gh0strat | 59610ae75cd593d2dc2ead44d3e0c580c6c07bb16ac0e64ab93508252e7dcf0f

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/05/2024, 20:33

Target

59610ae75cd593d2dc2ead44d3e0c580c6c07bb16ac0e64ab93508252e7dcf0f.dll
Size

51KB
MD5

8244c8f390ce93131bb798c315031988
SHA1

6b59991784d2c99d2cb360defd6c82439a2cab9f
SHA256

59610ae75cd593d2dc2ead44d3e0c580c6c07bb16ac0e64ab93508252e7dcf0f
SHA512

fb2964f9b24ce0d44a006f20f95d03ac730ef6fee887d3f1df2a5d8b3d197c03367dd6394f5791e876dba682429bff8ae5d2c864d0cf5f6ee47e8198e8806a13
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLKJYH5:1dWubF3n9S91BF3fboGJYH5

Score

10^/10

gh0strat rat

Family

gh0strat

kinh.xmcxmr.com

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/1612-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1612	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 1612	1624	rundll32.exe	28
PID 1624 wrote to memory of 1612	1624	rundll32.exe	28
PID 1624 wrote to memory of 1612	1624	rundll32.exe	28
PID 1624 wrote to memory of 1612	1624	rundll32.exe	28
PID 1624 wrote to memory of 1612	1624	rundll32.exe	28
PID 1624 wrote to memory of 1612	1624	rundll32.exe	28
PID 1624 wrote to memory of 1612	1624	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\59610ae75cd593d2dc2ead44d3e0c580c6c07bb16ac0e64ab93508252e7dcf0f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\59610ae75cd593d2dc2ead44d3e0c580c6c07bb16ac0e64ab93508252e7dcf0f.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1612

memory/1612-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download