gh0strat | 79f82bde333ff0727a6c40b03f7e372b0e132625083d9d5a9166023325c92a85

Analysis

max time kernel
41s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19-09-2022 20:05

Target

79f82bde333ff0727a6c40b03f7e372b0e132625083d9d5a9166023325c92a85.exe
Size

141KB
MD5

aba9f3896ef9bad7af4d5ca95d6979d6
SHA1

3a2600d7bed9ab7ff34afe33dc5a4bc61bcac442
SHA256

79f82bde333ff0727a6c40b03f7e372b0e132625083d9d5a9166023325c92a85
SHA512

6da38ae0b1daa8f87dd58379d3707e9995a85e61676a652094ee1d42981313df2e670745adab5836eb782642c0b28cfc638883c92d2b47a83be795fc61e07fb7
SSDEEP

3072:N9+/MKlrBOTI8h7UVuRh/DBiEQcaKPXcDsJZ9:Nv0OTI0UQLDw8aiXcQZ

Score

10^/10

gh0strat rat

Gh0st RAT payload 2 IoCs

resource	yara_rule
behavioral1/memory/1788-54-0x0000000000404000-0x0000000000424000-memory.dmp	family_gh0strat
behavioral1/memory/1788-56-0x0000000000400000-0x0000000000423590-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1976	1788	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 1976	1788	79f82bde333ff0727a6c40b03f7e372b0e132625083d9d5a9166023325c92a85.exe	28
PID 1788 wrote to memory of 1976	1788	79f82bde333ff0727a6c40b03f7e372b0e132625083d9d5a9166023325c92a85.exe	28
PID 1788 wrote to memory of 1976	1788	79f82bde333ff0727a6c40b03f7e372b0e132625083d9d5a9166023325c92a85.exe	28
PID 1788 wrote to memory of 1976	1788	79f82bde333ff0727a6c40b03f7e372b0e132625083d9d5a9166023325c92a85.exe	28

C:\Users\Admin\AppData\Local\Temp\79f82bde333ff0727a6c40b03f7e372b0e132625083d9d5a9166023325c92a85.exe
"C:\Users\Admin\AppData\Local\Temp\79f82bde333ff0727a6c40b03f7e372b0e132625083d9d5a9166023325c92a85.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 88
  2⤵
  - Program crash
  PID:1976

memory/1788-54-0x0000000000404000-0x0000000000424000-memory.dmp

Filesize
128KB

Download
memory/1788-56-0x0000000000400000-0x0000000000423590-memory.dmp

Filesize
141KB

Download