gh0strat | 963364a366a3d5320a9b4e043457ffdfa7e7680660763e39f18bbc725f6233fb

Analysis

max time kernel
145s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 11:21

Target

963364a366a3d5320a9b4e043457ffdfa7e7680660763e39f18bbc725f6233fb.dll
Size

51KB
MD5

d8dca6dc6343d1238fc512c48c8dad71
SHA1

7f9fe035a84319021cc020df08b6f176b956507e
SHA256

963364a366a3d5320a9b4e043457ffdfa7e7680660763e39f18bbc725f6233fb
SHA512

e05806fd63b7cc9da27ffa5c18d96c1c0cf5c8d4c82aba4254dc410469b98ea631ea30068b0efa81fe81ca6271dcac479180db534758a058f6b53d7ada0e4f06
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLqJYH5:1dWubF3n9S91BF3fboGJYH5

Score

10^/10

gh0strat rat

Family

gh0strat

kinh.xmcxmr.com

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/2024-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2024	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3580 wrote to memory of 2024	3580	rundll32.exe	92
PID 3580 wrote to memory of 2024	3580	rundll32.exe	92
PID 3580 wrote to memory of 2024	3580	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\963364a366a3d5320a9b4e043457ffdfa7e7680660763e39f18bbc725f6233fb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3580
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\963364a366a3d5320a9b4e043457ffdfa7e7680660763e39f18bbc725f6233fb.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2232 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:5044

memory/2024-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download