gh0strat | e0fa51c5428264e230864148ce1c9227c057e84272573129edbd73079faed7a9

Analysis

max time kernel
143s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 15:34

Target
e0fa51c5428264e230864148ce1c9227c057e84272573129edbd73079faed7a9.dll
Size 899KB
Sample240508-sz2pyabd9t
SHA256 e0fa51c5428264e230864148ce1c9227c057e84272573129edbd73079faed7a9
MD5 6cb82270d5c73140f4d162d153a7add6
SHA1 5aaa8998785706ce01e8c2ddadd125c5a65aae46
SHA512 4f4ba10b03cf071d94f81bb1b7563eec167e20a249d2d1c0cf5348c79a05a397fb6a0ae35261d6c85146bea95802148c1af822393ff902a999447688a066f63b
SSDEEP 24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXw:7wqd87Vw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat rat

Family

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/4848-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4848	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 4848	2876	rundll32.exe	81
PID 2876 wrote to memory of 4848	2876	rundll32.exe	81
PID 2876 wrote to memory of 4848	2876	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e0fa51c5428264e230864148ce1c9227c057e84272573129edbd73079faed7a9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e0fa51c5428264e230864148ce1c9227c057e84272573129edbd73079faed7a9.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4848

memory/4848-0-0x0000000010000000-0x000000001014F000-memory.dmp

Download