gh0strat | c6d0a54c20cf02f7be7fb85e111b8eee2411bfdcabf7cbbe308be2101261c686

Analysis

max time kernel
140s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 13:18

Target

c6d0a54c20cf02f7be7fb85e111b8eee2411bfdcabf7cbbe308be2101261c686.dll
Size

51KB
MD5

e3f0ef8306edb8a9d96024f166252e82
SHA1

35cb8b40f962fedfbeec426dea24f3693daf7c89
SHA256

c6d0a54c20cf02f7be7fb85e111b8eee2411bfdcabf7cbbe308be2101261c686
SHA512

68deceecdc593abf2d1907dbea45eb4f00ab0fe06b26e874963a883862e8bb6014a5de6dc6279bfbfef267c8fc30e1c250eab92d2c720ba71c9b78f75fac07fc
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLeJYH5:1dWubF3n9S91BF3fboiJYH5

Score

10^/10

gh0strat rat

Family

gh0strat

kinh.xmcxmr.com

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/1692-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1692	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 1692	2128	rundll32.exe	28
PID 2128 wrote to memory of 1692	2128	rundll32.exe	28
PID 2128 wrote to memory of 1692	2128	rundll32.exe	28
PID 2128 wrote to memory of 1692	2128	rundll32.exe	28
PID 2128 wrote to memory of 1692	2128	rundll32.exe	28
PID 2128 wrote to memory of 1692	2128	rundll32.exe	28
PID 2128 wrote to memory of 1692	2128	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c6d0a54c20cf02f7be7fb85e111b8eee2411bfdcabf7cbbe308be2101261c686.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c6d0a54c20cf02f7be7fb85e111b8eee2411bfdcabf7cbbe308be2101261c686.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1692

memory/1692-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download