gh0strat | 199f8f7408e54d7f6189d5d116110c8c31c511a584226b55b6857a9fd092321c

Analysis

max time kernel
143s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 16:18

Target

199f8f7408e54d7f6189d5d116110c8c31c511a584226b55b6857a9fd092321c.dll
Size

51KB
MD5

6826aaaeecdb9849839876267fadfdc9
SHA1

d8e1110bd1888c59c32a71b9500d62bf8ddc7512
SHA256

199f8f7408e54d7f6189d5d116110c8c31c511a584226b55b6857a9fd092321c
SHA512

bade8ff9e64964d0a79c18b4ec253d1e4f319ff0f591dce97d661c897902c13c6690be069e0366ad3563fe0555579e8815382788b180510f4f83366f4940c1bd
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL4JYH5:1dWubF3n9S91BF3fboMJYH5

Score

10^/10

gh0strat rat

Family

gh0strat

kinh.xmcxmr.com

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/1924-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1924	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 1924	960	rundll32.exe	82
PID 960 wrote to memory of 1924	960	rundll32.exe	82
PID 960 wrote to memory of 1924	960	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\199f8f7408e54d7f6189d5d116110c8c31c511a584226b55b6857a9fd092321c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\199f8f7408e54d7f6189d5d116110c8c31c511a584226b55b6857a9fd092321c.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1924

memory/1924-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download