gh0strat | dcfd421c5625ede80a52ff57fa6b619447f2d67545b2aea37b2d6e4049ada840

Analysis

max time kernel
147s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 23:20

Target

dcfd421c5625ede80a52ff57fa6b619447f2d67545b2aea37b2d6e4049ada840.dll
Size

51KB
MD5

56f555ea4a6ef1249214c5be8b7a8453
SHA1

aed95bf249c476e30b026ba210d4d93332934587
SHA256

dcfd421c5625ede80a52ff57fa6b619447f2d67545b2aea37b2d6e4049ada840
SHA512

c9ce10e365d3c8436f4a6767f9ef721561871d1c5122c158903ae9322c7435d0e51397dc9a17f52f9d248d4530d1999138bdc90e65ce8721f044d794060c5437
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL+3JYH5:1dWubF3n9S91BF3fbowJYH5

Score

10^/10

gh0strat rat

Family

gh0strat

kinh.xmcxmr.com

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/3552-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3552	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 3552	4004	rundll32.exe	83
PID 4004 wrote to memory of 3552	4004	rundll32.exe	83
PID 4004 wrote to memory of 3552	4004	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dcfd421c5625ede80a52ff57fa6b619447f2d67545b2aea37b2d6e4049ada840.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dcfd421c5625ede80a52ff57fa6b619447f2d67545b2aea37b2d6e4049ada840.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:3552

memory/3552-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download