gh0strat | 64f64cb08661545b7ffc486a6f51260b421a3f46fbe9c99724d2c1d122bd251c

Analysis

max time kernel
149s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 12:20

Target
64f64cb08661545b7ffc486a6f51260b421a3f46fbe9c99724d2c1d122bd251c.dll
Size 899KB
Sample240428-ph79lsff56
SHA256 64f64cb08661545b7ffc486a6f51260b421a3f46fbe9c99724d2c1d122bd251c
MD5 c653842cc0f83b5ad78f4c33ee4e0262
SHA1 c6c88a42d435b1df4fc096d9bbe6787a67f823ed
SHA512 c8c6b2635e14454b5beb38a8aaf9145d62342230719252f2abdcd2fbca6cf6dbe40b85440fbaade0421a46ed08b6326658f0ccaea657a8526fc4e1d8d409ef75
SSDEEP 24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXv:7wqd87Vv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat rat

Family

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/4868-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4868	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3148 wrote to memory of 4868	3148	rundll32.exe	85
PID 3148 wrote to memory of 4868	3148	rundll32.exe	85
PID 3148 wrote to memory of 4868	3148	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\64f64cb08661545b7ffc486a6f51260b421a3f46fbe9c99724d2c1d122bd251c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3148
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\64f64cb08661545b7ffc486a6f51260b421a3f46fbe9c99724d2c1d122bd251c.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4868

memory/4868-0-0x0000000010000000-0x000000001014F000-memory.dmp

Download