gh0strat | 4c3107c6aa9e4451284a23cb50f8980c864a73beccdc6e507053831d5b03a04d

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19-10-2022 22:57

Target

4c3107c6aa9e4451284a23cb50f8980c864a73beccdc6e507053831d5b03a04d.exe
Size

560KB
MD5

a15c1da6b565a89aeccb4e09bd87d361
SHA1

0b1e72ef3e1e4d83f53837b81d79c28929447080
SHA256

4c3107c6aa9e4451284a23cb50f8980c864a73beccdc6e507053831d5b03a04d
SHA512

1129b3afa5271642a14d04412738318c34351f09750e803db7b96fc21c2c61de316f33218966b6757b9dce23174d53aca183403484c1fe6bdbdd6fdf8ecec5e3
SSDEEP

12288:3+wGXg9gQURXwM/Yvu/9p9lMtZ+xjClXO3:3+wrWQUZd/VVPEX

Score

10^/10

gh0strat rat upx

Gh0st RAT payload 2 IoCs

resource	yara_rule
behavioral1/memory/1600-57-0x0000000010000000-0x000000001003B000-memory.dmp	family_gh0strat
behavioral1/memory/1600-58-0x0000000010000000-0x000000001003B000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1600-55-0x0000000010000000-0x000000001003B000-memory.dmp	upx
behavioral1/memory/1600-57-0x0000000010000000-0x000000001003B000-memory.dmp	upx
behavioral1/memory/1600-58-0x0000000010000000-0x000000001003B000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
940	1600	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 940	1600	4c3107c6aa9e4451284a23cb50f8980c864a73beccdc6e507053831d5b03a04d.exe	27
PID 1600 wrote to memory of 940	1600	4c3107c6aa9e4451284a23cb50f8980c864a73beccdc6e507053831d5b03a04d.exe	27
PID 1600 wrote to memory of 940	1600	4c3107c6aa9e4451284a23cb50f8980c864a73beccdc6e507053831d5b03a04d.exe	27
PID 1600 wrote to memory of 940	1600	4c3107c6aa9e4451284a23cb50f8980c864a73beccdc6e507053831d5b03a04d.exe	27

C:\Users\Admin\AppData\Local\Temp\4c3107c6aa9e4451284a23cb50f8980c864a73beccdc6e507053831d5b03a04d.exe
"C:\Users\Admin\AppData\Local\Temp\4c3107c6aa9e4451284a23cb50f8980c864a73beccdc6e507053831d5b03a04d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 240
  2⤵
  - Program crash
  PID:940

memory/1600-54-0x0000000076461000-0x0000000076463000-memory.dmp

Filesize
8KB

Download
memory/1600-55-0x0000000010000000-0x000000001003B000-memory.dmp

Filesize
236KB

Download
memory/1600-57-0x0000000010000000-0x000000001003B000-memory.dmp

Filesize
236KB

Download
memory/1600-58-0x0000000010000000-0x000000001003B000-memory.dmp

Filesize
236KB

Download
memory/1600-60-0x0000000001260000-0x0000000001317000-memory.dmp

Filesize
732KB

Download