gh0strat | 9a56a2f140f013f4823a4a0e545dfa7c69a92e0b55376479528a190aa1c4a7df

Analysis

max time kernel
271s
max time network
318s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 04:11

Target

9a56a2f140f013f4823a4a0e545dfa7c69a92e0b55376479528a190aa1c4a7df.dll
Size

5.1MB
MD5

cdc338e76f89ea28f77d4d291d4f066a
SHA1

ffe240c3703aa8778c051b957fe3f88bd5ced94b
SHA256

9a56a2f140f013f4823a4a0e545dfa7c69a92e0b55376479528a190aa1c4a7df
SHA512

7104f05f1c29e44c7a055e4745fa63d88ee15cc47e601cab932eb23932e1adcbae85c4b38995c6ff894aaaf77cd019d9a53006dbca886416dd55e5af6453cc96
SSDEEP

3072:7BWHWVKhqvEzO/V1VrNYQkCA+HFSWvF3TBftznob2s:1WHA9DNYtEHhvF3TBlznobl

Score

10^/10

gh0strat rat

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/4852-133-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2144	4852	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 4852	4296	rundll32.exe	81
PID 4296 wrote to memory of 4852	4296	rundll32.exe	81
PID 4296 wrote to memory of 4852	4296	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a56a2f140f013f4823a4a0e545dfa7c69a92e0b55376479528a190aa1c4a7df.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a56a2f140f013f4823a4a0e545dfa7c69a92e0b55376479528a190aa1c4a7df.dll,#1
  2⤵
  PID:4852
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 600
    3⤵
    - Program crash
    PID:2144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4852 -ip 4852
1⤵
PID:1800

memory/4852-133-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download