gh0strat | b947392e9dc843552fa0f103f0721872ec184b27a65247005a1e5f74f368f315

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 12:38

Target

fcc92a5c6c2f5534be3dd967f1f5cde3_JaffaCakes118.dll
Size

68KB
MD5

fcc92a5c6c2f5534be3dd967f1f5cde3
SHA1

41bc38068eb4b988040e525a0d8dbb4e195bf5d7
SHA256

b947392e9dc843552fa0f103f0721872ec184b27a65247005a1e5f74f368f315
SHA512

d99c13d573496bf9e82e49a03128998543254d3c36a3b8e78033f2cf8dca606d8cc55a60fd1d886f94cb702e22b42c15c07476b5413a7b42acb39eac8e743746
SSDEEP

1536:NUw/HyslBvrq9HDFuuX8SkThRAKecdIhf3/8NY5kK7Up:NUw/HyslBcuuXLkYKe+IR3/8akK7Up

Score

10^/10

gh0strat rat

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2300-0-0x0000000010000000-0x0000000010013000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2076 wrote to memory of 2300	2076	rundll32.exe	rundll32.exe
PID 2076 wrote to memory of 2300	2076	rundll32.exe	rundll32.exe
PID 2076 wrote to memory of 2300	2076	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fcc92a5c6c2f5534be3dd967f1f5cde3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2076

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fcc92a5c6c2f5534be3dd967f1f5cde3_JaffaCakes118.dll,#1
2⤵
PID:2300

memory/2300-0-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download