gh0strat | da133e995e3f8b6d4b4b0fa8b57a1cb1e6180ecfd9618064f46f53167126d668

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 23:42

Target

da133e995e3f8b6d4b4b0fa8b57a1cb1e6180ecfd9618064f46f53167126d668.exe
Size

131KB
MD5

98d61cfcb810ea3ffbc6f21ce14fabea
SHA1

bc6423a5a21a7664dfa825d3df52ddff087de8c8
SHA256

da133e995e3f8b6d4b4b0fa8b57a1cb1e6180ecfd9618064f46f53167126d668
SHA512

bc82c0a8b792c66ca240c438c627740bd7e3a9751ae57db43faaf7879039819e62f787292e3ed2f1da6fb3383ae348dfdf808582c6fa5423f60ce1585ed422ec
SSDEEP

3072:gu+2qlgByBTEur7VsuRh/DBiE/8bNJFX6ccx+tJdnJ0:gADyBTE0V1LDw5N3qccqJdnJ0

Score

10^/10

gh0strat rat

Gh0st RAT payload 2 IoCs

resource	yara_rule
behavioral1/memory/1756-54-0x0000000000404000-0x0000000000421000-memory.dmp	family_gh0strat
behavioral1/memory/1756-56-0x0000000000400000-0x0000000000420040-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1380	1756	WerFault.exe	6

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 1380	1756	da133e995e3f8b6d4b4b0fa8b57a1cb1e6180ecfd9618064f46f53167126d668.exe	27
PID 1756 wrote to memory of 1380	1756	da133e995e3f8b6d4b4b0fa8b57a1cb1e6180ecfd9618064f46f53167126d668.exe	27
PID 1756 wrote to memory of 1380	1756	da133e995e3f8b6d4b4b0fa8b57a1cb1e6180ecfd9618064f46f53167126d668.exe	27
PID 1756 wrote to memory of 1380	1756	da133e995e3f8b6d4b4b0fa8b57a1cb1e6180ecfd9618064f46f53167126d668.exe	27

C:\Users\Admin\AppData\Local\Temp\da133e995e3f8b6d4b4b0fa8b57a1cb1e6180ecfd9618064f46f53167126d668.exe
"C:\Users\Admin\AppData\Local\Temp\da133e995e3f8b6d4b4b0fa8b57a1cb1e6180ecfd9618064f46f53167126d668.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 88
  2⤵
  - Program crash
  PID:1380

memory/1380-55-0x0000000000000000-mapping.dmp

Download
memory/1756-54-0x0000000000404000-0x0000000000421000-memory.dmp

Filesize
116KB

Download
memory/1756-56-0x0000000000400000-0x0000000000420040-memory.dmp

Filesize
128KB

Download