gh0strat | ac99894c72fdd44f6fe993a4634731b9e0adf9ddb7bec18cf2a8013b18504df2

Analysis

max time kernel
141s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 22:14

Target
ac99894c72fdd44f6fe993a4634731b9e0adf9ddb7bec18cf2a8013b18504df2.dll
Size 51KB
Sample240509-152wwscg69
SHA256 ac99894c72fdd44f6fe993a4634731b9e0adf9ddb7bec18cf2a8013b18504df2
MD5 82e47813d56ad713f29aa68fdfc9bd66
SHA1 8a189aa07b43045dbd078524d303a1d4b0d7ab8d
SHA512 aa9894802e00c3e42f4538620274ad93ab93c6f2e6351c20b61b5912988eb15e81118092ec3885a79274dc271d63c18376e7f13cccc5d8dbe2b56a3c13d2639c
SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLfSJYH5:1dWubF3n9S91BF3fborSJYH5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat rat

Family

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/4556-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4556	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4336 wrote to memory of 4556	4336	rundll32.exe	85
PID 4336 wrote to memory of 4556	4336	rundll32.exe	85
PID 4336 wrote to memory of 4556	4336	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac99894c72fdd44f6fe993a4634731b9e0adf9ddb7bec18cf2a8013b18504df2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac99894c72fdd44f6fe993a4634731b9e0adf9ddb7bec18cf2a8013b18504df2.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4556

memory/4556-0-0x0000000010000000-0x0000000010011000-memory.dmp

Download