gh0strat | 0b77909d20e673eaf500e3e36252984bf551b88330e15e1cf8d7de88633cc5ee

Analysis

max time kernel
137s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 12:17

Target
0b77909d20e673eaf500e3e36252984bf551b88330e15e1cf8d7de88633cc5ee.dll
Size 174KB
Sample240429-pgalysaf7w
SHA256 0b77909d20e673eaf500e3e36252984bf551b88330e15e1cf8d7de88633cc5ee
MD5 417b18b44664339dcd8cbf40c04c95a5
SHA1 465cb33467728d75cbaf994d10348b531a07b8df
SHA512 93269775eb410215e13280e6df20d7e1bf86d15c192818c09dc8ae34b0556038b4a9d3d031c5fb1440aed7bd7909d7f806da862f9be011a70caa8d0f51690c89
SSDEEP 3072:LUDBHy4BBy6eFJrmmIewRxM6JSQTqGd4Pwc3q:L0yB6oJrcRZQcqGywq
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat rat

Gh0st RAT payload 5 IoCs

resource	yara_rule
behavioral2/memory/1840-0-0x0000000000400000-0x000000000040B000-memory.dmp	family_gh0strat
behavioral2/memory/1840-2-0x0000000000400000-0x000000000040B000-memory.dmp	family_gh0strat
behavioral2/memory/1840-3-0x0000000000400000-0x000000000040B000-memory.dmp	family_gh0strat
behavioral2/memory/1840-4-0x0000000000400000-0x000000000040B000-memory.dmp	family_gh0strat
behavioral2/memory/1840-8-0x0000000000400000-0x000000000040B000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3056 set thread context of 1840	3056	rundll32.exe	83
PID 3056 set thread context of 3664	3056	rundll32.exe	87

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 1840	3056	rundll32.exe	83
PID 3056 wrote to memory of 1840	3056	rundll32.exe	83
PID 3056 wrote to memory of 1840	3056	rundll32.exe	83
PID 3056 wrote to memory of 1840	3056	rundll32.exe	83
PID 3056 wrote to memory of 1840	3056	rundll32.exe	83
PID 3056 wrote to memory of 1840	3056	rundll32.exe	83
PID 3056 wrote to memory of 1840	3056	rundll32.exe	83
PID 3056 wrote to memory of 1840	3056	rundll32.exe	83
PID 3056 wrote to memory of 3664	3056	rundll32.exe	87
PID 3056 wrote to memory of 3664	3056	rundll32.exe	87
PID 3056 wrote to memory of 3664	3056	rundll32.exe	87
PID 3056 wrote to memory of 3664	3056	rundll32.exe	87
PID 3056 wrote to memory of 3664	3056	rundll32.exe	87
PID 3056 wrote to memory of 3664	3056	rundll32.exe	87
PID 3056 wrote to memory of 3664	3056	rundll32.exe	87
PID 3056 wrote to memory of 3664	3056	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b77909d20e673eaf500e3e36252984bf551b88330e15e1cf8d7de88633cc5ee.dll,#1
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\SysWOW64\svchost.exe"
  2⤵
  PID:1840
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\SysWOW64\svchost.exe"
  2⤵
  PID:3664

memory/1840-0-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/1840-2-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/1840-3-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/1840-4-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/1840-8-0x0000000000400000-0x000000000040B000-memory.dmp

Download