File name:

ÇåÍËÍŶÓÊý¾ÝʹÓÃÃûµ¥-VIP.exe

Full analysis: https://app.any.run/tasks/16d217ff-ad69-4bc2-a8af-dd6307dd133b
Verdict: Malicious activity
Threats:

Gh0st RAT is a malware with advanced trojan functionality that enables attackers to establish full control over the victim’s system. The spying capabilities of Gh0st RAT made it a go-to tool for numerous criminal groups in high-profile attacks against government and corporate organizations. The most common vector of attack involving this malware begins with spam and phishing emails.

Analysis date: February 17, 2025, 07:00:53
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
loader
remote
rat
gh0st
gh0stcringe
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 5 sections
MD5:

BE740FFC1F8F0DCC94A5BEFCC0EFDCDF

SHA1:

A6B8F86C05AA03F304F145BB96F83D4EF8467DC1

SHA256:

A39D04119147F3CFD6AFE16E5D5CDA2C205030114095921AD6A77A47CD230AFA

SSDEEP:

6144:NiFryOWMdC3H1b23/2eGCGgYXGRgk4mH:NiFmOWMdE1b23/2eGCGgYXGp4m

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • GH0ST has been detected (SURICATA)

      • wpscloudsvr.exe (PID: 4144)
    • Changes the autorun value in the registry

      • wpscloudsvr.exe (PID: 4144)
  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • ÇåÍËÍŶÓÊý¾ÝʹÓÃÃûµ¥-VIP.exe (PID: 4716)
      • wpscloudsvr.exe (PID: 4144)
    • Potential Corporate Privacy Violation

      • ÇåÍËÍŶÓÊý¾ÝʹÓÃÃûµ¥-VIP.exe (PID: 4716)
    • Connects to the server without a host name

      • ÇåÍËÍŶÓÊý¾ÝʹÓÃÃûµ¥-VIP.exe (PID: 4716)
    • Executable content was dropped or overwritten

      • ÇåÍËÍŶÓÊý¾ÝʹÓÃÃûµ¥-VIP.exe (PID: 4716)
    • Process requests binary or script from the Internet

      • ÇåÍËÍŶÓÊý¾ÝʹÓÃÃûµ¥-VIP.exe (PID: 4716)
    • Reads the date of Windows installation

      • ÇåÍËÍŶÓÊý¾ÝʹÓÃÃûµ¥-VIP.exe (PID: 4716)
    • Likely accesses (executes) a file from the Public directory

      • wpscloudsvr.exe (PID: 4144)
    • Contacting a server suspected of hosting an CnC

      • wpscloudsvr.exe (PID: 4144)
    • Connects to unusual port

      • wpscloudsvr.exe (PID: 4144)
    • There is functionality for taking screenshot (YARA)

      • wpscloudsvr.exe (PID: 4144)
  • INFO

    • Checks proxy server information

      • ÇåÍËÍŶÓÊý¾ÝʹÓÃÃûµ¥-VIP.exe (PID: 4716)
      • wpscloudsvr.exe (PID: 4144)
    • Creates files or folders in the user directory

      • ÇåÍËÍŶÓÊý¾ÝʹÓÃÃûµ¥-VIP.exe (PID: 4716)
    • Checks supported languages

      • ÇåÍËÍŶÓÊý¾ÝʹÓÃÃûµ¥-VIP.exe (PID: 4716)
      • wpscloudsvr.exe (PID: 4144)
    • Reads the computer name

      • ÇåÍËÍŶÓÊý¾ÝʹÓÃÃûµ¥-VIP.exe (PID: 4716)
      • wpscloudsvr.exe (PID: 4144)
    • The sample compiled with english language support

      • ÇåÍËÍŶÓÊý¾ÝʹÓÃÃûµ¥-VIP.exe (PID: 4716)
    • Process checks computer location settings

      • ÇåÍËÍŶÓÊý¾ÝʹÓÃÃûµ¥-VIP.exe (PID: 4716)
    • Reads CPU info

      • wpscloudsvr.exe (PID: 4144)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:02:08 07:50:43+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.42
CodeSize: 139776
InitializedDataSize: 83968
UninitializedDataSize: -
EntryPoint: 0x7870
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
128
Monitored processes
2
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start ã‡ã¥ãã‹ãã…â¶ã“ãŠã½â¾ããŠâ¹ã“ãƒãƒã»âµâ¥-vip.exe #GH0ST wpscloudsvr.exe

Process information

PID
CMD
Path
Indicators
Parent process
4144"C:\Users\Public\WindowsDirectory\wpscloudsvr.exe" C:\Users\Public\WindowsDirectory\wpscloudsvr.exe
ÇåÍËÍŶÓÊý¾ÝʹÓÃÃûµ¥-VIP.exe
User:
admin
Integrity Level:
MEDIUM
Version:
2017.4.5.9032155
Modules
Images
c:\users\public\windowsdirectory\wpscloudsvr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
4716"C:\Users\admin\AppData\Local\Temp\ÇåÍËÍŶÓÊý¾ÝʹÓÃÃûµ¥-VIP.exe" C:\Users\admin\AppData\Local\Temp\ÇåÍËÍŶÓÊý¾ÝʹÓÃÃûµ¥-VIP.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\ã‡ã¥ãã‹ãã…â¶ã“ãŠã½â¾ããŠâ¹ã“ãƒãƒã»âµâ¥-vip.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
Total events
1 329
Read events
1 325
Write events
4
Delete events
0

Modification events

(PID) Process:(4716) Ã‡Ã¥ÃÃ‹ÃÃ…¶ÓÊý¾ÝʹÓÃÃûµ¥-VIP.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4716) Ã‡Ã¥ÃÃ‹ÃÃ…¶ÓÊý¾ÝʹÓÃÃûµ¥-VIP.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4716) Ã‡Ã¥ÃÃ‹ÃÃ…¶ÓÊý¾ÝʹÓÃÃûµ¥-VIP.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(4144) wpscloudsvr.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Realtek¸ßÇåÎúÒôƵ¹ÜÀíÆ÷
Value:
C:\Users\Public\WindowsDirectory\wpscloudsvr.exe
Executable files
4
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
4716ÇåÍËÍŶÓÊý¾ÝʹÓÃÃûµ¥-VIP.exeC:\Users\Public\WindowsDirectory\wpscloudsvr.exeexecutable
MD5:24BF2E499C377E2F521707E2EC88280A
SHA256:C04B5F44426D7F3B8B096B72D37B23C3545E30F35932CC1A2AA5438FBC136D8B
4716ÇåÍËÍŶÓÊý¾ÝʹÓÃÃûµ¥-VIP.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\UnityPlayer[1].dllexecutable
MD5:531A48F1374B7BDCB8645AC33A058382
SHA256:B69030F3930AC8F06F5527DE3226BAF29EAE8D46E8FFABB0D7675F3E0C6BC8E2
4716ÇåÍËÍŶÓÊý¾ÝʹÓÃÃûµ¥-VIP.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\wpscloudsvr[1].exeexecutable
MD5:24BF2E499C377E2F521707E2EC88280A
SHA256:C04B5F44426D7F3B8B096B72D37B23C3545E30F35932CC1A2AA5438FBC136D8B
4716ÇåÍËÍŶÓÊý¾ÝʹÓÃÃûµ¥-VIP.exeC:\Users\Public\WindowsDirectory\UnityPlayer.dllexecutable
MD5:531A48F1374B7BDCB8645AC33A058382
SHA256:B69030F3930AC8F06F5527DE3226BAF29EAE8D46E8FFABB0D7675F3E0C6BC8E2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
33
DNS requests
17
Threats
9

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
2536
svchost.exe
GET
200
23.48.23.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
2536
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
whitelisted
1176
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
4716
ÇåÍËÍŶÓÊý¾ÝʹÓÃÃûµ¥-VIP.exe
GET
200
143.92.51.20:80
http://143.92.51.20/UnityPlayer.dll
unknown
unknown
4716
ÇåÍËÍŶÓÊý¾ÝʹÓÃÃûµ¥-VIP.exe
GET
200
143.92.51.20:80
http://143.92.51.20/wpscloudsvr.exe
unknown
unknown
644
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
whitelisted
3420
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2536
svchost.exe
23.48.23.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2536
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5064
SearchApp.exe
92.123.104.25:443
www.bing.com
Akamai International B.V.
DE
whitelisted
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1016
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4716
ÇåÍËÍŶÓÊý¾ÝʹÓÃÃûµ¥-VIP.exe
143.92.51.20:80
BGPNET Global ASN
HK
unknown

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.48.23.176
  • 23.48.23.194
  • 23.48.23.164
  • 23.48.23.145
  • 23.48.23.166
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 2.23.246.101
whitelisted
google.com
  • 142.250.186.174
whitelisted
www.bing.com
  • 92.123.104.25
  • 92.123.104.19
  • 92.123.104.20
  • 92.123.104.28
  • 92.123.104.18
  • 92.123.104.23
  • 92.123.104.15
  • 92.123.104.26
  • 92.123.104.29
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 184.30.131.245
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
login.live.com
  • 20.190.160.5
  • 20.190.160.66
  • 20.190.160.3
  • 40.126.32.138
  • 20.190.160.131
  • 20.190.160.64
  • 40.126.32.74
  • 20.190.160.2
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted

Threats

PID
Process
Class
Message
4716
ÇåÍËÍŶÓÊý¾ÝʹÓÃÃûµ¥-VIP.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
4716
ÇåÍËÍŶÓÊý¾ÝʹÓÃÃûµ¥-VIP.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
4716
ÇåÍËÍŶÓÊý¾ÝʹÓÃÃûµ¥-VIP.exe
Misc activity
ET INFO Packed Executable Download
4716
ÇåÍËÍŶÓÊý¾ÝʹÓÃÃûµ¥-VIP.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
4716
ÇåÍËÍŶÓÊý¾ÝʹÓÃÃûµ¥-VIP.exe
Misc activity
ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)
4716
ÇåÍËÍŶÓÊý¾ÝʹÓÃÃûµ¥-VIP.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
4716
ÇåÍËÍŶÓÊý¾ÝʹÓÃÃûµ¥-VIP.exe
Misc activity
ET INFO Packed Executable Download
4144
wpscloudsvr.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] Gh0stRat
4144
wpscloudsvr.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] Gh0stCringe Successful Connection
No debug info