gh0strat | a3d2e7849bbbe3369a77b1a56f20bd6f47d84275e54c4f1b989c14ac787dd6b2

Analysis

max time kernel
148s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 08:15

Target
a3d2e7849bbbe3369a77b1a56f20bd6f47d84275e54c4f1b989c14ac787dd6b2.dll
Size 50KB
Sample240508-j5j8eade67
SHA256 a3d2e7849bbbe3369a77b1a56f20bd6f47d84275e54c4f1b989c14ac787dd6b2
MD5 b9fadf2d0ef6f053276386cf92d5b990
SHA1 e335507f154d663d30e6ea55185d4b9cb44d1583
SHA512 784e384093a7ff9a8be09f7b8dbb03843b8f1ceed1a4c24ec1edc1d5a6ab6e2299cd4a1ab9c8ab9f64724f8a976a58b1a705defa121142b0cbdf3e16491c3d12
SSDEEP 1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5BJYH:W5ReWjTrW9rNPgYoTJYH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat rat

Family

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/4632-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4632	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3812 wrote to memory of 4632	3812	rundll32.exe	84
PID 3812 wrote to memory of 4632	3812	rundll32.exe	84
PID 3812 wrote to memory of 4632	3812	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3d2e7849bbbe3369a77b1a56f20bd6f47d84275e54c4f1b989c14ac787dd6b2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3d2e7849bbbe3369a77b1a56f20bd6f47d84275e54c4f1b989c14ac787dd6b2.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4632

memory/4632-0-0x0000000010000000-0x0000000010011000-memory.dmp

Download