gh0strat | 8531b83e706e60d7059e7af6d3444857f3afec1ac7a758ba1968da9549895857

Analysis

max time kernel
149s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 14:18

Target
8531b83e706e60d7059e7af6d3444857f3afec1ac7a758ba1968da9549895857.dll
Size 899KB
Sample240509-rmd8fagg86
SHA256 8531b83e706e60d7059e7af6d3444857f3afec1ac7a758ba1968da9549895857
MD5 5c271c6b935c76cf6aec950acadd5f92
SHA1 3a8d3777d8486889c77a0344fd480df6fd6bcecb
SHA512 f53732e44e6885f8ab70f0be0da10820e93c36e697c43e5799d8fd1d89ad1fdae581c61f2d11ad3b8ba8ee5a0ff7f08a2f4a5ea7ce0e3067385471d7f2c81f63
SSDEEP 24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PX5:7wqd87V5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat rat

Family

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/3008-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3008	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3556 wrote to memory of 3008	3556	rundll32.exe	82
PID 3556 wrote to memory of 3008	3556	rundll32.exe	82
PID 3556 wrote to memory of 3008	3556	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8531b83e706e60d7059e7af6d3444857f3afec1ac7a758ba1968da9549895857.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8531b83e706e60d7059e7af6d3444857f3afec1ac7a758ba1968da9549895857.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:3008

memory/3008-0-0x0000000010000000-0x000000001014F000-memory.dmp

Download