gh0strat | b1d1819acd6c3ff31cb495b45a2135468c4ae5d2d043de8eed77a8b8460dd4af

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-04-2024 00:24

Target

b1d1819acd6c3ff31cb495b45a2135468c4ae5d2d043de8eed77a8b8460dd4af.dll
Size

51KB
MD5

85049d8d6946cde5c8dafad4556f58e5
SHA1

3b8ac71d9bef495f07e54a886c3275a6f22c8004
SHA256

b1d1819acd6c3ff31cb495b45a2135468c4ae5d2d043de8eed77a8b8460dd4af
SHA512

1d6e5608db6c887b6c87c08ab64f8c7d8e5e6670f893a1d27626b8f044f8aff7a6bb462a01452814e35b444e7a987cbd6f2dee6e38c7d43e2eee27ec59b375ba
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL9JYH5:1dWubF3n9S91BF3fboJJYH5

Score

10^/10

gh0strat rat

Family

gh0strat

kinh.xmcxmr.com

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/2892-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2892	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2892	1708	rundll32.exe	28
PID 1708 wrote to memory of 2892	1708	rundll32.exe	28
PID 1708 wrote to memory of 2892	1708	rundll32.exe	28
PID 1708 wrote to memory of 2892	1708	rundll32.exe	28
PID 1708 wrote to memory of 2892	1708	rundll32.exe	28
PID 1708 wrote to memory of 2892	1708	rundll32.exe	28
PID 1708 wrote to memory of 2892	1708	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b1d1819acd6c3ff31cb495b45a2135468c4ae5d2d043de8eed77a8b8460dd4af.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b1d1819acd6c3ff31cb495b45a2135468c4ae5d2d043de8eed77a8b8460dd4af.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2892

memory/2892-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download