File name:

cbe788ade8b4b72cdd6593d7c5c903fa3c44af51933ffbba75be1dd44bf837b5

Full analysis: https://app.any.run/tasks/7ca1f242-4237-4dd1-b563-c1fd4d74a2a4
Verdict: Malicious activity
Threats:

Gh0st RAT is a malware with advanced trojan functionality that enables attackers to establish full control over the victim’s system. The spying capabilities of Gh0st RAT made it a go-to tool for numerous criminal groups in high-profile attacks against government and corporate organizations. The most common vector of attack involving this malware begins with spam and phishing emails.

Analysis date: March 24, 2025, 20:31:18
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
gh0st
rat
zegost
loader
upx
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

BAF3CFF400FA65ADB377E6179D7E92CE

SHA1:

5B6A5BEC8587C8C6810A6E99095938E1207C40D7

SHA256:

CBE788ADE8B4B72CDD6593D7C5C903FA3C44AF51933FFBBA75BE1DD44BF837B5

SSDEEP:

98304:siINeEg+diXSVSg5Lru5zX46Tg8Dpw7ubEvnB3H/eyJHELjf:p

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Creates or modifies Windows services

      • R.exe (PID: 4688)
    • ZEGOST has been detected

      • R.exe (PID: 4688)
    • GH0ST mutex has been found

      • TXPlatfor.exe (PID: 4120)
      • TXPlatfor.exe (PID: 4724)
    • Starts CMD.EXE for self-deleting

      • N.exe (PID: 1188)
    • GH0ST has been detected

      • N.exe (PID: 1188)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • R.exe (PID: 4688)
      • cbe788ade8b4b72cdd6593d7c5c903fa3c44af51933ffbba75be1dd44bf837b5.exe (PID: 2600)
      • N.exe (PID: 1188)
      • TXPlatfor.exe (PID: 4724)
    • Executes as Windows Service

      • TXPlatfor.exe (PID: 4120)
    • Creates or modifies Windows services

      • TXPlatfor.exe (PID: 4724)
    • Creates files in the driver directory

      • TXPlatfor.exe (PID: 4724)
    • Starts CMD.EXE for commands execution

      • N.exe (PID: 1188)
    • Hides command output

      • cmd.exe (PID: 6272)
    • Application launched itself

      • TXPlatfor.exe (PID: 4120)
    • There is functionality for taking screenshot (YARA)

      • TXPlatfor.exe (PID: 4724)
      • cbe788ade8b4b72cdd6593d7c5c903fa3c44af51933ffbba75be1dd44bf837b5.exe (PID: 2600)
    • Drops a system driver (possible attempt to evade defenses)

      • TXPlatfor.exe (PID: 4724)
    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 6272)
  • INFO

    • The sample compiled with chinese language support

      • cbe788ade8b4b72cdd6593d7c5c903fa3c44af51933ffbba75be1dd44bf837b5.exe (PID: 2600)
    • Reads the computer name

      • R.exe (PID: 4688)
      • N.exe (PID: 1188)
      • TXPlatfor.exe (PID: 4120)
      • TXPlatfor.exe (PID: 4724)
    • Checks supported languages

      • N.exe (PID: 1188)
      • TXPlatfor.exe (PID: 4724)
      • cbe788ade8b4b72cdd6593d7c5c903fa3c44af51933ffbba75be1dd44bf837b5.exe (PID: 2600)
      • TXPlatfor.exe (PID: 4120)
      • R.exe (PID: 4688)
    • Create files in a temporary directory

      • cbe788ade8b4b72cdd6593d7c5c903fa3c44af51933ffbba75be1dd44bf837b5.exe (PID: 2600)
    • UPX packer has been detected

      • TXPlatfor.exe (PID: 4724)
    • Reads the software policy settings

      • slui.exe (PID: 2316)
    • Checks proxy server information

      • slui.exe (PID: 2316)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:04:10 02:40:30+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 520192
InitializedDataSize: 2162688
UninitializedDataSize: -
EntryPoint: 0x60da5
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 8.9.8.9
ProductVersionNumber: 8.9.8.9
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Unicode
FileVersion: 8.9.8.9
FileDescription: 应用程序
ProductName: RuntimeBroker
ProductVersion: 8.9.8.9
CompanyName: RuntimeBroker
LegalCopyright: RuntimeBroker
Comments: RuntimeBroker
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
137
Monitored processes
10
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start cbe788ade8b4b72cdd6593d7c5c903fa3c44af51933ffbba75be1dd44bf837b5.exe #ZEGOST r.exe n.exe #GH0ST txplatfor.exe no specs cmd.exe no specs #GH0ST txplatfor.exe conhost.exe no specs ping.exe no specs slui.exe cbe788ade8b4b72cdd6593d7c5c903fa3c44af51933ffbba75be1dd44bf837b5.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1188C:\Users\admin\AppData\Local\Temp\\N.exeC:\Users\admin\AppData\Local\Temp\N.exe
cbe788ade8b4b72cdd6593d7c5c903fa3c44af51933ffbba75be1dd44bf837b5.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\n.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2316C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2600"C:\Users\admin\Desktop\cbe788ade8b4b72cdd6593d7c5c903fa3c44af51933ffbba75be1dd44bf837b5.exe" C:\Users\admin\Desktop\cbe788ade8b4b72cdd6593d7c5c903fa3c44af51933ffbba75be1dd44bf837b5.exe
explorer.exe
User:
admin
Company:
RuntimeBroker
Integrity Level:
HIGH
Description:
应用程序
Version:
8.9.8.9
Modules
Images
c:\users\admin\desktop\cbe788ade8b4b72cdd6593d7c5c903fa3c44af51933ffbba75be1dd44bf837b5.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
4120C:\WINDOWS\SysWOW64\TXPlatfor.exe -autoC:\Windows\SysWOW64\TXPlatfor.exe
services.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Modules
Images
c:\windows\syswow64\txplatfor.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
4300ping -n 2 127.0.0.1 C:\Windows\SysWOW64\PING.EXEcmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Ping Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4688C:\Users\admin\AppData\Local\Temp\\R.exeC:\Users\admin\AppData\Local\Temp\R.exe
cbe788ade8b4b72cdd6593d7c5c903fa3c44af51933ffbba75be1dd44bf837b5.exe
User:
admin
Company:
FEIM Studios
Integrity Level:
HIGH
Description:
A Free Enterprise Instant Messenger
Exit code:
0
Version:
3, 5, 0, 1
Modules
Images
c:\users\admin\appdata\local\temp\r.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4724C:\WINDOWS\SysWOW64\TXPlatfor.exe -acsiC:\Windows\SysWOW64\TXPlatfor.exe
TXPlatfor.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Modules
Images
c:\windows\syswow64\txplatfor.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
5428\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5800"C:\Users\admin\Desktop\cbe788ade8b4b72cdd6593d7c5c903fa3c44af51933ffbba75be1dd44bf837b5.exe" C:\Users\admin\Desktop\cbe788ade8b4b72cdd6593d7c5c903fa3c44af51933ffbba75be1dd44bf837b5.exeexplorer.exe
User:
admin
Company:
RuntimeBroker
Integrity Level:
MEDIUM
Description:
应用程序
Exit code:
3221226540
Version:
8.9.8.9
Modules
Images
c:\users\admin\desktop\cbe788ade8b4b72cdd6593d7c5c903fa3c44af51933ffbba75be1dd44bf837b5.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
6272C:\WINDOWS\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\admin\AppData\Local\Temp\N.exe > nulC:\Windows\SysWOW64\cmd.exeN.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
3 897
Read events
3 880
Write events
17
Delete events
0

Modification events

(PID) Process:(4688) R.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Remote Data
Operation:writeName:Description
Value:
¹ÜÀí»ùÓÚ×é¼þ¶ÔÏóÄ£Ð͵ĺËÐÄ·þÎñ¡£Èç¹û·þÎñ±»½ûÓ㬼ÆËã»ú½«ÎÞ·¨Õý³£ÔËÐС£
(PID) Process:(4688) R.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Remote Data\Parameters
Operation:writeName:ServiceDll
Value:
C:\WINDOWS\system32\1098453.txt
(PID) Process:(4688) R.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Svchost
Operation:writeName:Remote Data
Value:
Remote Data
(PID) Process:(1188) N.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\Select
Operation:writeName:MarkTime
Value:
2025-03-24 20:31
(PID) Process:(4724) TXPlatfor.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\QAssist
Operation:writeName:Type
Value:
2
(PID) Process:(4724) TXPlatfor.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\QAssist
Operation:writeName:Start
Value:
1
(PID) Process:(4724) TXPlatfor.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\QAssist
Operation:writeName:ErrorControl
Value:
0
(PID) Process:(4724) TXPlatfor.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\QAssist
Operation:writeName:ImagePath
Value:
system32\DRIVERS\QAssist.sys
(PID) Process:(4724) TXPlatfor.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\QAssist
Operation:writeName:DisplayName
Value:
QAssist
(PID) Process:(4724) TXPlatfor.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\QAssist
Operation:writeName:Group
Value:
FSFilter Activity Monitor
Executable files
6
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
4688R.exeC:\Windows\SysWOW64\1098453.txtexecutable
MD5:2F3F529494BC6BD6EC279EE9B91D437F
SHA256:7E3E59ECB8ADCD5E61B0C04A676F73467F311FC106EF08AF64F4D2CC532B7346
1188N.exeC:\Windows\SysWOW64\TXPlatfor.exeexecutable
MD5:4A36A48E58829C22381572B2040B6FE0
SHA256:3DE6C02F52A661B8F934F59541D0CF297BB489EB2155E346B63C7338E09AEAF8
4688R.exeC:\Windows\SysWOW64\ini.initext
MD5:E9FF1627BDE05EEFAEB1104E0A5F3ECF
SHA256:09A4C10AD506071DF1E48C567D0CD3399D7E65F7569DB6A5A608A9A037CC8CB1
2600cbe788ade8b4b72cdd6593d7c5c903fa3c44af51933ffbba75be1dd44bf837b5.exeC:\Users\admin\AppData\Local\Temp\N.exeexecutable
MD5:4A36A48E58829C22381572B2040B6FE0
SHA256:3DE6C02F52A661B8F934F59541D0CF297BB489EB2155E346B63C7338E09AEAF8
2600cbe788ade8b4b72cdd6593d7c5c903fa3c44af51933ffbba75be1dd44bf837b5.exeC:\Users\admin\AppData\Local\Temp\HD_X.datexecutable
MD5:BAF3CFF400FA65ADB377E6179D7E92CE
SHA256:CBE788ADE8B4B72CDD6593D7C5C903FA3C44AF51933FFBBA75BE1DD44BF837B5
2600cbe788ade8b4b72cdd6593d7c5c903fa3c44af51933ffbba75be1dd44bf837b5.exeC:\Users\admin\AppData\Local\Temp\R.exeexecutable
MD5:8DC3ADF1C490211971C1E2325F1424D2
SHA256:BC29F2022AB3B812E50C8681FF196F090C038B5AB51E37DAFFAC4469A8C2EB2C
4724TXPlatfor.exeC:\Windows\System32\drivers\QAssist.sysexecutable
MD5:4E34C068E764AD0FF0CB58BC4F143197
SHA256:6CCE28B275D5EC20992BB13790976CAF434AB46DDBFD5CFD431D33424943122B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
21
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5364
RUXIMICS.exe
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
51.124.78.146:443
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
whitelisted
5364
RUXIMICS.exe
51.124.78.146:443
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
whitelisted
5364
RUXIMICS.exe
2.16.168.124:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
6112
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2316
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.78
whitelisted
hackerinvasion.f3322.net
whitelisted
crl.microsoft.com
  • 2.16.168.124
  • 2.16.168.114
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info