gh0strat | bdbd90c44183d4b542ef6c4dd70cf7b492c5c6e8d15b42e1976a527ff33a042a

Analysis

max time kernel
144s
max time network
49s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 23:14

Target
bdbd90c44183d4b542ef6c4dd70cf7b492c5c6e8d15b42e1976a527ff33a042a.dll
Size 51KB
Sample240427-28ca3sag28
SHA256 bdbd90c44183d4b542ef6c4dd70cf7b492c5c6e8d15b42e1976a527ff33a042a
MD5 b3fc9df16af2357d553a1dbcce85511e
SHA1 1541a054c898aaf83af86921b0831ffd5924f018
SHA512 ffc07c22e7dc54c1146eb1548f31a31fd0365359a0fc3b4101aeb9fd2389a31e2f428d87e026eb1cdd8adbe06b500ec01a04f528f99a1ebb1da99eff66a22fba
SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLQJYH5:1dWubF3n9S91BF3fboUJYH5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat rat

Family

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/1464-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1464	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 1464	884	rundll32.exe	85
PID 884 wrote to memory of 1464	884	rundll32.exe	85
PID 884 wrote to memory of 1464	884	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bdbd90c44183d4b542ef6c4dd70cf7b492c5c6e8d15b42e1976a527ff33a042a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bdbd90c44183d4b542ef6c4dd70cf7b492c5c6e8d15b42e1976a527ff33a042a.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1464

memory/1464-0-0x0000000010000000-0x0000000010011000-memory.dmp

Download