gh0strat | db767504cc0a4959f4230ec2875988cd0b1f23e9c2087606993d02736ff2578b

Analysis

max time kernel
148s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 14:32

Target

db767504cc0a4959f4230ec2875988cd0b1f23e9c2087606993d02736ff2578b.dll
Size

95KB
MD5

21d7e446348def747c41365b3d86ef3b
SHA1

4e3936142277e078841f31aee1b1445e47b8e964
SHA256

db767504cc0a4959f4230ec2875988cd0b1f23e9c2087606993d02736ff2578b
SHA512

877c7f94a525daa4af029d82c37c40319db1370c7a7b92bcd1857c2ee05968d0ce559a37957d0b6bbccc91fc803af45ae56379f7dd0e8c42cfaa687ac058bee2
SSDEEP

1536:/YGGGBDexeOrAN0zor/uYaiwxcJ11fnwq0KTw+2Z0gNZTfY:/TGEAkNxuY3wxm1tnwqDTw+2Z0gNZTfY

Score

10^/10

gh0strat rat

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/1212-133-0x0000000010000000-0x000000001001B000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 1212	4860	rundll32.exe	79
PID 4860 wrote to memory of 1212	4860	rundll32.exe	79
PID 4860 wrote to memory of 1212	4860	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\db767504cc0a4959f4230ec2875988cd0b1f23e9c2087606993d02736ff2578b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\db767504cc0a4959f4230ec2875988cd0b1f23e9c2087606993d02736ff2578b.dll,#1
  2⤵
  PID:1212

memory/1212-133-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download