| File name: | 584e2801498be07ffc35c3aa3654484c1bb832039e73ce81f65316fa99d5bfd9 |
| Full analysis: | https://app.any.run/tasks/1b41a7aa-1127-4c80-8920-df19c5fdf9e1 |
| Verdict: | Malicious activity |
| Threats: | Gh0st RAT is a malware with advanced trojan functionality that enables attackers to establish full control over the victim’s system. The spying capabilities of Gh0st RAT made it a go-to tool for numerous criminal groups in high-profile attacks against government and corporate organizations. The most common vector of attack involving this malware begins with spam and phishing emails. |
| Analysis date: | February 09, 2025, 12:25:33 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections |
| MD5: | AE417EF46CFD1950BE425676DD25BE99 |
| SHA1: | 36F2B9B8A318B1E7687CD8D7BAF9D8BDAFC3F73B |
| SHA256: | 584E2801498BE07FFC35C3AA3654484C1BB832039E73CE81F65316FA99D5BFD9 |
| SSDEEP: | 49152:ZaKoXA2V5VqZMBys8KZB6j/uDGspoHc+bi3vt2NCjE2NWgwvnfKKoTCZ+gKyEYVn:ZaKr2VHqZMR8KZB6j/vHc+bilgWEqWgi |
MALICIOUS
Executing a file with an untrusted certificate
- 584e2801498be07ffc35c3aa3654484c1bb832039e73ce81f65316fa99d5bfd9.exe (PID: 6496)
Starts CMD.EXE for self-deleting
- AK74.exe (PID: 6736)
GH0ST has been detected
- AK74.exe (PID: 6736)
GH0ST mutex has been found
- 584e2801498be07ffc35c3aa3654484c1bb832039e73ce81f65316fa99d5bfd9.exe (PID: 6636)
SAINBOX has been detected
- Ghiya.exe (PID: 6828)
Create files in the Startup directory
- 584e2801498be07ffc35c3aa3654484c1bb832039e73ce81f65316fa99d5bfd9.exe (PID: 6636)
Changes the autorun value in the registry
- 584e2801498be07ffc35c3aa3654484c1bb832039e73ce81f65316fa99d5bfd9.exe (PID: 6636)
Uses sleep, probably for evasion detection (SCRIPT)
- wscript.exe (PID: 7004)
- wscript.exe (PID: 7008)
SUSPICIOUS
Reads security settings of Internet Explorer
- 584e2801498be07ffc35c3aa3654484c1bb832039e73ce81f65316fa99d5bfd9.exe (PID: 6636)
Executable content was dropped or overwritten
- 584e2801498be07ffc35c3aa3654484c1bb832039e73ce81f65316fa99d5bfd9.exe (PID: 6636)
- AK47.exe (PID: 6692)
- Ghiya.exe (PID: 6828)
- AK74.exe (PID: 6736)
Mutex name with non-standard characters
- AK47.exe (PID: 6700)
- AK47.exe (PID: 6692)
Hides command output
- cmd.exe (PID: 6820)
Starts CMD.EXE for commands execution
- AK74.exe (PID: 6736)
Application launched itself
- Ghiya.exe (PID: 6800)
Creates files in the driver directory
- Ghiya.exe (PID: 6828)
Drops a system driver (possible attempt to evade defenses)
- Ghiya.exe (PID: 6828)
Creates or modifies Windows services
- Ghiya.exe (PID: 6828)
- AK47.exe (PID: 6692)
Executes as Windows Service
- Ghiya.exe (PID: 6800)
The process executes VB scripts
- 584e2801498be07ffc35c3aa3654484c1bb832039e73ce81f65316fa99d5bfd9.exe (PID: 6636)
Accesses WMI object, sets custom ImpersonationLevel (SCRIPT)
- wscript.exe (PID: 7008)
- wscript.exe (PID: 7004)
Executes WMI query (SCRIPT)
- wscript.exe (PID: 7008)
- wscript.exe (PID: 7004)
Runs PING.EXE to delay simulation
- cmd.exe (PID: 6820)
There is functionality for taking screenshot (YARA)
- 584e2801498be07ffc35c3aa3654484c1bb832039e73ce81f65316fa99d5bfd9.exe (PID: 6636)
- Ghiya.exe (PID: 6828)
There is functionality for enable RDP (YARA)
- 584e2801498be07ffc35c3aa3654484c1bb832039e73ce81f65316fa99d5bfd9.exe (PID: 6636)
Connects to unusual port
- 584e2801498be07ffc35c3aa3654484c1bb832039e73ce81f65316fa99d5bfd9.exe (PID: 6636)
INFO
Checks supported languages
- 584e2801498be07ffc35c3aa3654484c1bb832039e73ce81f65316fa99d5bfd9.exe (PID: 6636)
- Ghiya.exe (PID: 6800)
- AK47.exe (PID: 6700)
- Ghiya.exe (PID: 6828)
- AK47.exe (PID: 6692)
- AK74.exe (PID: 6736)
Reads the computer name
- 584e2801498be07ffc35c3aa3654484c1bb832039e73ce81f65316fa99d5bfd9.exe (PID: 6636)
- AK47.exe (PID: 6692)
- AK74.exe (PID: 6736)
- Ghiya.exe (PID: 6800)
- Ghiya.exe (PID: 6828)
The sample compiled with chinese language support
- 584e2801498be07ffc35c3aa3654484c1bb832039e73ce81f65316fa99d5bfd9.exe (PID: 6636)
Process checks computer location settings
- 584e2801498be07ffc35c3aa3654484c1bb832039e73ce81f65316fa99d5bfd9.exe (PID: 6636)
Creates files or folders in the user directory
- 584e2801498be07ffc35c3aa3654484c1bb832039e73ce81f65316fa99d5bfd9.exe (PID: 6636)
VMProtect protector has been detected
- 584e2801498be07ffc35c3aa3654484c1bb832039e73ce81f65316fa99d5bfd9.exe (PID: 6636)
UPX packer has been detected
- Ghiya.exe (PID: 6828)
Create files in a temporary directory
- 584e2801498be07ffc35c3aa3654484c1bb832039e73ce81f65316fa99d5bfd9.exe (PID: 6636)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win64 Executable (generic) (64.6) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (15.4) |
| .exe | | | Win32 Executable (generic) (10.5) |
| .exe | | | Generic Win/DOS Executable (4.6) |
| .exe | | | DOS Executable Generic (4.6) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2021:03:29 14:48:39+00:00 |
| ImageFileCharacteristics: | Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 3530752 |
| InitializedDataSize: | 835584 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x2dfb0a |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x0000 |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| FileVersion: | 1.0.0.0 |
| FileDescription: | Windows 配置程序 |
| ProductName: | Windows 核心进程 |
| ProductVersion: | 1.0.0.0 |
| LegalCopyright: | 作者版权所有 请尊重并使用正版 |
| Comments: | 本程序使用易语言编写(http://www.eyuyan.com) |
Total processes
133
Monitored processes
12
Malicious processes
6
Suspicious processes
2
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 6496 | "C:\Users\admin\Desktop\584e2801498be07ffc35c3aa3654484c1bb832039e73ce81f65316fa99d5bfd9.exe" | C:\Users\admin\Desktop\584e2801498be07ffc35c3aa3654484c1bb832039e73ce81f65316fa99d5bfd9.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 3221226540 Modules
| |||||||||||||||
| 6636 | "C:\Users\admin\Desktop\584e2801498be07ffc35c3aa3654484c1bb832039e73ce81f65316fa99d5bfd9.exe" | C:\Users\admin\Desktop\584e2801498be07ffc35c3aa3654484c1bb832039e73ce81f65316fa99d5bfd9.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: HIGH Modules
| |||||||||||||||
| 6692 | "C:\Users\admin\AppData\Local\Temp\AK47.exe" | C:\Users\admin\AppData\Local\Temp\AK47.exe | 584e2801498be07ffc35c3aa3654484c1bb832039e73ce81f65316fa99d5bfd9.exe | ||||||||||||
User: admin Company: FEIM Studios Integrity Level: HIGH Description: A Free Enterprise Instant Messenger Exit code: 0 Version: 3, 5, 0, 1 Modules
| |||||||||||||||
| 6700 | C:\Users\admin\AppData\Local\Temp\\AK47.exe | C:\Users\admin\AppData\Local\Temp\AK47.exe | — | 584e2801498be07ffc35c3aa3654484c1bb832039e73ce81f65316fa99d5bfd9.exe | |||||||||||
User: admin Company: FEIM Studios Integrity Level: HIGH Description: A Free Enterprise Instant Messenger Exit code: 0 Version: 3, 5, 0, 1 Modules
| |||||||||||||||
| 6736 | C:\Users\admin\AppData\Local\Temp\\AK74.exe | C:\Users\admin\AppData\Local\Temp\AK74.exe | 584e2801498be07ffc35c3aa3654484c1bb832039e73ce81f65316fa99d5bfd9.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 6800 | C:\WINDOWS\SysWOW64\Ghiya.exe -auto | C:\Windows\SysWOW64\Ghiya.exe | — | services.exe | |||||||||||
User: SYSTEM Integrity Level: SYSTEM Exit code: 0 Modules
| |||||||||||||||
| 6820 | C:\WINDOWS\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\admin\AppData\Local\Temp\AK74.exe > nul | C:\Windows\SysWOW64\cmd.exe | — | AK74.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6828 | C:\WINDOWS\SysWOW64\Ghiya.exe -acsi | C:\Windows\SysWOW64\Ghiya.exe | Ghiya.exe | ||||||||||||
User: SYSTEM Integrity Level: SYSTEM Modules
| |||||||||||||||
| 6852 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6928 | ping -n 2 127.0.0.1 | C:\Windows\SysWOW64\PING.EXE | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: TCP/IP Ping Command Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
4 779
Read events
4 758
Write events
21
Delete events
0
Modification events
| (PID) Process: | (6636) 584e2801498be07ffc35c3aa3654484c1bb832039e73ce81f65316fa99d5bfd9.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer |
| Operation: | write | Name: | SlowContextMenuEntries |
Value: 6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000 | |||
| (PID) Process: | (6636) 584e2801498be07ffc35c3aa3654484c1bb832039e73ce81f65316fa99d5bfd9.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | 360safo |
Value: C:\Users\admin\AppData\Roaming\Microsoft\svchcst.exe | |||
| (PID) Process: | (6692) AK47.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Ö÷¶¯·ÀÓù·þÎñÄ£¿é |
| Operation: | write | Name: | Description |
Value: ¹ÜÀí»ùÓÚ×é¼þ¶ÔÏóÄ£Ð͵ĺËÐÄ·þÎñ¡£Èç¹û·þÎñ±»½ûÓ㬼ÆËã»ú½«ÎÞ·¨Õý³£ÔËÐС£ | |||
| (PID) Process: | (6692) AK47.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Ö÷¶¯·ÀÓù·þÎñÄ£¿é\Parameters |
| Operation: | write | Name: | ServiceDll |
Value: C:\WINDOWS\system32\1272265.txt | |||
| (PID) Process: | (6692) AK47.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Svchost |
| Operation: | write | Name: | Ö÷¶¯·ÀÓù·þÎñÄ£¿é |
Value: Ö÷¶¯·ÀÓù·þÎñÄ£¿é | |||
| (PID) Process: | (6736) AK74.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\Select |
| Operation: | write | Name: | MarkTime |
Value: 2025-02-09 12:25 | |||
| (PID) Process: | (6828) Ghiya.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\QAssist |
| Operation: | write | Name: | Type |
Value: 2 | |||
| (PID) Process: | (6828) Ghiya.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\QAssist |
| Operation: | write | Name: | Start |
Value: 1 | |||
| (PID) Process: | (6828) Ghiya.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\QAssist |
| Operation: | write | Name: | ErrorControl |
Value: 0 | |||
| (PID) Process: | (6828) Ghiya.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\QAssist |
| Operation: | write | Name: | ImagePath |
Value: system32\DRIVERS\QAssist.sys | |||
Executable files
7
Suspicious files
1
Text files
3
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6692 | AK47.exe | C:\Windows\SysWOW64\1272265.txt | executable | |
MD5:D1FC869FE95FE786D5234D620A70A439 | SHA256:CFC3BEB59676AC47A1C705E7B2B0D8147B63D386619546985FCA5BB73E0235EE | |||
| 6636 | 584e2801498be07ffc35c3aa3654484c1bb832039e73ce81f65316fa99d5bfd9.exe | C:\Users\admin\AppData\Roaming\Microsoft\Config.ini | text | |
MD5:29CE53E2A4A446614CCC8D64D346BDE4 | SHA256:56225BE6838BC6E93EA215891EACF28844AE27A9F8B2B29BF19D3A8C2B1F58DF | |||
| 6828 | Ghiya.exe | C:\Windows\System32\drivers\QAssist.sys | executable | |
MD5:4E34C068E764AD0FF0CB58BC4F143197 | SHA256:6CCE28B275D5EC20992BB13790976CAF434AB46DDBFD5CFD431D33424943122B | |||
| 6636 | 584e2801498be07ffc35c3aa3654484c1bb832039e73ce81f65316fa99d5bfd9.exe | C:\Users\admin\AppData\Roaming\svchcst.exe | executable | |
MD5:AE417EF46CFD1950BE425676DD25BE99 | SHA256:584E2801498BE07FFC35C3AA3654484C1BB832039E73CE81F65316FA99D5BFD9 | |||
| 6692 | AK47.exe | C:\Windows\SysWOW64\ini.ini | text | |
MD5:F5BFF67D91D257BB69D2AC2CD9BAA78B | SHA256:925B5A18058B36A2F24FDBC1FCF159B69C22730B76E54562907FF88CF8984453 | |||
| 6636 | 584e2801498be07ffc35c3aa3654484c1bb832039e73ce81f65316fa99d5bfd9.exe | C:\Users\admin\AppData\Local\Temp\AK47.exe | executable | |
MD5:423EB994ED553294F8A6813619B8DA87 | SHA256:050B4F2D5AE8EAECD414318DC8E222A56F169626DA6CA8FEB7EDD78E8B1F0218 | |||
| 6636 | 584e2801498be07ffc35c3aa3654484c1bb832039e73ce81f65316fa99d5bfd9.exe | C:\Users\admin\AppData\Local\Temp\AK74.exe | executable | |
MD5:B0998AA7D5071D33DAA5B60B9C3C9735 | SHA256:3080B6BB456564899B0D99D4131BD6A0B284D31F7D80EF773E4872D94048D49A | |||
| 6636 | 584e2801498be07ffc35c3aa3654484c1bb832039e73ce81f65316fa99d5bfd9.exe | C:\Users\admin\AppData\Roaming\Microsoft\VBS3.vbs | text | |
MD5:F21471C3A2C5F50898D224566A51B415 | SHA256:5EA37D5967873A0D5EAB6ECCD595C64702D0FCADA07E528058213B203109860A | |||
| 6636 | 584e2801498be07ffc35c3aa3654484c1bb832039e73ce81f65316fa99d5bfd9.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.lnk | binary | |
MD5:8B6690FD24513452E465D9C777F9631B | SHA256:0DBF0821827CCDA0C26F166F1ED1A73521E23B4DDF2D65F4FD99C7E3ABAACA74 | |||
| 6736 | AK74.exe | C:\Windows\SysWOW64\Ghiya.exe | executable | |
MD5:B0998AA7D5071D33DAA5B60B9C3C9735 | SHA256:3080B6BB456564899B0D99D4131BD6A0B284D31F7D80EF773E4872D94048D49A | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
209
DNS requests
36
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
4712 | MoUsoCoreWorker.exe | GET | 200 | 23.48.23.176:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
3040 | svchost.exe | GET | 200 | 23.48.23.176:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
3040 | svchost.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 104.126.37.160:443 | — | Akamai International B.V. | DE | unknown |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
3040 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4712 | MoUsoCoreWorker.exe | 23.48.23.176:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
3040 | svchost.exe | 23.48.23.176:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4712 | MoUsoCoreWorker.exe | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
3040 | svchost.exe | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
4712 | MoUsoCoreWorker.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
cf1549064127.f3322.net |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
self.events.data.microsoft.com |
| whitelisted |