gh0strat | 0f4e72ee215f37671456d439b0fdabed3c4a547f0cca044b5cd759e545028a70

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 14:19

Target
0f4e72ee215f37671456d439b0fdabed3c4a547f0cca044b5cd759e545028a70.dll
Size 51KB
Sample240508-rm5qdsgf5z
SHA256 0f4e72ee215f37671456d439b0fdabed3c4a547f0cca044b5cd759e545028a70
MD5 a0b554b9f0d8286c699e5f5dcb8f6241
SHA1 0e2f3cd8ee2aed566781b2e5a168f1ae3c15f284
SHA512 433a2499577cac2072610b2eff7c780b1ab84747dc1a1922f0ea26a9838ba5bda3947b14a6688c3471cae86f8246b56c45a48c20a8462b59772695eaea258076
SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLMJYH5:1dWubF3n9S91BF3fboYJYH5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat rat

Family

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/2140-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2140	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3364 wrote to memory of 2140	3364	rundll32.exe	81
PID 3364 wrote to memory of 2140	3364	rundll32.exe	81
PID 3364 wrote to memory of 2140	3364	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f4e72ee215f37671456d439b0fdabed3c4a547f0cca044b5cd759e545028a70.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f4e72ee215f37671456d439b0fdabed3c4a547f0cca044b5cd759e545028a70.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2140

memory/2140-0-0x0000000010000000-0x0000000010011000-memory.dmp

Download