gh0strat | 845bf1354caa7b63ebbc018675c664f7fdc5d62c8ca54a1b9666a5e6fdbbac04

Analysis

max time kernel
152s
max time network
90s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 01:55

Target

845bf1354caa7b63ebbc018675c664f7fdc5d62c8ca54a1b9666a5e6fdbbac04.dll
Size

124KB
MD5

3dc3b47082e3ca911c9a81182a4b71c9
SHA1

90ecb80a910ed2e55f8c45ae65a729820a72fbd2
SHA256

845bf1354caa7b63ebbc018675c664f7fdc5d62c8ca54a1b9666a5e6fdbbac04
SHA512

996ef53596cade0106a2bd15c57c02121128d17b536356784361e632dd3fae0cce6b38aa62e5732a97fbe884b738c171c4311988ea2d8f2b963dd7cc277c92ae
SSDEEP

3072:qRn1vFHCqcDVvR7p0+8u9NMK+kl5wHrmXmLeout:IDHRciu9NMrkbwHgceoS

Score

10^/10

gh0strat rat

Gh0st RAT payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000e000000012308-56.dat	family_gh0strat
behavioral1/files/0x000e000000012308-57.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Loads dropped DLL 1 IoCs

pid	Process
1176	svchost.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Bwxy\Gwxyabcde.gif	rundll32.exe
File created	C:\Program Files (x86)\Bwxy\Gwxyabcde.gif	rundll32.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

Suspicious use of AdjustPrivilegeToken 8 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 1668	1352	rundll32.exe	28
PID 1352 wrote to memory of 1668	1352	rundll32.exe	28
PID 1352 wrote to memory of 1668	1352	rundll32.exe	28
PID 1352 wrote to memory of 1668	1352	rundll32.exe	28
PID 1352 wrote to memory of 1668	1352	rundll32.exe	28
PID 1352 wrote to memory of 1668	1352	rundll32.exe	28
PID 1352 wrote to memory of 1668	1352	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\845bf1354caa7b63ebbc018675c664f7fdc5d62c8ca54a1b9666a5e6fdbbac04.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\845bf1354caa7b63ebbc018675c664f7fdc5d62c8ca54a1b9666a5e6fdbbac04.dll,#1
  2⤵
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  PID:1668

\??\c:\program files (x86)\bwxy\gwxyabcde.gif

Filesize
5.7MB

MD5
4231e97b6584185ef3f53662bcbb7fcb

SHA1
de9bf1205b6fd2accd8ddcaf77576939c1f1f31f

SHA256
370c42c399c3539f9b5ccac39d074fe943af5b4087f00c6c5685ed7035ea1284

SHA512
dd28816f57637afbf510781617fb18b6f35573e52f6c98c5cae908517659d9898b4be5ccae7e74a09c2f4d77e81329eb81cdb254b6dc902141bbb332921d1636

Download Submit
\Program Files (x86)\Bwxy\Gwxyabcde.gif

Filesize
5.7MB

MD5
4231e97b6584185ef3f53662bcbb7fcb

SHA1
de9bf1205b6fd2accd8ddcaf77576939c1f1f31f

SHA256
370c42c399c3539f9b5ccac39d074fe943af5b4087f00c6c5685ed7035ea1284

SHA512
dd28816f57637afbf510781617fb18b6f35573e52f6c98c5cae908517659d9898b4be5ccae7e74a09c2f4d77e81329eb81cdb254b6dc902141bbb332921d1636

Download Submit
memory/1668-55-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download