gh0strat | 5e96008e191e7d957912c604e39fe7111a1f01ca778395944bce2d3056c8f229

Analysis

max time kernel
140s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 12:14

Target

5e96008e191e7d957912c604e39fe7111a1f01ca778395944bce2d3056c8f229.dll
Size

50KB
MD5

3e06db34430745198bd5bceb692dfd93
SHA1

275e48808322ef42a6afa79e44f38ee9b2505cac
SHA256

5e96008e191e7d957912c604e39fe7111a1f01ca778395944bce2d3056c8f229
SHA512

14d73cd5b7e45ed37d9684543737d8275a879cc46dcb8293574441ce7df5e681f76e6cd2fc17e14d319e2001d6c41ece5ff3525bf83d19424e1e89a0f6e237c8
SSDEEP

1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5bJYH:W5ReWjTrW9rNPgYo5JYH

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/2072-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2072	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2072	2156	rundll32.exe	28
PID 2156 wrote to memory of 2072	2156	rundll32.exe	28
PID 2156 wrote to memory of 2072	2156	rundll32.exe	28
PID 2156 wrote to memory of 2072	2156	rundll32.exe	28
PID 2156 wrote to memory of 2072	2156	rundll32.exe	28
PID 2156 wrote to memory of 2072	2156	rundll32.exe	28
PID 2156 wrote to memory of 2072	2156	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e96008e191e7d957912c604e39fe7111a1f01ca778395944bce2d3056c8f229.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e96008e191e7d957912c604e39fe7111a1f01ca778395944bce2d3056c8f229.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2072

memory/2072-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download