gh0strat | dbe37d3f6c5927b8d8875b7f44c35b351c72a7f0a8a7d884fb5690b47bbb3d41

Analysis

max time kernel
146s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
14-05-2024 00:14

Target

dbe37d3f6c5927b8d8875b7f44c35b351c72a7f0a8a7d884fb5690b47bbb3d41.dll
Size

899KB
MD5

59a678a0b21d20b8f644843d2972a3dc
SHA1

c57c3b971cb3fd413ca7d395d4e674a4c1e5edc7
SHA256

dbe37d3f6c5927b8d8875b7f44c35b351c72a7f0a8a7d884fb5690b47bbb3d41
SHA512

e457a65f6567ed83b8627e08db347155fb314b1ec668ada64c0cb9af69f1337590ebeafcd62219b58a603ab0e11348ad810d4377ce04774e0837247367fcd028
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXi:7wqd87Vi

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/3640-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3640	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 3640	2688	rundll32.exe	83
PID 2688 wrote to memory of 3640	2688	rundll32.exe	83
PID 2688 wrote to memory of 3640	2688	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dbe37d3f6c5927b8d8875b7f44c35b351c72a7f0a8a7d884fb5690b47bbb3d41.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dbe37d3f6c5927b8d8875b7f44c35b351c72a7f0a8a7d884fb5690b47bbb3d41.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:3640

memory/3640-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download