gh0strat | 2dcd1dfd882ac2734aa06c0f904eb3ab1c88724dfaca1f8b29ac1a5103084c41

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 09:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2dcd1dfd882ac2734aa06c0f904eb3ab1c88724dfaca1f8b29ac1a5103084c41.exe
Size

1.0MB
MD5

aed9ca5588420c5334ddba6725653531
SHA1

caa808d35ef81ad04cd1e33ead907037341f5ca3
SHA256

2dcd1dfd882ac2734aa06c0f904eb3ab1c88724dfaca1f8b29ac1a5103084c41
SHA512

84b862ed6f7ab4c5f6d9a0a2c80155e8296f4ba86e8f49c5e2246e9571a417721b9f148c6adebe7d9235b637ef79ac192f83dfaf0c015de92a1499aef7f91572
SSDEEP

24576:2lnK0BGRzIxVfywyzmnWFUBdPdjpuHUcWvNhtUejEZkS:TsGRzuty/SnWqRduUcuNTm

Score

10^/10

gh0strat rat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/2868-8698-0x0000000000400000-0x000000000056E000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious use of NtSetInformationThreadHideFromDebugger 29 IoCs

pid	Process
2868	2dcd1dfd882ac2734aa06c0f904eb3ab1c88724dfaca1f8b29ac1a5103084c41.exe
2868	2dcd1dfd882ac2734aa06c0f904eb3ab1c88724dfaca1f8b29ac1a5103084c41.exe
2868	2dcd1dfd882ac2734aa06c0f904eb3ab1c88724dfaca1f8b29ac1a5103084c41.exe
2868	2dcd1dfd882ac2734aa06c0f904eb3ab1c88724dfaca1f8b29ac1a5103084c41.exe
2868	2dcd1dfd882ac2734aa06c0f904eb3ab1c88724dfaca1f8b29ac1a5103084c41.exe
2868	2dcd1dfd882ac2734aa06c0f904eb3ab1c88724dfaca1f8b29ac1a5103084c41.exe
2868	2dcd1dfd882ac2734aa06c0f904eb3ab1c88724dfaca1f8b29ac1a5103084c41.exe
2868	2dcd1dfd882ac2734aa06c0f904eb3ab1c88724dfaca1f8b29ac1a5103084c41.exe
2868	2dcd1dfd882ac2734aa06c0f904eb3ab1c88724dfaca1f8b29ac1a5103084c41.exe
2868	2dcd1dfd882ac2734aa06c0f904eb3ab1c88724dfaca1f8b29ac1a5103084c41.exe
2868	2dcd1dfd882ac2734aa06c0f904eb3ab1c88724dfaca1f8b29ac1a5103084c41.exe
2868	2dcd1dfd882ac2734aa06c0f904eb3ab1c88724dfaca1f8b29ac1a5103084c41.exe
2868	2dcd1dfd882ac2734aa06c0f904eb3ab1c88724dfaca1f8b29ac1a5103084c41.exe
2868	2dcd1dfd882ac2734aa06c0f904eb3ab1c88724dfaca1f8b29ac1a5103084c41.exe
2868	2dcd1dfd882ac2734aa06c0f904eb3ab1c88724dfaca1f8b29ac1a5103084c41.exe
2868	2dcd1dfd882ac2734aa06c0f904eb3ab1c88724dfaca1f8b29ac1a5103084c41.exe
2868	2dcd1dfd882ac2734aa06c0f904eb3ab1c88724dfaca1f8b29ac1a5103084c41.exe
2868	2dcd1dfd882ac2734aa06c0f904eb3ab1c88724dfaca1f8b29ac1a5103084c41.exe
2868	2dcd1dfd882ac2734aa06c0f904eb3ab1c88724dfaca1f8b29ac1a5103084c41.exe
2868	2dcd1dfd882ac2734aa06c0f904eb3ab1c88724dfaca1f8b29ac1a5103084c41.exe
2868	2dcd1dfd882ac2734aa06c0f904eb3ab1c88724dfaca1f8b29ac1a5103084c41.exe
2868	2dcd1dfd882ac2734aa06c0f904eb3ab1c88724dfaca1f8b29ac1a5103084c41.exe
2868	2dcd1dfd882ac2734aa06c0f904eb3ab1c88724dfaca1f8b29ac1a5103084c41.exe
2868	2dcd1dfd882ac2734aa06c0f904eb3ab1c88724dfaca1f8b29ac1a5103084c41.exe
2868	2dcd1dfd882ac2734aa06c0f904eb3ab1c88724dfaca1f8b29ac1a5103084c41.exe
2868	2dcd1dfd882ac2734aa06c0f904eb3ab1c88724dfaca1f8b29ac1a5103084c41.exe
2868	2dcd1dfd882ac2734aa06c0f904eb3ab1c88724dfaca1f8b29ac1a5103084c41.exe
2868	2dcd1dfd882ac2734aa06c0f904eb3ab1c88724dfaca1f8b29ac1a5103084c41.exe
2868	2dcd1dfd882ac2734aa06c0f904eb3ab1c88724dfaca1f8b29ac1a5103084c41.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2868	2dcd1dfd882ac2734aa06c0f904eb3ab1c88724dfaca1f8b29ac1a5103084c41.exe
2868	2dcd1dfd882ac2734aa06c0f904eb3ab1c88724dfaca1f8b29ac1a5103084c41.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2868	2dcd1dfd882ac2734aa06c0f904eb3ab1c88724dfaca1f8b29ac1a5103084c41.exe

C:\Users\Admin\AppData\Local\Temp\2dcd1dfd882ac2734aa06c0f904eb3ab1c88724dfaca1f8b29ac1a5103084c41.exe
"C:\Users\Admin\AppData\Local\Temp\2dcd1dfd882ac2734aa06c0f904eb3ab1c88724dfaca1f8b29ac1a5103084c41.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:2868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2868-0-0x0000000000400000-0x000000000056E000-memory.dmp

Filesize
1.4MB

Download
memory/2868-1-0x0000000076C20000-0x0000000076C67000-memory.dmp

Filesize
284KB

Download
memory/2868-811-0x0000000002400000-0x0000000002511000-memory.dmp

Filesize
1.1MB

Download
memory/2868-812-0x0000000002400000-0x0000000002511000-memory.dmp

Filesize
1.1MB

Download
memory/2868-814-0x0000000002400000-0x0000000002511000-memory.dmp

Filesize
1.1MB

Download
memory/2868-816-0x0000000002400000-0x0000000002511000-memory.dmp

Filesize
1.1MB

Download
memory/2868-818-0x0000000002400000-0x0000000002511000-memory.dmp

Filesize
1.1MB

Download
memory/2868-820-0x0000000002400000-0x0000000002511000-memory.dmp

Filesize
1.1MB

Download
memory/2868-822-0x0000000002400000-0x0000000002511000-memory.dmp

Filesize
1.1MB

Download
memory/2868-824-0x0000000002400000-0x0000000002511000-memory.dmp

Filesize
1.1MB

Download
memory/2868-826-0x0000000002400000-0x0000000002511000-memory.dmp

Filesize
1.1MB

Download
memory/2868-828-0x0000000002400000-0x0000000002511000-memory.dmp

Filesize
1.1MB

Download
memory/2868-830-0x0000000002400000-0x0000000002511000-memory.dmp

Filesize
1.1MB

Download
memory/2868-832-0x0000000002400000-0x0000000002511000-memory.dmp

Filesize
1.1MB

Download
memory/2868-834-0x0000000002400000-0x0000000002511000-memory.dmp

Filesize
1.1MB

Download
memory/2868-836-0x0000000002400000-0x0000000002511000-memory.dmp

Filesize
1.1MB

Download
memory/2868-838-0x0000000002400000-0x0000000002511000-memory.dmp

Filesize
1.1MB

Download
memory/2868-840-0x0000000002400000-0x0000000002511000-memory.dmp

Filesize
1.1MB

Download
memory/2868-842-0x0000000002400000-0x0000000002511000-memory.dmp

Filesize
1.1MB

Download
memory/2868-844-0x0000000002400000-0x0000000002511000-memory.dmp

Filesize
1.1MB

Download
memory/2868-846-0x0000000002400000-0x0000000002511000-memory.dmp

Filesize
1.1MB

Download
memory/2868-848-0x0000000002400000-0x0000000002511000-memory.dmp

Filesize
1.1MB

Download
memory/2868-850-0x0000000002400000-0x0000000002511000-memory.dmp

Filesize
1.1MB

Download
memory/2868-852-0x0000000002400000-0x0000000002511000-memory.dmp

Filesize
1.1MB

Download
memory/2868-854-0x0000000002400000-0x0000000002511000-memory.dmp

Filesize
1.1MB

Download
memory/2868-856-0x0000000002400000-0x0000000002511000-memory.dmp

Filesize
1.1MB

Download
memory/2868-858-0x0000000002400000-0x0000000002511000-memory.dmp

Filesize
1.1MB

Download
memory/2868-860-0x0000000002400000-0x0000000002511000-memory.dmp

Filesize
1.1MB

Download
memory/2868-862-0x0000000002400000-0x0000000002511000-memory.dmp

Filesize
1.1MB

Download
memory/2868-864-0x0000000002400000-0x0000000002511000-memory.dmp

Filesize
1.1MB

Download
memory/2868-866-0x0000000002400000-0x0000000002511000-memory.dmp

Filesize
1.1MB

Download
memory/2868-868-0x0000000002400000-0x0000000002511000-memory.dmp

Filesize
1.1MB

Download
memory/2868-870-0x0000000002400000-0x0000000002511000-memory.dmp

Filesize
1.1MB

Download
memory/2868-872-0x0000000002400000-0x0000000002511000-memory.dmp

Filesize
1.1MB

Download
memory/2868-2547-0x0000000002270000-0x00000000023F1000-memory.dmp

Filesize
1.5MB

Download
memory/2868-8693-0x0000000000400000-0x000000000056E000-memory.dmp

Filesize
1.4MB

Download
memory/2868-8694-0x0000000002400000-0x0000000002511000-memory.dmp

Filesize
1.1MB

Download
memory/2868-8698-0x0000000000400000-0x000000000056E000-memory.dmp

Filesize
1.4MB

Download