gh0strat | f33ffb9736f7aa99505131a2ff474e7e76dc6f6b926749d3652c974363afae8d

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/09/2026, 11:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f33ffb9736f7aa99505131a2ff474e7e76dc6f6b926749d3652c974363afae8d.exe
Size 5.9MB
Sample260928-nrc96aserd
SHA256 f33ffb9736f7aa99505131a2ff474e7e76dc6f6b926749d3652c974363afae8d
MD5 13be959d03a4db9948748dae5a27a968
SHA1 f28efb45a2dbf329edf82c935c82ee733d4b71d0
SHA512 2ae483f0b2ce62e8945d72fd98939f0c013bdecec93f3ac5d908a8e5c27f2ec0583af793217dcc957e150ef2d6741c716d3864367dc8351dc88d7008b1efb665
SSDEEP 98304:z2SVMD8id6tskaIaw0Xhs72gV7MuUZJeWjb8yc95ODB7b4ZqyiOIQPudyYwUSc7V:To1BIYhsyW7MukJXIyr17b4ZviQW88Sk
TLSH
T12E561297BA9184F1C55534F19CA2A77292B56F540E12868FA3F8FE2D3832143DD3B12E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery gh0strat persistence rat spyware stealer trojan

Malware Config

Signatures

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c609-6.dat	family_gh0strat

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\svchcst\Parameters\ServiceDll = "C:\\Windows\\system32\\240759578.bat"	look2.exe

Executes dropped EXE 6 IoCs

pid	Process
4964	look2.exe
4352	HD_f33ffb9736f7aa99505131a2ff474e7e76dc6f6b926749d3652c974363afae8d.exe
4316	UninstallTool.exe
2184	UninstallTool_x64.dat
5700	UninstallToolHelper.exe
1008	svchcst.exe

Loads dropped DLL 3 IoCs

pid	Process
4964	look2.exe
4928	svchost.exe
1008	svchcst.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	UninstallTool.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\240759578.bat	look2.exe
File opened for modification	C:\Windows\SysWOW64\ini.ini	look2.exe
File created	C:\Windows\SysWOW64\svchcst.exe	svchost.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	f33ffb9736f7aa99505131a2ff474e7e76dc6f6b926749d3652c974363afae8d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UninstallTool_x64.dat
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchcst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchcst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UninstallTool_x64.dat

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UninstallToolHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f33ffb9736f7aa99505131a2ff474e7e76dc6f6b926749d3652c974363afae8d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	look2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HD_f33ffb9736f7aa99505131a2ff474e7e76dc6f6b926749d3652c974363afae8d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UninstallTool.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4952	f33ffb9736f7aa99505131a2ff474e7e76dc6f6b926749d3652c974363afae8d.exe
4952	f33ffb9736f7aa99505131a2ff474e7e76dc6f6b926749d3652c974363afae8d.exe
2184	UninstallTool_x64.dat
2184	UninstallTool_x64.dat

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2184	UninstallTool_x64.dat

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2184	UninstallTool_x64.dat

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
4952	f33ffb9736f7aa99505131a2ff474e7e76dc6f6b926749d3652c974363afae8d.exe
4952	f33ffb9736f7aa99505131a2ff474e7e76dc6f6b926749d3652c974363afae8d.exe
2184	UninstallTool_x64.dat
2184	UninstallTool_x64.dat
2184	UninstallTool_x64.dat
2184	UninstallTool_x64.dat
2184	UninstallTool_x64.dat
2184	UninstallTool_x64.dat
2184	UninstallTool_x64.dat
2184	UninstallTool_x64.dat
2184	UninstallTool_x64.dat

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 4964	4952	f33ffb9736f7aa99505131a2ff474e7e76dc6f6b926749d3652c974363afae8d.exe	88
PID 4952 wrote to memory of 4352	4952	f33ffb9736f7aa99505131a2ff474e7e76dc6f6b926749d3652c974363afae8d.exe	92
PID 4352 wrote to memory of 4316	4352	HD_f33ffb9736f7aa99505131a2ff474e7e76dc6f6b926749d3652c974363afae8d.exe	95
PID 4316 wrote to memory of 2184	4316	UninstallTool.exe	96
PID 2184 wrote to memory of 5700	2184	UninstallTool_x64.dat	97
PID 4928 wrote to memory of 1008	4928	svchost.exe	98

C:\Users\Admin\AppData\Local\Temp\f33ffb9736f7aa99505131a2ff474e7e76dc6f6b926749d3652c974363afae8d.exe
"C:\Users\Admin\AppData\Local\Temp\f33ffb9736f7aa99505131a2ff474e7e76dc6f6b926749d3652c974363afae8d.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Users\Admin\AppData\Local\Temp\look2.exe
  C:\Users\Admin\AppData\Local\Temp\\look2.exe
  2⤵
  - Server Software Component: Terminal Services DLL
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:4964
- C:\Users\Admin\AppData\Local\Temp\HD_f33ffb9736f7aa99505131a2ff474e7e76dc6f6b926749d3652c974363afae8d.exe
  C:\Users\Admin\AppData\Local\Temp\HD_f33ffb9736f7aa99505131a2ff474e7e76dc6f6b926749d3652c974363afae8d.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4352
- - C:\Users\Admin\AppData\Local\Temp\~sfx0068273BFC\UninstallTool.exe
    "C:\Users\Admin\AppData\Local\Temp\~sfx0068273BFC\UninstallTool.exe"
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4316
  - - C:\Users\Admin\AppData\Local\Temp\~sfx0068273BFC\UninstallTool_x64.dat
      "C:\Users\Admin\AppData\Local\Temp\~sfx0068273BFC\UninstallTool_x64.dat"
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2184
    - - C:\Users\Admin\AppData\Local\Temp\~sfx0068273BFC\UninstallToolHelper.exe
        
        UninstallToolHelper.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5700

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "svchcst"
1⤵
PID:4640

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "svchcst"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Windows\SysWOW64\svchcst.exe
  C:\Windows\system32\svchcst.exe "c:\windows\system32\240759578.bat",MainThread
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:1008

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k "svchcst"
1⤵
PID:2556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HD_X.dat

Path C:\Users\Admin\AppData\Local\Temp\HD_X.dat
Size 1.6MB
SHA256 25bc3b42c2de504f147a73b92527ed7ea919cdb9704a57e9bf549a4fbc54259f
MD5 15d6aee20bf1f1a5911ba5d96cb68e3b
SHA1 a5295ab89ab544a5986a60f60ed7870c60d1fb22
SHA512 530d69ac501efc3690502437fbf87ad21918102f120fad0ff0b0bfa13a2fb04d21e5324c82f0d89de7e958d7016cf62a99407e13256ba986a477e1db8b7da7d0
SSDEEP 24576:2YFbkIsaPiXSVnC7Yp9zkNmZG8RRlnwyztNUdp5Ti6PimC7s0:2YREXSVMDi3LG066mC7s0
TLSH
T1D875BF96B99184B1C95434F098A6AB7291F56F544E138A8F63F8FE3C6832143DD3B12F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HD_f33ffb9736f7aa99505131a2ff474e7e76dc6f6b926749d3652c974363afae8d.exe

Path C:\Users\Admin\AppData\Local\Temp\HD_f33ffb9736f7aa99505131a2ff474e7e76dc6f6b926749d3652c974363afae8d.exe
Size 4.3MB
SHA256 f05ee3aefece3abda30d7a23ef7fb5a952fbe573dec90667cba982e945349221
MD5 b37fd72983880b1831615802c6cc15de
SHA1 c6aaeef8c3341ac23f9894a2b5cbe49838843933
SHA512 04c8d518000ec899a3477ed08c422a4f89e5b4373c41daadbee727fe9a4745460d9c77aa8311369c86e0a9e5e1b9cc0ca404b8dfacc9e8d15c57deb378b497cc
SSDEEP 98304:eaIaw0Xhs72gV7MuUZJeWjb8yc95ODB7b4ZqyiOIQPudyYwUSc79TYXPaj:zIYhsyW7MukJXIyr17b4ZviQW88SgtYS
TLSH
T1442633F7E3D685B4E562457E0D50B0972779BE252E15C2C3BBF9AE0D3E3E21292190C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

look2.exe

Path C:\Users\Admin\AppData\Local\Temp\look2.exe
Size 337KB
SHA256 86492ebf2d6f471a5ee92977318d099b3ea86175b5b7ae522237ae01d07a4857
MD5 2f3b6f16e33e28ad75f3fdaef2567807
SHA1 85e907340faf1edfc9210db85a04abd43d21b741
SHA512 db17e99e2df918cfc9ccbe934adfe73f0777ce1ce9f28b57a4b24ecd821efe2e0b976a634853247b77b16627d2bb3af4ba20306059d1d25ef38ffada7da3e3a4
SSDEEP 6144:8IXwWcHnNmZEvB7csAPRZyfQjCfA3lMXm4Y+5bFnWBFopJOU:8IXwDNmZEvJcscRZzjCI1O5W
TLSH
T1B474BF137FE4C8B6C59351324EE25F7AA1F6FE902E224A4333956F0CDD32691963A316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UninstallTool.exe

Path C:\Users\Admin\AppData\Local\Temp\~sfx0068273BFC\UninstallTool.exe
Size 261KB
SHA256 5f5dd58890751cf4ed28956f1ac255f05450343ba32f66c4f8703a7be3c2c1fe
MD5 2828f456c442547fd8f928a08bc5945c
SHA1 493b3937f95befd5447dfad195bd6e3b2c7e7fa8
SHA512 2de403da129d1a7ea03432226f5bba325aaf43ebb9eb66a791c32c688e06845a0f300c1042661330dec2e4ecaab4307c8c92c94c06404312dd29862bf9d0c086
SSDEEP 6144:6f9V/EVhh1HxiKcdIAOPnfcbF340zh5HdnOejvHG:6VV/EPkXdItfcbF31dnOejvm
TLSH
T17944AD1176D288B2E4B3193409F8DBB60D7DFD600B608DFF67A4226A5E703D05A36E76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UninstallToolHelper.exe

Path C:\Users\Admin\AppData\Local\Temp\~sfx0068273BFC\UninstallToolHelper.exe
Size 463KB
SHA256 ba8d7b5662f85aa901fd6bcf86fc5989013577b18c81a91bffc1211fec31d6c8
MD5 d82e0a3786dba17f88929d11d6b00b96
SHA1 098f9b676677dc3a30530ad5254b7fb41e1391d9
SHA512 4df64c5f421103fabf156342d41ff2cece82ce6b7015c454ac78680611d4ab64788c7ed50b0505edcd4cc704fdbe3c118370464c476f8047bd0e022ddbc3424d
SSDEEP 12288:jDrJL3QCiSt7hMYDbInjPp7ormE3Lu4iPnOEAPiWTydl6:jDrpQCpXZbCj5Y3C4MXlbK
TLSH
T1CCA4C01679D284B3D67309302DE896A2B97DF93217304EFB67D416190FF06C07A36EA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UninstallTool_x64.dat

Path C:\Users\Admin\AppData\Local\Temp\~sfx0068273BFC\UninstallTool_x64.dat
Size 4.6MB
SHA256 039bcf2ad0906b7ceaf7d083f85460ba3ea940b34bef7dad69ce63571d521e65
MD5 ed1754f89b9574e54db67583e948761e
SHA1 5a9f1b1db4531031b10a6bd0f4969797b2e3c52a
SHA512 bb2fdf0bd8d522d463d65f8bbd31a89b4fb9287a9ee39c1455e065fc7314b792a5376d01263a1ba5d006409acc4e19842b1155e1d45a5684312900297e515184
SSDEEP 98304:xaHkaN2/hZsCYuzZ5KTzt21iLHmZLd3eMCSyo93:IkaN2/hZsCYuzZ5KT9LGZLd9yo93
TLSH
T137267C49BBB841D5D0AAD13888538A4BE6F1BC121F708BCF01647A5E5F3B7E14E7A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

240759578.bat

Path C:\Windows\SysWOW64\240759578.bat
Size 51KB
SHA256 d96c04b4bd83e6aae2812947bc040527de60dfe30d1b0713a40b53825873a334
MD5 962fc92bc93c06954b19a22455110f4a
SHA1 c8e5e7b31c24ecc4345c809494984f21d2c4c68e
SHA512 8d5aad59150a0fec54e710eb9a6317d349318aba522a8f54fe8b848a819b6250dca1fe39e24c7398f6752b85bd1bf52e25703c3e01a970753c1a1d30436faed6
SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL2JYH5:1dWubF3n9S91BF3fboKJYH5
TLSH
T145333A02EE8D88F5F145177038AA33B6953ABDE036996A931F53DDA5C87B370F12D242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchcst.exe

Path C:\Windows\SysWOW64\svchcst.exe
Size 51KB
SHA256 ce6bb7eddc83762c708d4a41709ae00371dbdc09b2a380f28fa60b1edf917473
MD5 2e068ce2770fde8d1af4cb114b98df1f
SHA1 b6f9c2775babb025b22f915c3047aa627d07c312
SHA512 998d695eb56375e63df7db16740b89deb2cf630ccbead8bcf84a921ec6f4a4f9aef2755b703f7190f332b2008ebcc949363bcf8f392d7d07246c255b5073ed35
SSDEEP 1536:6G9yoVEpHP29I3fbcJboSUge5N+CnC/maz9Rh:8pv2mbcJboce58wvOR
TLSH
T137336C236A0A49B3DFE231780A9D7232526DD862075541F7A61057EAFD243E2EE743CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4352-60-0x0000000000400000-0x0000000000E3C000-memory.dmp

Download

memory/5700-63-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/5700-90-0x0000000000400000-0x0000000000474000-memory.dmp

Download