File name:

4016caaa795227319e25f1fb219b4dd75119e92c4b8aea034504d4e5166e3711

Full analysis: https://app.any.run/tasks/575d4920-841c-41c5-b3a9-9a2705d59e81
Verdict: Malicious activity
Threats:

Gh0st RAT is a malware with advanced trojan functionality that enables attackers to establish full control over the victim’s system. The spying capabilities of Gh0st RAT made it a go-to tool for numerous criminal groups in high-profile attacks against government and corporate organizations. The most common vector of attack involving this malware begins with spam and phishing emails.

Analysis date: May 19, 2025, 04:45:20
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
sainbox
rat
zegost
loader
gh0st
upx
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

A674D1E876EE396B418CA823762EEC2E

SHA1:

AFEB9AA7FC1251A1C44F1C96BF6BAD0B5A89FAF6

SHA256:

4016CAAA795227319E25F1FB219B4DD75119E92C4B8AEA034504D4E5166E3711

SSDEEP:

98304:diINeEg+diXSVSg5Lru5zX46Tg8Dpw7ubEvnB3H/eyJHEL5o:V

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • ZEGOST has been detected

      • R.exe (PID: 7888)
      • Remote Data.exe (PID: 6708)
    • Creates or modifies Windows services

      • R.exe (PID: 7888)
    • SAINBOX has been detected

      • N.exe (PID: 7960)
      • TXPlatfor.exe (PID: 7976)
      • TXPlatfor.exe (PID: 8032)
    • GH0ST mutex has been found

      • TXPlatfor.exe (PID: 7976)
      • TXPlatfor.exe (PID: 8032)
    • GH0ST has been detected

      • N.exe (PID: 7960)
    • Starts CMD.EXE for self-deleting

      • N.exe (PID: 7960)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • R.exe (PID: 7888)
      • 4016caaa795227319e25f1fb219b4dd75119e92c4b8aea034504d4e5166e3711.exe (PID: 7860)
      • N.exe (PID: 7960)
      • TXPlatfor.exe (PID: 8032)
    • Executes as Windows Service

      • TXPlatfor.exe (PID: 7976)
    • Hides command output

      • cmd.exe (PID: 7996)
    • Starts CMD.EXE for commands execution

      • N.exe (PID: 7960)
    • Drops a system driver (possible attempt to evade defenses)

      • TXPlatfor.exe (PID: 8032)
    • Creates files in the driver directory

      • TXPlatfor.exe (PID: 8032)
    • Creates or modifies Windows services

      • TXPlatfor.exe (PID: 8032)
    • There is functionality for taking screenshot (YARA)

      • 4016caaa795227319e25f1fb219b4dd75119e92c4b8aea034504d4e5166e3711.exe (PID: 7860)
      • TXPlatfor.exe (PID: 8032)
      • Remote Data.exe (PID: 6708)
    • Application launched itself

      • TXPlatfor.exe (PID: 7976)
    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 7996)
  • INFO

    • The sample compiled with chinese language support

      • 4016caaa795227319e25f1fb219b4dd75119e92c4b8aea034504d4e5166e3711.exe (PID: 7860)
    • Checks supported languages

      • R.exe (PID: 7888)
      • N.exe (PID: 7960)
      • TXPlatfor.exe (PID: 7976)
      • TXPlatfor.exe (PID: 8032)
      • 4016caaa795227319e25f1fb219b4dd75119e92c4b8aea034504d4e5166e3711.exe (PID: 7860)
    • Reads the computer name

      • R.exe (PID: 7888)
      • N.exe (PID: 7960)
      • TXPlatfor.exe (PID: 7976)
      • TXPlatfor.exe (PID: 8032)
    • Create files in a temporary directory

      • 4016caaa795227319e25f1fb219b4dd75119e92c4b8aea034504d4e5166e3711.exe (PID: 7860)
    • UPX packer has been detected

      • TXPlatfor.exe (PID: 8032)
    • Reads the software policy settings

      • slui.exe (PID: 5728)
    • Checks proxy server information

      • slui.exe (PID: 5728)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:04:10 02:40:30+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 520192
InitializedDataSize: 2088960
UninitializedDataSize: -
EntryPoint: 0x60da5
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 8.9.8.9
ProductVersionNumber: 8.9.8.9
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Unicode
FileVersion: 8.9.8.9
FileDescription: 应用程序
ProductName: RuntimeBroker
ProductVersion: 8.9.8.9
CompanyName: RuntimeBroker
LegalCopyright: RuntimeBroker
Comments: RuntimeBroker
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
11
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 4016caaa795227319e25f1fb219b4dd75119e92c4b8aea034504d4e5166e3711.exe #ZEGOST r.exe #SAINBOX n.exe #SAINBOX txplatfor.exe no specs cmd.exe no specs conhost.exe no specs #SAINBOX txplatfor.exe ping.exe no specs remote data.exe no specs slui.exe 4016caaa795227319e25f1fb219b4dd75119e92c4b8aea034504d4e5166e3711.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
5728C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6708"C:\WINDOWS\system32\Remote Data.exe" "c:\windows\system32\1099375.txt",MainThreadC:\Windows\SysWOW64\Remote Data.exesvchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows host process (Rundll32)
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\remote data.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
7764"C:\Users\admin\Desktop\4016caaa795227319e25f1fb219b4dd75119e92c4b8aea034504d4e5166e3711.exe" C:\Users\admin\Desktop\4016caaa795227319e25f1fb219b4dd75119e92c4b8aea034504d4e5166e3711.exeexplorer.exe
User:
admin
Company:
RuntimeBroker
Integrity Level:
MEDIUM
Description:
应用程序
Exit code:
3221226540
Version:
8.9.8.9
Modules
Images
c:\users\admin\desktop\4016caaa795227319e25f1fb219b4dd75119e92c4b8aea034504d4e5166e3711.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
7860"C:\Users\admin\Desktop\4016caaa795227319e25f1fb219b4dd75119e92c4b8aea034504d4e5166e3711.exe" C:\Users\admin\Desktop\4016caaa795227319e25f1fb219b4dd75119e92c4b8aea034504d4e5166e3711.exe
explorer.exe
User:
admin
Company:
RuntimeBroker
Integrity Level:
HIGH
Description:
应用程序
Version:
8.9.8.9
Modules
Images
c:\users\admin\desktop\4016caaa795227319e25f1fb219b4dd75119e92c4b8aea034504d4e5166e3711.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
7888C:\Users\admin\AppData\Local\Temp\\R.exeC:\Users\admin\AppData\Local\Temp\R.exe
4016caaa795227319e25f1fb219b4dd75119e92c4b8aea034504d4e5166e3711.exe
User:
admin
Company:
FEIM Studios
Integrity Level:
HIGH
Description:
A Free Enterprise Instant Messenger
Exit code:
0
Version:
3, 5, 0, 1
Modules
Images
c:\users\admin\appdata\local\temp\r.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7960C:\Users\admin\AppData\Local\Temp\\N.exeC:\Users\admin\AppData\Local\Temp\N.exe
4016caaa795227319e25f1fb219b4dd75119e92c4b8aea034504d4e5166e3711.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\n.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
7976C:\WINDOWS\SysWOW64\TXPlatfor.exe -autoC:\Windows\SysWOW64\TXPlatfor.exe
services.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Modules
Images
c:\windows\syswow64\txplatfor.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
7996C:\WINDOWS\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\admin\AppData\Local\Temp\N.exe > nulC:\Windows\SysWOW64\cmd.exeN.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
8008\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
8032C:\WINDOWS\SysWOW64\TXPlatfor.exe -acsiC:\Windows\SysWOW64\TXPlatfor.exe
TXPlatfor.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Modules
Images
c:\windows\syswow64\txplatfor.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
Total events
4 158
Read events
4 141
Write events
17
Delete events
0

Modification events

(PID) Process:(7888) R.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Remote Data
Operation:writeName:Description
Value:
¹ÜÀí»ùÓÚ×é¼þ¶ÔÏóÄ£Ð͵ĺËÐÄ·þÎñ¡£Èç¹û·þÎñ±»½ûÓ㬼ÆËã»ú½«ÎÞ·¨Õý³£ÔËÐС£
(PID) Process:(7888) R.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Remote Data\Parameters
Operation:writeName:ServiceDll
Value:
C:\WINDOWS\system32\1099375.txt
(PID) Process:(7888) R.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Svchost
Operation:writeName:Remote Data
Value:
Remote Data
(PID) Process:(7960) N.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\Select
Operation:writeName:MarkTime
Value:
2025-05-19 04:45
(PID) Process:(8032) TXPlatfor.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\QAssist
Operation:writeName:Type
Value:
2
(PID) Process:(8032) TXPlatfor.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\QAssist
Operation:writeName:Start
Value:
1
(PID) Process:(8032) TXPlatfor.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\QAssist
Operation:writeName:ErrorControl
Value:
0
(PID) Process:(8032) TXPlatfor.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\QAssist
Operation:writeName:ImagePath
Value:
system32\DRIVERS\QAssist.sys
(PID) Process:(8032) TXPlatfor.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\QAssist
Operation:writeName:DisplayName
Value:
QAssist
(PID) Process:(8032) TXPlatfor.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\QAssist
Operation:writeName:Group
Value:
FSFilter Activity Monitor
Executable files
6
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
78604016caaa795227319e25f1fb219b4dd75119e92c4b8aea034504d4e5166e3711.exeC:\Users\admin\AppData\Local\Temp\R.exeexecutable
MD5:8DC3ADF1C490211971C1E2325F1424D2
SHA256:BC29F2022AB3B812E50C8681FF196F090C038B5AB51E37DAFFAC4469A8C2EB2C
8032TXPlatfor.exeC:\Windows\System32\drivers\QAssist.sysexecutable
MD5:4E34C068E764AD0FF0CB58BC4F143197
SHA256:6CCE28B275D5EC20992BB13790976CAF434AB46DDBFD5CFD431D33424943122B
78604016caaa795227319e25f1fb219b4dd75119e92c4b8aea034504d4e5166e3711.exeC:\Users\admin\AppData\Local\Temp\N.exeexecutable
MD5:4A36A48E58829C22381572B2040B6FE0
SHA256:3DE6C02F52A661B8F934F59541D0CF297BB489EB2155E346B63C7338E09AEAF8
78604016caaa795227319e25f1fb219b4dd75119e92c4b8aea034504d4e5166e3711.exeC:\Users\admin\AppData\Local\Temp\HD_X.datexecutable
MD5:A674D1E876EE396B418CA823762EEC2E
SHA256:4016CAAA795227319E25F1FB219B4DD75119E92C4B8AEA034504D4E5166E3711
7960N.exeC:\Windows\SysWOW64\TXPlatfor.exeexecutable
MD5:4A36A48E58829C22381572B2040B6FE0
SHA256:3DE6C02F52A661B8F934F59541D0CF297BB489EB2155E346B63C7338E09AEAF8
7888R.exeC:\Windows\SysWOW64\ini.initext
MD5:3A8E21A576EBB4D6C9F1BEA57EE11E82
SHA256:3493F90E349CC4B066E8CACD25451D38E527F4473F336D7706D1125C2F456D12
7888R.exeC:\Windows\SysWOW64\1099375.txtexecutable
MD5:58AD75C42C21F31D04B765C23A533B39
SHA256:42E78B229CE60675965D05ECFC6CBA8AB4DC12383FDC11F426C3D8015390174D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
52
DNS requests
34
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
2104
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
6036
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
whitelisted
6036
SIHClient.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
whitelisted
6036
SIHClient.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
whitelisted
6036
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
6036
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
whitelisted
6036
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
whitelisted
6036
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
whitelisted
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
2104
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6544
svchost.exe
20.190.159.130:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 51.104.136.2
whitelisted
google.com
  • 216.58.206.46
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.42
  • 23.216.77.20
  • 23.216.77.28
whitelisted
hackerinvasion.f3322.net
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
login.live.com
  • 20.190.159.130
  • 40.126.31.73
  • 20.190.159.64
  • 40.126.31.71
  • 20.190.159.4
  • 40.126.31.67
  • 40.126.31.0
  • 20.190.159.23
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info