gh0strat | c46ac4e5625910831e6c00759ecc2a0c631d3f366e1e3c94f7b5675cd34407a1

General

Target
2026-08-15_db1ad793e4984004d48496a4f5555694_chinachopper_elex_runningrat_wannacry_zxshell.exe
Size 108KB
Sample260815-mkrnjaak7v
SHA256 c46ac4e5625910831e6c00759ecc2a0c631d3f366e1e3c94f7b5675cd34407a1
MD5 db1ad793e4984004d48496a4f5555694
SHA1 f820a318d59682e268c0947c1df9bcdb21330a58
SHA512 d0e14c078e81ef7fd3c1790c9db78c5b767d7c4454038565faa82ddad605e98f1579d9106d1e1b7acd6fa17251728c5275087196a16c630debe8c3c6d0e2f680
SSDEEP 1536:lqEA70HzLJksPEOajozLElnqiO2jdgPb:lXTLJkQ7zAV3KPb
TLSH
T1CAB3E442A3E02512E1AF3B74697502364A7A3C7A5F2182EFF2D5C54E18799E1EE7070B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution gh0strat runningrat persistence rat

Malware Config

Signatures

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Family: RunningRat
RunningRat is a remote access trojan first seen in 2018.
rat runningrat

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000a000000011390-1.dat	family_gh0strat

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\lsass\Parameters\ServiceDll = "C:\\Windows\\system32\\240725781.dll"	2026-08-15_db1ad793e4984004d48496a4f5555694_chinachopper_elex_runningrat_wannacry_zxshell.exe

Executes dropped EXE 1 IoCs

pid	Process
1752	lsass.exe

Loads dropped DLL 3 IoCs

pid	Process
4132	2026-08-15_db1ad793e4984004d48496a4f5555694_chinachopper_elex_runningrat_wannacry_zxshell.exe
3380	svchost.exe
1752	lsass.exe

Creates a Windows Service
persistence

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\240725781.dll	2026-08-15_db1ad793e4984004d48496a4f5555694_chinachopper_elex_runningrat_wannacry_zxshell.exe
File created	C:\Windows\SysWOW64\lsass.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6036	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_db1ad793e4984004d48496a4f5555694_chinachopper_elex_runningrat_wannacry_zxshell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
6036	cmd.exe
4624	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4624	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4132	2026-08-15_db1ad793e4984004d48496a4f5555694_chinachopper_elex_runningrat_wannacry_zxshell.exe
4132	2026-08-15_db1ad793e4984004d48496a4f5555694_chinachopper_elex_runningrat_wannacry_zxshell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4132	2026-08-15_db1ad793e4984004d48496a4f5555694_chinachopper_elex_runningrat_wannacry_zxshell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4132	2026-08-15_db1ad793e4984004d48496a4f5555694_chinachopper_elex_runningrat_wannacry_zxshell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 6036	4132	2026-08-15_db1ad793e4984004d48496a4f5555694_chinachopper_elex_runningrat_wannacry_zxshell.exe	91
PID 6036 wrote to memory of 4624	6036	cmd.exe	94
PID 3380 wrote to memory of 1752	3380	svchost.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-08-15_db1ad793e4984004d48496a4f5555694_chinachopper_elex_runningrat_wannacry_zxshell.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_db1ad793e4984004d48496a4f5555694_chinachopper_elex_runningrat_wannacry_zxshell.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\Admin\AppData\Local\Temp\2026-08-15_db1ad793e4984004d48496a4f5555694_chinachopper_elex_runningrat_wannacry_zxshell.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:6036
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4624

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "lsass"
1⤵
PID:3120

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "lsass"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3380
- C:\Windows\SysWOW64\lsass.exe
  C:\Windows\system32\lsass.exe "c:\windows\system32\240725781.dll",MainThread
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1752

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k "lsass"
1⤵
PID:5344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Server Software Component

1

T1505

Terminal Services DLL

1

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

240725781.dll

Path C:\Windows\SysWOW64\240725781.dll
Size 37KB
SHA256 d094a0f06a617e07b20db8b0ffef90d066bc69de67ccdf3bcd9281095e15b815
MD5 99498cdef0ea80d953fcf36408767cfe
SHA1 fb84554cfea76eaaf35204af2b979ad63a87045d
SHA512 ffba46cbd25454537c4e93872027984cb13cc3f87651db6c90f85bd33d26a94bcf489f0d540eb3ce8ef39500c9a651d25d2992dd4d1d9e4042598bd083b2b699
SSDEEP 768:ZesiLUI0PPZrmzsXAUWjNCHmhzoVBvxamBT8TiuKmLHdjqA7PZ:QRUdrm4fWjNxKBhx7ulz7
TLSH
T18F033A0AE55CC0F7E25817707859277F6ABDADAF12691E6A4FA3DD6904B3260F10C307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lsass.exe

Path C:\Windows\SysWOW64\lsass.exe
Size 51KB
SHA256 ce6bb7eddc83762c708d4a41709ae00371dbdc09b2a380f28fa60b1edf917473
MD5 2e068ce2770fde8d1af4cb114b98df1f
SHA1 b6f9c2775babb025b22f915c3047aa627d07c312
SHA512 998d695eb56375e63df7db16740b89deb2cf630ccbead8bcf84a921ec6f4a4f9aef2755b703f7190f332b2008ebcc949363bcf8f392d7d07246c255b5073ed35
SSDEEP 1536:6G9yoVEpHP29I3fbcJboSUge5N+CnC/maz9Rh:8pv2mbcJboce58wvOR
TLSH
T137336C236A0A49B3DFE231780A9D7232526DD862075541F7A61057EAFD243E2EE743CF
MD5 SHA1 SHA512 SSDEEP TLSH