gh0strat | 120dd47b435168180c31caa1136c512525c5db6e22cc55ebd5593817f207f3d8

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 22:15

Target

120dd47b435168180c31caa1136c512525c5db6e22cc55ebd5593817f207f3d8.dll
Size

899KB
MD5

7f290a8ef94cac1d79b1677595f08675
SHA1

cadbe9a8d67de02b9c888dcd4c37a02151cd6778
SHA256

120dd47b435168180c31caa1136c512525c5db6e22cc55ebd5593817f207f3d8
SHA512

ee38410d5e54aa3917f220ae2e882994a7617795de34fcd326bd5824a0da06e3485bc393064d3c74dc250feb766bdafd1b26538e5813f20f295e5683ef5cc608
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXQ:7wqd87VQ

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/2552-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2552	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 516 wrote to memory of 2552	516	rundll32.exe	83
PID 516 wrote to memory of 2552	516	rundll32.exe	83
PID 516 wrote to memory of 2552	516	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\120dd47b435168180c31caa1136c512525c5db6e22cc55ebd5593817f207f3d8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:516
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\120dd47b435168180c31caa1136c512525c5db6e22cc55ebd5593817f207f3d8.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2552

memory/2552-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download