gh0strat | 1b61f15393c99c92a150e7c05c44de474a2b19f5c42e073414754dc9039179a5

Analysis

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 18:46

Target

00de4461d8f74018e71ba106871b74c1.dll
Size

152KB
MD5

00de4461d8f74018e71ba106871b74c1
SHA1

2b6d4c830d037c56a60329d42c419796924afc46
SHA256

1b61f15393c99c92a150e7c05c44de474a2b19f5c42e073414754dc9039179a5
SHA512

3c1c0c2867a2d24295642b16761a6d090e8b9e095e7874c4b45eb17f219803e2661f66b8bf9f9373dcca44f48b0cf0794a7efd924417e9b6b7f64419a7158238
SSDEEP

3072:7sWlWVAqoEeO/V1VrNYQsCA+HFSNv63TBft6nob2:QWlm9DNYVEHyv63TBl6nob

Score

10^/10

gh0strat rat

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/5108-0-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4412	5108	WerFault.exe	16

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 5108	4552	rundll32.exe	16
PID 4552 wrote to memory of 5108	4552	rundll32.exe	16
PID 4552 wrote to memory of 5108	4552	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00de4461d8f74018e71ba106871b74c1.dll,#1
1⤵
PID:5108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5108 -s 600
  2⤵
  - Program crash
  PID:4412

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00de4461d8f74018e71ba106871b74c1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5108 -ip 5108
1⤵
PID:5084

memory/5108-0-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download