gh0strat | 476695b51acd31a245dc4e8232b200aea3de01889e361066199aa9955ab4c8f4

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 19:17

Target

476695b51acd31a245dc4e8232b200aea3de01889e361066199aa9955ab4c8f4.dll
Size

51KB
MD5

7ccfadea9702fae6ec5e28b27eaf2916
SHA1

6d060649de133175acb5698ae9e56210ef6dffa6
SHA256

476695b51acd31a245dc4e8232b200aea3de01889e361066199aa9955ab4c8f4
SHA512

f48f6c14b87c5ca9aea8a734c40685439c7bed23874a2deeb34948be557b9cccdb03d10a30080e235ad0814bc12d4da3817dfa00bca06281a4d184246f058ca9
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLHJYH5:1dWubF3n9S91BF3fboLJYH5

Score

10^/10

gh0strat rat

Family

gh0strat

kinh.xmcxmr.com

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2000-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

2000 rundll32.exe

pid	process
2000	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2368 wrote to memory of 2000	2368	rundll32.exe	rundll32.exe
PID 2368 wrote to memory of 2000	2368	rundll32.exe	rundll32.exe
PID 2368 wrote to memory of 2000	2368	rundll32.exe	rundll32.exe
PID 2368 wrote to memory of 2000	2368	rundll32.exe	rundll32.exe
PID 2368 wrote to memory of 2000	2368	rundll32.exe	rundll32.exe
PID 2368 wrote to memory of 2000	2368	rundll32.exe	rundll32.exe
PID 2368 wrote to memory of 2000	2368	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\476695b51acd31a245dc4e8232b200aea3de01889e361066199aa9955ab4c8f4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2368

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\476695b51acd31a245dc4e8232b200aea3de01889e361066199aa9955ab4c8f4.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:2000

memory/2000-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download