gh0strat | 96af330607ef4f0f620a44c14afd14f4b80903ec7b10cb9fa78d4a2fb382f6a6

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 21:03

Target

f8bdec7012f6a269bec9dd403720b60c_JaffaCakes118.dll
Size

155KB
MD5

f8bdec7012f6a269bec9dd403720b60c
SHA1

d62c4f7f83e865a8f1c8233eaeb6974d301ebdd6
SHA256

96af330607ef4f0f620a44c14afd14f4b80903ec7b10cb9fa78d4a2fb382f6a6
SHA512

43603b3b4a52508861e02c66eae420045da34c60f3ca9c436dc9383aa0d1d3060af55d403574473b31d94b8d4e2bdea19055219602e38226eeab7c5fa152895e
SSDEEP

3072:7BWHWVKhqvEzO/V1VrNYQkCA+HFSWvf3TBft3nob2S:1WHA9DNYtEHhvf3TBl3nob

Score

10^/10

gh0strat rat

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/1532-0-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2476	1532	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 1532	2172	rundll32.exe	28
PID 2172 wrote to memory of 1532	2172	rundll32.exe	28
PID 2172 wrote to memory of 1532	2172	rundll32.exe	28
PID 2172 wrote to memory of 1532	2172	rundll32.exe	28
PID 2172 wrote to memory of 1532	2172	rundll32.exe	28
PID 2172 wrote to memory of 1532	2172	rundll32.exe	28
PID 2172 wrote to memory of 1532	2172	rundll32.exe	28
PID 1532 wrote to memory of 2476	1532	rundll32.exe	29
PID 1532 wrote to memory of 2476	1532	rundll32.exe	29
PID 1532 wrote to memory of 2476	1532	rundll32.exe	29
PID 1532 wrote to memory of 2476	1532	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f8bdec7012f6a269bec9dd403720b60c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f8bdec7012f6a269bec9dd403720b60c_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1532
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 228
    3⤵
    - Program crash
    PID:2476

memory/1532-0-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download