Analysis
- max time kernel
148s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 07:48
Behavioral task
behavioral1
Sample
3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe
- Size 1.5MB
- Sample261102-jnftna1yev
- SHA256 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d
- MD5 7bd834065a80c87f0538a86f086564ea
- SHA1 47818230f3eccdc83315d0df140a49ed0455072e
- SHA512 0bd839f4226000ab4b33fbd5998e0cafcaadaab986d485262e1d5ce9f4f0019ab801e81e257becb2f72bc300b492db504df90d486546fd8c7be4dece25c3773a
- SSDEEP 6144:FQyLEbWaR5Ccs8JFmuy4ixRDDDDh5GYzaQYf5q2G:OUaWaR5vs6q7lGh4
- TLSH T15E75B561A8323994C124E0BD631D44DE90B7F8AA7F340D20E5B19FDBD5A78DC84B4BDA
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
gh0strat
C2
-
156.239.230.222
Signatures
- Gh0st RAT payload 3 IoCs
resource yara_rule behavioral2/memory/960-1-0x0000000010000000-0x0000000010015000-memory.dmp family_gh0strat behavioral2/memory/4068-11-0x0000000000400000-0x0000000000480000-memory.dmp family_gh0strat behavioral2/memory/960-12-0x0000000000400000-0x0000000000480000-memory.dmp family_gh0strat - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe" 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe - Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe File opened (read-only) \??\K: 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe File opened (read-only) \??\L: 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe File opened (read-only) \??\P: 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe File opened (read-only) \??\Y: 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe File opened (read-only) \??\H: 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe File opened (read-only) \??\I: 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe File opened (read-only) \??\J: 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe File opened (read-only) \??\O: 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe File opened (read-only) \??\V: 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe File opened (read-only) \??\W: 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe File opened (read-only) \??\N: 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe File opened (read-only) \??\Q: 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe File opened (read-only) \??\R: 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe File opened (read-only) \??\T: 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe File opened (read-only) \??\B: 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe File opened (read-only) \??\D: 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe File opened (read-only) \??\M: 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe File opened (read-only) \??\S: 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe File opened (read-only) \??\U: 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe File opened (read-only) \??\X: 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe File opened (read-only) \??\Z: 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe -
resource yara_rule behavioral2/memory/960-0-0x0000000000400000-0x0000000000480000-memory.dmp upx behavioral2/memory/4068-11-0x0000000000400000-0x0000000000480000-memory.dmp upx behavioral2/memory/960-12-0x0000000000400000-0x0000000000480000-memory.dmp upx - Enumerates video capture drivers 2 TTPs 1 IoCs
Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe - Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 4068 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 4068 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 4068 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 4068 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe 960 3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe"C:\Users\Admin\AppData\Local\Temp\3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:960
-
C:\Users\Admin\AppData\Local\Temp\3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exeC:\Users\Admin\AppData\Local\Temp\3ef3761f161ddf5aa21a5f49600e07da4b67309e6d301b271437373f046a0c8d.exe1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4068
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:5496
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1