gh0strat | 9497f9af40155c95ed6843dfcd1e0d3a65db05d85a16c9afa757a70e10d065b6

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 22:15

Target
9497f9af40155c95ed6843dfcd1e0d3a65db05d85a16c9afa757a70e10d065b6.dll
Size 899KB
Sample240509-158z7scg86
SHA256 9497f9af40155c95ed6843dfcd1e0d3a65db05d85a16c9afa757a70e10d065b6
MD5 b6deacbed8ac518567521df997f39e39
SHA1 01b57c0f0571dfb11d37d4fe9c73d55b42200330
SHA512 0b1e8b73c3ad63dddfcc627daae3b35f97e708159677c0f74f9b52b709a7c888a9a174ed34af8c859b22f355ebde5de81138a873bb83ed1c299acf0db3659045
SSDEEP 24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PX5:7wqd87V5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat rat

Family

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/4656-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4656	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 4656	4312	rundll32.exe	82
PID 4312 wrote to memory of 4656	4312	rundll32.exe	82
PID 4312 wrote to memory of 4656	4312	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9497f9af40155c95ed6843dfcd1e0d3a65db05d85a16c9afa757a70e10d065b6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9497f9af40155c95ed6843dfcd1e0d3a65db05d85a16c9afa757a70e10d065b6.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4656

memory/4656-0-0x0000000010000000-0x000000001014F000-memory.dmp

Download