gh0strat | b2880504697aa2c7df3a6a78c8b4bf5cba8c65857d6e1890d6a8f7683c77fa46

Analysis

max time kernel
195s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2022 08:49

Target

b2880504697aa2c7df3a6a78c8b4bf5cba8c65857d6e1890d6a8f7683c77fa46.exe
Size

89KB
MD5

26a4639a3b9b50f44beb1e474d227c4f
SHA1

92e9220e268965c98136400db4f36c45c1ce717c
SHA256

b2880504697aa2c7df3a6a78c8b4bf5cba8c65857d6e1890d6a8f7683c77fa46
SHA512

e937cf6f65115e04bc690181c1adb8bbcc83f3c8a50385ea9ae721aa772be26de37ab6ac61e6c4fa5c3f8f93c0bfbefaddb0b8c315da45efab64880a3c31b66c
SSDEEP

1536:QXYLnC0atiq+9Cc73McaTBFb0bJ+oa/xrpnHTlyojsjxNe22JjIHMNL2jwfe:QXZ0hq+Yc7Hf4oa5r5sojsj+oMRu

Score

10^/10

gh0strat rat

Gh0st RAT payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4496-135-0x0000000010000000-0x0000000010046000-memory.dmp	family_gh0strat
behavioral2/memory/4496-137-0x0000000010000000-0x0000000010046000-memory.dmp	family_gh0strat
behavioral2/memory/4496-138-0x0000000010000000-0x0000000010046000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1552 4496 WerFault.exe b2880504697aa2c7df3a6a78c8b4bf5cba8c65857d6e1890d6a8f7683c77fa46.exe

pid	pid_target	process	target process
1552	4496	WerFault.exe	b2880504697aa2c7df3a6a78c8b4bf5cba8c65857d6e1890d6a8f7683c77fa46.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

b2880504697aa2c7df3a6a78c8b4bf5cba8c65857d6e1890d6a8f7683c77fa46.exe

pid	process
4496	b2880504697aa2c7df3a6a78c8b4bf5cba8c65857d6e1890d6a8f7683c77fa46.exe
4496	b2880504697aa2c7df3a6a78c8b4bf5cba8c65857d6e1890d6a8f7683c77fa46.exe

C:\Users\Admin\AppData\Local\Temp\b2880504697aa2c7df3a6a78c8b4bf5cba8c65857d6e1890d6a8f7683c77fa46.exe
"C:\Users\Admin\AppData\Local\Temp\b2880504697aa2c7df3a6a78c8b4bf5cba8c65857d6e1890d6a8f7683c77fa46.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 628
2⤵
- Program crash
PID:1552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4496 -ip 4496
1⤵
PID:3332

memory/4496-132-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4496-133-0x0000000010000000-0x0000000010046000-memory.dmp

Filesize
280KB

Download
memory/4496-135-0x0000000010000000-0x0000000010046000-memory.dmp

Filesize
280KB

Download
memory/4496-137-0x0000000010000000-0x0000000010046000-memory.dmp

Filesize
280KB

Download
memory/4496-138-0x0000000010000000-0x0000000010046000-memory.dmp

Filesize
280KB

Download
memory/4496-139-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download