gh0strat | ae71716ca5e7b8aeba987591ea74a011afc97b2ea188014225b8a6a8ef1ecaa1

Analysis

max time kernel
160s
max time network
204s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2022 17:33

Target

ae71716ca5e7b8aeba987591ea74a011afc97b2ea188014225b8a6a8ef1ecaa1.dll
Size

105KB
MD5

f130b2a825263b2766f3c5108270ab0d
SHA1

3de865d14cebf181e3ab9cda3c8929dc7e447454
SHA256

ae71716ca5e7b8aeba987591ea74a011afc97b2ea188014225b8a6a8ef1ecaa1
SHA512

deb0a8e0e44008c9f194140114bdd5ce4f009d1188c623a7b4cc4ae9caf33db05b0da8043addb54bd3803f9712b1d020fa64cfae7b2383e894625b4cf6e13782
SSDEEP

3072:BvBKS+26Y8zoz4EfZRzUKR/F4pEIbybZuwu1Uq:N8tA1fYmFEX2ZuwuC

Score

10^/10

gh0strat rat

Gh0st RAT payload 2 IoCs

Processes:

resource	yara_rule
\??\c:\windows\filename.jpg	family_gh0strat
C:\Windows\FileName.jpg	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Loads dropped DLL 1 IoCs

Processes:

svchost.exe

pid process

1136 svchost.exe
Drops file in Windows directory 2 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\Windows\FileName.jpg rundll32.exe
File opened for modification C:\Windows\FileName.jpg rundll32.exe

description	ioc	process
File created	C:\Windows\FileName.jpg	rundll32.exe
File opened for modification	C:\Windows\FileName.jpg	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

svchost.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1660 wrote to memory of 3380	1660	rundll32.exe	rundll32.exe
PID 1660 wrote to memory of 3380	1660	rundll32.exe	rundll32.exe
PID 1660 wrote to memory of 3380	1660	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ae71716ca5e7b8aeba987591ea74a011afc97b2ea188014225b8a6a8ef1ecaa1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1660

C:\Windows\FileName.jpg
Filesize
6.4MB

MD5
4f1d84406e453d2fe20b78de484941a3

SHA1
db8086d290e80b3fec82d12cfe7603e8645912aa

SHA256
2c0c041e4b6dc811242b91ffa3dc77719ba6f3f68c3152340faa43a448a79e25

SHA512
f43ce5a9ef083a17db03e0caad7ad0de9d1997b8cbb3698b4b76c0faba6c9729cdd001667187a394e5e4f93fb7096d0a4d4297c871d4f1528972acccde54c5a2

Download Submit
\??\c:\windows\filename.jpg
Filesize
6.4MB

MD5
4f1d84406e453d2fe20b78de484941a3

SHA1
db8086d290e80b3fec82d12cfe7603e8645912aa

SHA256
2c0c041e4b6dc811242b91ffa3dc77719ba6f3f68c3152340faa43a448a79e25

SHA512
f43ce5a9ef083a17db03e0caad7ad0de9d1997b8cbb3698b4b76c0faba6c9729cdd001667187a394e5e4f93fb7096d0a4d4297c871d4f1528972acccde54c5a2

Download Submit
memory/3380-132-0x0000000000000000-mapping.dmp

Download