gh0strat | 58aeec89488f901422df4d372da8f21a7b125b6434bc7e239cccd5fa96c3ae6d

Analysis

max time kernel
7s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 11:18

Target

58aeec89488f901422df4d372da8f21a7b125b6434bc7e239cccd5fa96c3ae6d.dll
Size

106KB
MD5

7623557c246ff2a02d5ffa5d81ce059b
SHA1

af3c13cb25f3cb703c55a4081569147f5613b58f
SHA256

58aeec89488f901422df4d372da8f21a7b125b6434bc7e239cccd5fa96c3ae6d
SHA512

90fa48a3fd83085a05ca2888747412bea0a2d7993416421e1d0229e31e3de209200ebc4cc8cbcf285964c1255682ad8bbed78c4972028a6b6d4d926ab23be227
SSDEEP

1536:B9TSClLEq6czdtldDafa2HvNcpp7zyhFc8XDfcnipjUJv5WH:B9TSCqq6cJwnvOzyhFXXjcnidUJv5WH

Score

10^/10

gh0strat rat

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/1188-57-0x0000000010000000-0x000000001001D000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1284	1188	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 1188	1100	rundll32.exe	28
PID 1100 wrote to memory of 1188	1100	rundll32.exe	28
PID 1100 wrote to memory of 1188	1100	rundll32.exe	28
PID 1100 wrote to memory of 1188	1100	rundll32.exe	28
PID 1100 wrote to memory of 1188	1100	rundll32.exe	28
PID 1100 wrote to memory of 1188	1100	rundll32.exe	28
PID 1100 wrote to memory of 1188	1100	rundll32.exe	28
PID 1188 wrote to memory of 1284	1188	rundll32.exe	29
PID 1188 wrote to memory of 1284	1188	rundll32.exe	29
PID 1188 wrote to memory of 1284	1188	rundll32.exe	29
PID 1188 wrote to memory of 1284	1188	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\58aeec89488f901422df4d372da8f21a7b125b6434bc7e239cccd5fa96c3ae6d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\58aeec89488f901422df4d372da8f21a7b125b6434bc7e239cccd5fa96c3ae6d.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1188
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1188 -s 256
    3⤵
    - Program crash
    PID:1284

memory/1188-55-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download
memory/1188-57-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download