEx
  PID:5584

C:\ProgramData\Microsoft\MF\NVId18666\rundll32.exe
C:\ProgramData\Microsoft\MF\NVId18666\rundll32.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2660
- C:\ProgramData\Microsoft\MF\NVId18666\svchost.exe
  svchost.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4584
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Windows\SysWOW64\svchost.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

log.dll

Path C:\ProgramData\Microsoft\MF\NVId18666\log.dll
Size 102KB
SHA256 053acb10b3bf65473dd6323be22f27ddcbc46136b81607e36cc7b1ea085f801b
MD5 b0230c6833e35d3dad78996a99dff002
SHA1 11fa9007c4667b3364dc1562a15bc15581c973af
SHA512 137d95c6ea8851f4c73b6a6780cb862f2f9b074d2cbba8cb4dfb6c9431d287ae8b2fcc2b0eabf756d783ea5f30fc91e69856843789db8177904255348fb57725
SSDEEP 3072:62dH7RZQU/RqeDDHmqHNBJlHu4sWpZYLr9Iak9:DdbkIVjmgJ5u4sWMdpc
TLSH
T137A38C0072D0C472E5BE09381570DA724B7EB930DFA0ADAB339426795E743C1DE25E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rundll32.exe

Path C:\ProgramData\Microsoft\MF\NVId18666\rundll32.exe
Size 91KB
SHA256 dba365a1fa45daecb63cd5352ac78cd631d8db57ae1abaad646299e1da3ed3bd
MD5 7831b9dbf804c41e4a7aaa22c7b8e552
SHA1 0530c961ccb6a30c05e195f94df001da4d2dae4f
SHA512 dd3064ac5a5f5b101ee71af844759574255fe92cde77816293b5aa949bc107a62cf25b571b81d85707d0ffdd0857afb34d65c7a18a7a904cff2053f8e24d44be
SSDEEP 1536:MC7cRgR4sbIsUCcM+tCxiyCy62yeiNCt1Yr/wBZjurxUeaLy8sW4pPcdvT86Ypih:LcCbI7CczOH62yeiNCt1YcurxUe8ygvO
TLSH
T1AC936C10B6D1C872E57715351874EAB29A3DF8315F619EAB3388067E0F342C19A36DBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\ProgramData\Microsoft\MF\NVId18666\svchost.exe
Size 192KB
SHA256 386eb7aa33c76ce671d6685f79512597f1fab28ea46c8ec7d89e58340081e2bd
MD5 8a8db1e20dc508af5a81fc00b1929468
SHA1 32e1ebec9672ad7cc5dc36d8a1c87bbf47a4fa9f
SHA512 9c5747fd7563b29ecf43b71b5480b260b083892d37054ff77cc6c613c3db380ce2bdf990fb466edc8705f784b051dc1be208b454696e67eb0c90c20470f4ea87
SSDEEP 3072:vSBLUBIJd19QIkYOC0L1oMCKxcfyL48akQ5r+eY2Q2Q1EpUdY75EbYJ7:vS/bgC0RoMsfyL4pdR+7sJ7
TLSH
T1CC143B75FBE2C0B2D9B3257058B4C225997A79515B30C1EBE7488BAF2D317E08A3570B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winime.dat

Path C:\ProgramData\Microsoft\MF\NVId18666\winime.dat
Size 970KB
SHA256 e65dbaffe5c2ff05939ed042ea06ed7a6e68525be22d8fd438f458459765c96b
MD5 d07e775a307b124ece93f68289b27dbe
SHA1 84d8f65519c5dd6a05a53e149612747adb2e7c23
SHA512 8b19ebff5393f2161330d650049ac152edc7d15399b9babf3c63bd139837af19ce3859a92a3dc2fd7dab7017c7fca1247de5d9fc90ac34f4608d915e3aecd1b6
SSDEEP 24576:qF1ujgFD3YBYNLUDDNCbAC6gzqG9P+0bXj:qTg0LUVNCn9P+0bXj
TLSH
T11825E16D765E0BA319D42CE30CD2FB8F83AA4229DB64FFF326B851778108912476DE54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3636-43-0x0000000000B30000-0x0000000000BCE000-memory.dmp

Download

memory/3636-44-0x0000000010000000-0x00000000100A1000-memory.dmp

Download

memory/4156-4-0x0000000005120000-0x000000000533F000-memory.dmp

Download

memory/4156-1-0x0000000010000000-0x0000000010222000-memory.dmp

Download

memory/4584-34-0x00000000037A0000-0x00000000038A1000-memory.dmp

Download

memory/4584-30-0x0000000010000000-0x000000001007E000-memory.dmp

Download

memory/4584-36-0x0000000010000000-0x000000001007E000-memory.dmp

Download

memory/4584-37-0x0000000000A40000-0x0000000000A5F000-memory.dmp

Download

memory/4584-48-0x00000000037A0000-0x00000000038A1000-memory.dmp

Download

memory/4584-49-0x0000000010000000-0x000000001007E000-memory.dmp

Download

memory/5584-23-0x0000000000400000-0x000000000086D000-memory.dmp

Download

memory/5584-5-0x0000000004FE0000-0x00000000051FF000-memory.dmp

Download