gh0strat | a068a79caf3d6ef090ccb0474157adfd06144c1e36ddf2d8753bbba196ecb824

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 12:14

Target

a068a79caf3d6ef090ccb0474157adfd06144c1e36ddf2d8753bbba196ecb824.dll
Size

899KB
MD5

794d3bead6f514fa7e7551e2dd4f3978
SHA1

c3368eac77b119b8222f0858c217ea159eee2ad4
SHA256

a068a79caf3d6ef090ccb0474157adfd06144c1e36ddf2d8753bbba196ecb824
SHA512

7bcdb2bf1e8c59d0a737d60d408c56684a210d82ce059c367693afc07945a52025c3649ed4005c49157b47341b5801c500d959019a77ec394f5a2f2e0fa8a1a2
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PX1:7wqd87V1

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/2936-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2936	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 2936	1244	rundll32.exe	28
PID 1244 wrote to memory of 2936	1244	rundll32.exe	28
PID 1244 wrote to memory of 2936	1244	rundll32.exe	28
PID 1244 wrote to memory of 2936	1244	rundll32.exe	28
PID 1244 wrote to memory of 2936	1244	rundll32.exe	28
PID 1244 wrote to memory of 2936	1244	rundll32.exe	28
PID 1244 wrote to memory of 2936	1244	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a068a79caf3d6ef090ccb0474157adfd06144c1e36ddf2d8753bbba196ecb824.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a068a79caf3d6ef090ccb0474157adfd06144c1e36ddf2d8753bbba196ecb824.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2936

memory/2936-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download