gh0strat | 0b65c49668e2ea2883a84d9a333427e231b6a2907f376023603ed000199a97c0

Analysis

max time kernel
182s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 01:00

Target

0b65c49668e2ea2883a84d9a333427e231b6a2907f376023603ed000199a97c0.dll
Size

152KB
MD5

a545f5f6127bc3ad73253010cbaba9e0
SHA1

c38507540a5336f2409c3480bcd2ab190a6372ac
SHA256

0b65c49668e2ea2883a84d9a333427e231b6a2907f376023603ed000199a97c0
SHA512

7309bf61b4fea55fe57e80953839a9638c117614bcdea61372c32416757afcb9f2e6006da7d50034fb41bd04036d947fe1a7d6447698399530db4393cba6a595
SSDEEP

3072:8Z+CDYVuQ2O25iAyjkuhBC58owBoV/TBfthCv2btH9rscAW:Y+TbT2sA6/yyowKdTBl0v2btH9FAW

Score

10^/10

gh0strat rat

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/776-133-0x0000000010000000-0x0000000010028000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2576	776	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3856 wrote to memory of 776	3856	rundll32.exe	83
PID 3856 wrote to memory of 776	3856	rundll32.exe	83
PID 3856 wrote to memory of 776	3856	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b65c49668e2ea2883a84d9a333427e231b6a2907f376023603ed000199a97c0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b65c49668e2ea2883a84d9a333427e231b6a2907f376023603ed000199a97c0.dll,#1
  2⤵
  PID:776
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 776 -s 580
    3⤵
    - Program crash
    PID:2576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 776 -ip 776
1⤵
PID:4524

memory/776-133-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download