gh0strat | 1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 04:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe
Size 2.8MB
Sample260730-ers6yabe44
SHA256 1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6
MD5 c1313947ee1a51fb5b85f85dd771c3c5
SHA1 deb2976105e1e2efb67d795b0b64598642c3d37d
SHA512 8cdd6fe380666ddb165fd170d1b5d3fa125f98de98aeb98032c77b3940824c8c743d6e3942929a9f28a4aba77982eb42272cc4ba0641d6866b42c88c8f866c52
SSDEEP 49152:BQZAdVyVT9n/Xg0P+WhoD+XGwv2tP1zTPADnWPMklKu8bi4O8b8ITDnl13S:iGdVyVT9nPgmhc+Wwv2tP1PPknK
TLSH
T10AD5AF30FA418036E452217189796F7EAC79AD3007A549C7A394EF5D6E306E2EE32377
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery gh0strat persistence rat upx

Malware Config

Signatures

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Gh0st RAT payload 2 IoCs

resource	yara_rule
behavioral2/memory/5752-7-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/files/0x000f00000001c53a-14.dat	family_gh0strat

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ö÷¶¯·ÀÓù·þÎñÄ£¿é\Parameters\ServiceDll = "C:\\Windows\\system32\\240721609.txt"	svchos.exe

Executes dropped EXE 5 IoCs

pid	Process
5752	svchost.exe
1644	svchos.exe
5048	HD_1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe
4740	HD_1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe
5660	Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe

Loads dropped DLL 3 IoCs

pid	Process
1644	svchos.exe
1020	svchost.exe
5660	Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\240721609.txt	svchos.exe
File opened for modification	C:\Windows\SysWOW64\ini.ini	svchos.exe
File created	C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe	svchost.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5752-5-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/5752-7-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1140	5752	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HD_1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HD_1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\	HD_1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\	HD_1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4228	1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe
4228	1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4228	1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe
4228	1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 5752	4228	1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe	89
PID 4228 wrote to memory of 1644	4228	1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe	93
PID 4228 wrote to memory of 5048	4228	1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe	97
PID 5048 wrote to memory of 4740	5048	HD_1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe	98
PID 5048 wrote to memory of 4740	5048	HD_1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe	98
PID 5048 wrote to memory of 4740	5048	HD_1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe	98
PID 1020 wrote to memory of 5660	1020	svchost.exe	100

C:\Users\Admin\AppData\Local\Temp\1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe
"C:\Users\Admin\AppData\Local\Temp\1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  C:\Users\Admin\AppData\Local\Temp\\svchost.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5752
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5752 -s 560
    3⤵
    - Program crash
    PID:1140
- C:\Users\Admin\AppData\Local\Temp\svchos.exe
  C:\Users\Admin\AppData\Local\Temp\\svchos.exe
  2⤵
  - Server Software Component: Terminal Services DLL
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:1644
- C:\Users\Admin\AppData\Local\Temp\HD_1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe
  C:\Users\Admin\AppData\Local\Temp\HD_1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5048
- - C:\Users\Admin\AppData\Local\Temp\HD_1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe
    "C:\Users\Admin\AppData\Local\Temp\HD_1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe" --channel=5048.0.1647655524 --type=renderer
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5752 -ip 5752
1⤵
PID:4980

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"
1⤵
PID:4976

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
  C:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\240721609.txt",MainThread
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5660

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k "╓≈╢»╖└╙∙╖■╬±─ú┐Θ"
1⤵
PID:6092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HD_1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe

Path C:\Users\Admin\AppData\Local\Temp\HD_1b26f74fdc8107b8f0cee46a8ddccb739e283f7098be8f58aba933190c1d35e6.exe
Size 1.5MB
SHA256 00d2ce2c35e8f2d31c2a8778c6e8846be3d1467cd1e66aa494571a14dea0e4d1
MD5 7a97aa40d8a3da4a9095873c72d524c5
SHA1 d219db66995e0548ea1226cb1806388b1ac718f7
SHA512 16de6e0fdda9ebd7de996e97f73d9fad661c947320b604e5aafdcde50ee4582b1b07da98233b12dc76c464abe2104323c056b1ab477532ee10f5117cb03aa90c
SSDEEP 24576:8fJVAXknwvrPymlvoCO1kCjTPADOwWPg9kl0nE58bi4O8b8ITDnlLGk3S:M+XGwv2tP1zTPADnWPMklKu8bi4O8b81
TLSH
T177657C30F6418136E8A23172DE796F6E6C6AA93013E504C762841F6D9F706F2EE36357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HD_X.dat

Path C:\Users\Admin\AppData\Local\Temp\HD_X.dat
Size 1.3MB
SHA256 3766103e37600d9f3e0f787444572245ddbf7b791f6b86e0c89f70c716296462
MD5 1c08ec38913ac46ad3fee730690cba71
SHA1 1911985f4fe8678a5fc859f019faa66cc69d51e2
SHA512 dc31f9d8267e054f81d4d2c503a5fdc5a9e478ed9371b19ea661586204c3cac6c299b959cafb0797a62a0c3e6a02c68b2f43c121e9ca70b3f2c21fcea407e832
SSDEEP 24576:BQZoidOTdVZinacCET9Ecl1eadg0MCiVWhFU7cVu:BQZAdVyVT9n/Xg0P+WhoB
TLSH
T12B55D052FA8280B2D209107018BA2739DA756E754B21CBD7A75CFE1E7D36681E83713F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchos.exe

Path C:\Users\Admin\AppData\Local\Temp\svchos.exe
Size 93KB
SHA256 62954fdf65e629b39a29f539619d20691332184c6b6be5a826128a8e759bfa84
MD5 3b377ad877a942ec9f60ea285f7119a2
SHA1 60b23987b20d913982f723ab375eef50fafa6c70
SHA512 af3a71f867ad9d28772c48b521097f9bf8931eb89fd2974e8de10990241419a39ddc3c0b36dd38aac4fdf14e1f0c5e228692618e93adce958d5b5dab8940e46f
SSDEEP 1536:ktbE7m8nNEQ2O6ReWMWfPbp2WTrW9L3JPPgJ+o5FJYHvh/P6:Bm+2LReWjTrW9rNPgYoTJYHvh
TLSH
T1B1934A41BE8CC869D05C81B03D7BA6B58422BC553900277B6F8AFB4FD976350EC2A5DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost.exe
Size 377KB
SHA256 6e0b7d205a400cf28ae3faa5a0c4b35016c24a5d818d770e54e3342857eae35c
MD5 9b3f9dce6748ab71769198b5dd5320d1
SHA1 06c76c2c3e2ef607612e2fde18797b6223f2bfe3
SHA512 00e756cfb85d3bd448a630b3f7617531b894a0e4cbf1fba58cab0bc0169bb9dcf80041ebb0cdc6e248df5a41322ee919f1d3a412d4dc8600755d4cf7f6e0ec90
SSDEEP 6144:5UGp2l6zRmeVLNH3ozQTAygOcqAJwQZgb4YtjH6/MuQafORzEOmFfMzi71o+YgL7:HclcceB3lKwAg0Mja/UafOVwbhF
TLSH
T139841241FF520123C70A71758CD88A6A9F667B888E560C2B7F746F4F0A702DE583AD39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

240721609.txt

Path C:\Windows\SysWOW64\240721609.txt
Size 50KB
SHA256 70aa0509dce70455724c5bfe595b5753aa461f6969e3b75097e5d929d924c65b
MD5 551e5ffc60b0a9eb898368b684f94b38
SHA1 ba1eba39a2a8d23a9e732d44f856f7a065e47952
SHA512 ab4c687064a48b6887aea03716caf218df285ce1f4a05f0c5543b5d4b74803802d712bf7477694c8d3a3f127171f5563ff0447e566acadd9e9a38e0de6b691d6
SSDEEP 1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5fJYH:W5ReWjTrW9rNPgYoFJYH
TLSH
T166333902DD8D88F5E141177039AA77B7953ABCE07A8526634F63DE69C87B330F42D286
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe

Path C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
Size 51KB
SHA256 ce6bb7eddc83762c708d4a41709ae00371dbdc09b2a380f28fa60b1edf917473
MD5 2e068ce2770fde8d1af4cb114b98df1f
SHA1 b6f9c2775babb025b22f915c3047aa627d07c312
SHA512 998d695eb56375e63df7db16740b89deb2cf630ccbead8bcf84a921ec6f4a4f9aef2755b703f7190f332b2008ebcc949363bcf8f392d7d07246c255b5073ed35
SSDEEP 1536:6G9yoVEpHP29I3fbcJboSUge5N+CnC/maz9Rh:8pv2mbcJboce58wvOR
TLSH
T137336C236A0A49B3DFE231780A9D7232526DD862075541F7A61057EAFD243E2EE743CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4740-52-0x0000000001560000-0x0000000001570000-memory.dmp

Download

memory/5752-5-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/5752-7-0x0000000010000000-0x00000000101B6000-memory.dmp

Download