Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/10/2026, 04:34
Behavioral task
behavioral1
Sample
d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe
- Size 136KB
- Sample261029-e686psht3t
- SHA256 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677
- MD5 6bc33ea461aada23d60e84994fca65a8
- SHA1 5e943a59ec4c6bff9f1184e578fca1ec80781d16
- SHA512 07928ed8abc2a1432f5147e7f0081093e62ae004773a4095570deb5b7732406bddcf5a0fce5998c0045e557c55e0fbebc69ce85ebca75cb9f813f9f63e3fb4f6
- SSDEEP 3072:TyIpG2/iDbYzNfpqd9NzgGRSX5a35qE1CK:uIposJhm9hgG0a35q2B
- TLSH T19BD30242F247C4A3F3E12875D90B999D49612CAD8F426E2B0ADDF34FB4B67E52901836
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
gh0strat
C2
-
156.239.230.222
Signatures
- Gh0st RAT payload 3 IoCs
resource yara_rule behavioral2/memory/2856-1-0x0000000010000000-0x0000000010015000-memory.dmp family_gh0strat behavioral2/memory/4100-12-0x0000000000400000-0x000000000046F000-memory.dmp family_gh0strat behavioral2/memory/2856-13-0x0000000000400000-0x000000000046F000-memory.dmp family_gh0strat - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe" d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe - Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe File opened (read-only) \??\T: d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe File opened (read-only) \??\V: d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe File opened (read-only) \??\D: d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe File opened (read-only) \??\G: d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe File opened (read-only) \??\J: d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe File opened (read-only) \??\W: d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe File opened (read-only) \??\Y: d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe File opened (read-only) \??\B: d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe File opened (read-only) \??\I: d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe File opened (read-only) \??\K: d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe File opened (read-only) \??\X: d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe File opened (read-only) \??\Z: d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe File opened (read-only) \??\N: d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe File opened (read-only) \??\Q: d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe File opened (read-only) \??\S: d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe File opened (read-only) \??\U: d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe File opened (read-only) \??\H: d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe File opened (read-only) \??\L: d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe File opened (read-only) \??\M: d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe File opened (read-only) \??\O: d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe File opened (read-only) \??\P: d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe -
resource yara_rule behavioral2/memory/2856-0-0x0000000000400000-0x000000000046F000-memory.dmp upx behavioral2/memory/4100-12-0x0000000000400000-0x000000000046F000-memory.dmp upx behavioral2/memory/2856-13-0x0000000000400000-0x000000000046F000-memory.dmp upx - Enumerates video capture drivers 2 TTPs 1 IoCs
Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 4100 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 4100 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 4100 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 4100 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe 2856 d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe"C:\Users\Admin\AppData\Local\Temp\d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2856
-
C:\Users\Admin\AppData\Local\Temp\d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exeC:\Users\Admin\AppData\Local\Temp\d786cbebe1949613ee4f41e7d9f3ac2c12074140ca864a3073afbbeffc01e677.exe1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4100
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1