gh0strat | 39ceb715fea2ede1780fe0fb1650ac203a946ab02ad9c5cc091d254cb1ccb0e1

Analysis

max time kernel
141s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/02/2024, 08:47

Target

8eb88a45feec85aa63a0ab18ed97725b.exe
Size

342KB
MD5

8eb88a45feec85aa63a0ab18ed97725b
SHA1

6f3359279f415ec00df3961c2d13e7d9bc698034
SHA256

39ceb715fea2ede1780fe0fb1650ac203a946ab02ad9c5cc091d254cb1ccb0e1
SHA512

2336325e8802f5bd30b9c8a4eb4e3738f7a71bb844b9f7db6fd08c47b1f2d484447e795e6aa8f2149349c5ad9b82127ae9491095bbdc6ec7d1ab15300965f51d
SSDEEP

6144:DxcOrHdN6kw8em0BFuCuD7HYu6vZGiYqisvN3HG8pKvKjU02:DxcOj+kwRINvHYHROq1c84vKjU02

Score

10^/10

gh0strat rat

Gh0st RAT payload 3 IoCs

resource	yara_rule
behavioral1/memory/860-1-0x0000000000400000-0x000000000048D000-memory.dmp	family_gh0strat
behavioral1/memory/860-2-0x0000000000400000-0x000000000048D000-memory.dmp	family_gh0strat
behavioral1/memory/860-4-0x0000000000400000-0x000000000048D000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1776	860	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 860 wrote to memory of 1776	860	8eb88a45feec85aa63a0ab18ed97725b.exe	28
PID 860 wrote to memory of 1776	860	8eb88a45feec85aa63a0ab18ed97725b.exe	28
PID 860 wrote to memory of 1776	860	8eb88a45feec85aa63a0ab18ed97725b.exe	28
PID 860 wrote to memory of 1776	860	8eb88a45feec85aa63a0ab18ed97725b.exe	28

C:\Users\Admin\AppData\Local\Temp\8eb88a45feec85aa63a0ab18ed97725b.exe
"C:\Users\Admin\AppData\Local\Temp\8eb88a45feec85aa63a0ab18ed97725b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:860
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 860 -s 208
  2⤵
  - Program crash
  PID:1776

memory/860-0-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/860-1-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/860-2-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/860-4-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download