gh0strat | e2997c58428630f0678620c7028b599ca6bb25379fda0c3d5aee84a38e098532

Analysis

max time kernel
55s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 07:00

Target

e2997c58428630f0678620c7028b599ca6bb25379fda0c3d5aee84a38e098532.exe
Size

656KB
MD5

15321341bf768b4681697c9829b4f5c5
SHA1

f2ec122cf0c503ffb27ef3237a89ee44d6ee5e3c
SHA256

e2997c58428630f0678620c7028b599ca6bb25379fda0c3d5aee84a38e098532
SHA512

276632a0a5984cae21b466c3902e5ccf30baad599cfadd4d30c6832cfa4faaa2dda3d56efc14b23021b7dd311fab108813f9e22cd9dd7b003b6926c073169878
SSDEEP

1536:iw1W0mMTJL4tTtlRiV9UKAvVgKVfLaHfVV:i6EiL4tTt+7AdVf+

Score

10^/10

gh0strat rat

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/1176-57-0x0000000010000000-0x0000000010121000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1112	1176	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 1112	1176	e2997c58428630f0678620c7028b599ca6bb25379fda0c3d5aee84a38e098532.exe	28
PID 1176 wrote to memory of 1112	1176	e2997c58428630f0678620c7028b599ca6bb25379fda0c3d5aee84a38e098532.exe	28
PID 1176 wrote to memory of 1112	1176	e2997c58428630f0678620c7028b599ca6bb25379fda0c3d5aee84a38e098532.exe	28
PID 1176 wrote to memory of 1112	1176	e2997c58428630f0678620c7028b599ca6bb25379fda0c3d5aee84a38e098532.exe	28

C:\Users\Admin\AppData\Local\Temp\e2997c58428630f0678620c7028b599ca6bb25379fda0c3d5aee84a38e098532.exe
"C:\Users\Admin\AppData\Local\Temp\e2997c58428630f0678620c7028b599ca6bb25379fda0c3d5aee84a38e098532.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1176 -s 208
  2⤵
  - Program crash
  PID:1112

memory/1176-54-0x00000000752B1000-0x00000000752B3000-memory.dmp

Filesize
8KB

Download
memory/1176-55-0x0000000010000000-0x0000000010121000-memory.dmp

Filesize
1.1MB

Download
memory/1176-57-0x0000000010000000-0x0000000010121000-memory.dmp

Filesize
1.1MB

Download