gh0strat | e3af91720312870eaa83906a33a1afc46bbe24fedc996dcb1afce27d52d00921

Analysis

max time kernel
140s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 19:21

Target

e3af91720312870eaa83906a33a1afc46bbe24fedc996dcb1afce27d52d00921.dll
Size

51KB
MD5

437e4416973e0732da07beb3113a395c
SHA1

7447520176fb3aa614bca30b7298f9cc62b3061b
SHA256

e3af91720312870eaa83906a33a1afc46bbe24fedc996dcb1afce27d52d00921
SHA512

edb9ca5685c4e8b507a141f299224506d888befb2eed4f9715cb5b8d44275254ce3e116ddd8380d04d32ac097a5b1fe1b0023c7abf948e5a01f65a57f4ae9953
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLIJYH5:1dWubF3n9S91BF3fbo8JYH5

Score

10^/10

gh0strat rat

Family

gh0strat

kinh.xmcxmr.com

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5024-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

5024 rundll32.exe

pid	process
5024	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4872 wrote to memory of 5024	4872	rundll32.exe	rundll32.exe
PID 4872 wrote to memory of 5024	4872	rundll32.exe	rundll32.exe
PID 4872 wrote to memory of 5024	4872	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e3af91720312870eaa83906a33a1afc46bbe24fedc996dcb1afce27d52d00921.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4872

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e3af91720312870eaa83906a33a1afc46bbe24fedc996dcb1afce27d52d00921.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:5024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3416,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:8
1⤵
PID:2700

memory/5024-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download