gh0strat | 32853277de1f3453e1f7319cbfcb790203a5b6df8871e9a9ec19a6af5d62a741

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 02:06

Target
a1e767739a3c28ac71b598b9ccd818d0_NEIKI.dll
Size 51KB
Sample240508-cjxs2sfe87
SHA256 32853277de1f3453e1f7319cbfcb790203a5b6df8871e9a9ec19a6af5d62a741
MD5 a1e767739a3c28ac71b598b9ccd818d0
SHA1 3b83351735758e019124d7d6f8e17528c3254510
SHA512 d00a7c68a315379946e977d77a7921143a74c5aeea80173893fc815e678e1b2c8a0332734c2224ced8c3cf15a7320915a14177db4a9b06a412718887eb492831
SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLdJYH5:1dWubF3n9S91BF3fboBJYH5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat rat

Family

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/2932-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2932	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 2932	4468	rundll32.exe	84
PID 4468 wrote to memory of 2932	4468	rundll32.exe	84
PID 4468 wrote to memory of 2932	4468	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1e767739a3c28ac71b598b9ccd818d0_NEIKI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1e767739a3c28ac71b598b9ccd818d0_NEIKI.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2932

memory/2932-0-0x0000000010000000-0x0000000010011000-memory.dmp

Download