gh0strat | ba8c5a1c56345ddbf8afe86f5c2677bb35205efd3591d3013d256bfc3a23e65a

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 23:17

Target

ba8c5a1c56345ddbf8afe86f5c2677bb35205efd3591d3013d256bfc3a23e65a.dll
Size

51KB
MD5

e9aa451ab180deb12be35c7f73dfa7bb
SHA1

7b5c58120ddadc801899c9c93c92c31c491886ff
SHA256

ba8c5a1c56345ddbf8afe86f5c2677bb35205efd3591d3013d256bfc3a23e65a
SHA512

8f8186162803fe1ee278e0338a7a2d56c14f663975cb5e6290578112b74c94a2a8b940658694c618a63a91aea962c226bcc57074ba6223770146c1a8a9e30141
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL3JYH5:1dWubF3n9S91BF3fbobJYH5

Score

10^/10

gh0strat rat

Family

gh0strat

kinh.xmcxmr.com

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/1908-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1908	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 1908	1912	rundll32.exe	28
PID 1912 wrote to memory of 1908	1912	rundll32.exe	28
PID 1912 wrote to memory of 1908	1912	rundll32.exe	28
PID 1912 wrote to memory of 1908	1912	rundll32.exe	28
PID 1912 wrote to memory of 1908	1912	rundll32.exe	28
PID 1912 wrote to memory of 1908	1912	rundll32.exe	28
PID 1912 wrote to memory of 1908	1912	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba8c5a1c56345ddbf8afe86f5c2677bb35205efd3591d3013d256bfc3a23e65a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba8c5a1c56345ddbf8afe86f5c2677bb35205efd3591d3013d256bfc3a23e65a.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1908

memory/1908-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download