gh0strat | c0bf979826d54c9282aed9f188503998df4f1b184fb5f54354422ff41d984eaa

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 08:14

Target
c0bf979826d54c9282aed9f188503998df4f1b184fb5f54354422ff41d984eaa.dll
Size 50KB
Sample240428-j5b7ssbe52
SHA256 c0bf979826d54c9282aed9f188503998df4f1b184fb5f54354422ff41d984eaa
MD5 6eca9987a3ff8484313d06cd04ccc952
SHA1 9740d5e670d0d5fb5bb1353923c9a50da5b4856f
SHA512 c4f1ea52bb69738fd51cc588373c1b0ee4f66169c277801f6a29c38c942ae61850213b5902174c69086447864130405b432430895dfb6733a6a0c4a8380f383a
SSDEEP 1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5YJYH:W5ReWjTrW9rNPgYoqJYH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat rat

Family

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/4208-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4208	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 184 wrote to memory of 4208	184	rundll32.exe	88
PID 184 wrote to memory of 4208	184	rundll32.exe	88
PID 184 wrote to memory of 4208	184	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c0bf979826d54c9282aed9f188503998df4f1b184fb5f54354422ff41d984eaa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:184
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c0bf979826d54c9282aed9f188503998df4f1b184fb5f54354422ff41d984eaa.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4208

memory/4208-0-0x0000000010000000-0x0000000010011000-memory.dmp

Download