gh0strat | 784af10c8881233383675fce536cf1787bc51dcaf5ead3b15860fa08719af1a7

Analysis

max time kernel
149s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 01:14

Target
784af10c8881233383675fce536cf1787bc51dcaf5ead3b15860fa08719af1a7.dll
Size 899KB
Sample240427-bl69tsfg95
SHA256 784af10c8881233383675fce536cf1787bc51dcaf5ead3b15860fa08719af1a7
MD5 29bd0b825b60e1958969bb3259e801e7
SHA1 e1f435ea32fcd26e883474c560c18998c07a3847
SHA512 933c8a3a7c75b5a6993098ad30bb2fedc5a1c02f781abec55016070498f4cff9a6cf493b8cae238ffc82a46d18c5afa8163ad9bd9efe7ac0247b6a09f678f455
SSDEEP 24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXs:7wqd87Vs
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat rat

Family

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/5048-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5048	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1000 wrote to memory of 5048	1000	rundll32.exe	83
PID 1000 wrote to memory of 5048	1000	rundll32.exe	83
PID 1000 wrote to memory of 5048	1000	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\784af10c8881233383675fce536cf1787bc51dcaf5ead3b15860fa08719af1a7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\784af10c8881233383675fce536cf1787bc51dcaf5ead3b15860fa08719af1a7.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:5048

memory/5048-0-0x0000000010000000-0x000000001014F000-memory.dmp

Download