gh0strat | 7865a06e57e75ca1e8f357bf24dd6880256332eb4bc1479a4cc61bb6e8871a1b

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 11:58

Target

6ca6d2f11192c0be90d40aa16391622c.dll
Size

95KB
MD5

6ca6d2f11192c0be90d40aa16391622c
SHA1

57ecd8ffb486367374af10b5a7f6aa5df38c818a
SHA256

7865a06e57e75ca1e8f357bf24dd6880256332eb4bc1479a4cc61bb6e8871a1b
SHA512

36687580f40c32d0fb576717dc74327af9a298d1bfd8f5bd1121c711b82a12b0fe52eaecd8970cbe23c722bef4fad5503236ea99843e0cdbdc32b6a046c46c12
SSDEEP

1536:AYZ6zR6ZxsC3kYAIRN3q39PQgCcZ9UfTDAcU66eQ5I:AYZ6zox/UIRN3A6gCK9GTDAi6eQ5

Score

10^/10

gh0strat rat

Gh0st RAT payload 2 IoCs

resource	yara_rule
behavioral1/memory/3060-0-0x0000000010000000-0x000000001001B000-memory.dmp	family_gh0strat
behavioral1/memory/3060-1-0x0000000010000000-0x000000001001B000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 3060	2348	rundll32.exe	13
PID 2348 wrote to memory of 3060	2348	rundll32.exe	13
PID 2348 wrote to memory of 3060	2348	rundll32.exe	13
PID 2348 wrote to memory of 3060	2348	rundll32.exe	13
PID 2348 wrote to memory of 3060	2348	rundll32.exe	13
PID 2348 wrote to memory of 3060	2348	rundll32.exe	13
PID 2348 wrote to memory of 3060	2348	rundll32.exe	13

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6ca6d2f11192c0be90d40aa16391622c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6ca6d2f11192c0be90d40aa16391622c.dll,#1
  2⤵
  PID:3060

memory/3060-0-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download
memory/3060-1-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download